lagora-cli 1.1.0

package/dist/scripts/chunk-NCJMUBTG.js

@@ -0,0 +1,125 @@
+// scripts/issue-local-client.ts
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+async function fetchIssueFromStore(issueId, format) {
+  const { getIssue } = await import("./storage-234FBH54.js");
+  const record = await getIssue(issueId);
+  if (!record) throw new Error(`Issue not found: ${issueId}`);
+  printIssueRecord(record, format);
+}
+function printIssueRecord(record, format) {
+  if (format === "json") {
+    console.log(JSON.stringify(record, null, 2));
+    return;
+  }
+  const latestRun = record.verificationRuns.at(-1);
+  console.log(`# ${record.issue.title}`);
+  console.log(`id: ${record.issue.id}`);
+  console.log(`status: ${record.issue.status}`);
+  console.log(`reporter: ${record.issue.creator}`);
+  console.log(`assignee: ${record.issue.assignee?.name ?? "none"}`);
+  console.log(`occurrences: ${record.issue.occurrenceCount}`);
+  console.log(`tags: ${record.issue.tags.join(", ") || "none"}`);
+  console.log(`kernel: ${record.artifacts.find((artifact) => artifact.id === record.bundle.kernelArtifactId)?.filename ?? "missing"}`);
+  if (latestRun) {
+    console.log(`latestVerification: ${latestRun.kind} ${latestRun.status}${latestRun.failedStage ? ` failedStage=${latestRun.failedStage}` : ""}`);
+  }
+  console.log("");
+  console.log(record.issue.description || "No description supplied.");
+}
+async function checkoutIssueFromStore(issueId, out, author) {
+  const { getIssue } = await import("./storage-234FBH54.js");
+  const initialRecord = await getIssue(issueId);
+  if (initialRecord?.issue.status === "open") {
+    const { updateIssueStatus } = await import("./storage-234FBH54.js");
+    await updateIssueStatus(issueId, "investigating", author);
+  }
+  const record = await getIssue(issueId);
+  if (!record) throw new Error(`Issue not found: ${issueId}`);
+  const targetRoot = path.resolve(out?.trim() || path.join("lagora-issues", issueId));
+  await mkdir(targetRoot, { recursive: true });
+  await writeFile(path.join(targetRoot, "issue.json"), `${JSON.stringify(record, null, 2)}
+`);
+  const issueStoreRoot = process.env.AGORA_ISSUE_STORE ? path.resolve(process.env.AGORA_ISSUE_STORE) : path.join(process.cwd(), "issue-store");
+  for (const artifact of record.artifacts) {
+    if (artifact.storage !== "issue-store" || !artifact.relativePath) continue;
+    await copyFile(path.join(issueStoreRoot, artifact.relativePath), path.join(targetRoot, artifact.filename));
+  }
+  console.log(`Issue ${issueId} checked out to ${targetRoot}`);
+}
+async function saveSuggestionToStore(input) {
+  const file = path.resolve(input.file);
+  const content = await readFile(file, "utf8");
+  const filename = input.filename?.trim() || path.basename(file);
+  const { addKernelSuggestion, getIssue, updateKernelSuggestion } = await import("./storage-234FBH54.js");
+  const record = await getIssue(input.issueId);
+  if (!record) throw new Error(`Issue not found: ${input.issueId}`);
+  const baseArtifactId = input.baseArtifactId?.trim() || record.bundle.kernelArtifactId;
+  if (input.suggestionArtifactId?.trim()) {
+    await updateKernelSuggestion({
+      issueId: input.issueId,
+      baseArtifactId,
+      suggestionArtifactId: input.suggestionArtifactId.trim(),
+      filename,
+      content,
+      author: input.author
+    });
+    console.log(`Suggestion updated for ${input.issueId}`);
+    return;
+  }
+  await addKernelSuggestion({ issueId: input.issueId, baseArtifactId, filename, content, author: input.author });
+  console.log(`Suggestion added to ${input.issueId}`);
+}
+async function assignIssueInStore(input) {
+  const { assignIssue, clearIssueAssignee } = await import("./storage-234FBH54.js");
+  if (input.assignee) {
+    await assignIssue({ issueId: input.issueId, assignee: input.assignee, actor: input.author });
+  } else {
+    await clearIssueAssignee(input.issueId, input.author);
+  }
+  console.log(`Assignee updated: ${input.issueId} -> ${input.assignee || "unassigned"}`);
+}
+async function updateIssueStatusInStore(issueId, status, author) {
+  const { updateIssueStatus } = await import("./storage-234FBH54.js");
+  await updateIssueStatus(issueId, status, author);
+  console.log(`Status updated: ${issueId} -> ${status}`);
+}
+async function addBlockerToStore(input) {
+  const { addIssueBlocker } = await import("./storage-234FBH54.js");
+  const blocker = await addIssueBlocker({
+    issueId: input.issueId,
+    repository: input.repository?.trim() || void 0,
+    number: input.number,
+    actor: input.author
+  });
+  console.log(`Blocker linked: ${input.issueId} -> ${blocker.repository}#${blocker.number} (${blocker.status})`);
+}
+async function syncBlockerInStore(input) {
+  const { syncIssueBlocker } = await import("./storage-234FBH54.js");
+  const blocker = await syncIssueBlocker({ issueId: input.issueId, blockerId: input.blockerId, actor: input.author });
+  console.log(`Blocker synced: ${input.issueId} -> ${blocker.repository}#${blocker.number} (${blocker.status})`);
+}
+async function updateIssueDescriptionInStore(issueId, description, author) {
+  const { updateIssueDescription } = await import("./storage-234FBH54.js");
+  try {
+    await updateIssueDescription({ issueId, description, actor: author });
+  } catch (error) {
+    if (error instanceof Error && error.message === "issue_description_forbidden") {
+      throw new Error(`Only the reporter can rewrite this issue; --author is currently "${author}"`);
+    }
+    throw error;
+  }
+  console.log(`Description updated for ${issueId}`);
+}
+
+export {
+  fetchIssueFromStore,
+  printIssueRecord,
+  checkoutIssueFromStore,
+  saveSuggestionToStore,
+  assignIssueInStore,
+  updateIssueStatusInStore,
+  addBlockerToStore,
+  syncBlockerInStore,
+  updateIssueDescriptionInStore
+};

package/dist/scripts/chunk-QJPQHKIO.js

@@ -0,0 +1,23 @@
+// lib/vendor-id.ts
+var LEGACY_CREATOR_VENDOR_ID = "hyperaccel";
+var vendorIdPattern = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isVendorId(value) {
+  return vendorIdPattern.test(value);
+}
+function parseVendorId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return isVendorId(trimmed) ? trimmed : void 0;
+}
+function normalizeVendorId(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return LEGACY_CREATOR_VENDOR_ID;
+  const parsed = parseVendorId(trimmed);
+  if (!parsed) throw new Error(`Invalid vendor id: ${trimmed}`);
+  return parsed;
+}
+
+export {
+  parseVendorId,
+  normalizeVendorId
+};

package/dist/scripts/chunk-RIR5KGHC.js

@@ -0,0 +1,33 @@
+import {
+  sdkRuntimeToolchainEnv
+} from "./chunk-UQ6I6VTY.js";
+
+// lib/verification-lowering-env.ts
+import path from "node:path";
+function loweringWorkerEnv(runtime, baseEnv = process.env) {
+  const toolchainEnv = sdkRuntimeToolchainEnv(baseEnv);
+  return {
+    ...toolchainEnv,
+    HOME: baseEnv.HOME,
+    LANG: baseEnv.LANG,
+    LC_ALL: baseEnv.LC_ALL,
+    NODE_ENV: nodeEnv(baseEnv.NODE_ENV),
+    PATH: toolchainEnv.PATH,
+    AGORA_SDK_ROOT: runtime.preparedRoot,
+    AGORA_SDK_PREPARED_ROOT: runtime.preparedRoot,
+    LEGATO_KERNEL_FUNCTION: baseEnv.LEGATO_KERNEL_FUNCTION,
+    PYTHONPATH: [
+      baseEnv.AGORA_SDK_PYTHONPATH,
+      baseEnv.AGORA_PYTHONPATH_EXTRA,
+      baseEnv.PYTHONPATH
+    ].filter(Boolean).join(path.delimiter)
+  };
+}
+function nodeEnv(value) {
+  if (value === "production" || value === "test") return value;
+  return "development";
+}
+
+export {
+  loweringWorkerEnv
+};

package/dist/scripts/chunk-TJZVQYBL.js

@@ -0,0 +1,8 @@
+// lib/base-path.ts
+var appBasePath = "/legato-dev-agora";
+var publicAppUrl = `https://public.hyperaccel.net${appBasePath}`;
+var internalAppUrl = `https://legato-dev-agora.hyperaccel.net${appBasePath}`;
+
+export {
+  internalAppUrl
+};

package/dist/scripts/chunk-UHJXD4TG.js

@@ -0,0 +1,18 @@
+// lib/server/issue-store-paths.ts
+import path from "node:path";
+function getIssueStoreRoot() {
+  return process.env.AGORA_ISSUE_STORE ? path.resolve(process.env.AGORA_ISSUE_STORE) : path.resolve("issue-store");
+}
+function safeJoin(root, ...segments) {
+  const resolvedRoot = path.resolve(root);
+  const target = path.resolve(resolvedRoot, ...segments);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new Error(`Path escapes storage root: ${segments.join("/")}`);
+  }
+  return target;
+}
+
+export {
+  getIssueStoreRoot,
+  safeJoin
+};

package/dist/scripts/chunk-UQ6I6VTY.js

@@ -0,0 +1,117 @@
+// lib/server/sdk-runtime-cache.ts
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+var CACHE_VERSION = "sdk-prepare-cache-v1";
+var TOOLCHAIN_FINGERPRINT = "llvm20-openmp";
+var SOURCE_FINGERPRINT_VERSION = "sdk-prepare-source-v1";
+var LLVM_ROOT = "/usr/lib/llvm-20";
+var LLVM_BIN = `${LLVM_ROOT}/bin`;
+var LLVM_LIB = `${LLVM_ROOT}/lib`;
+var SDK_PREPARE_SOURCE_PATHS = ["legato", "host_runtime", "misc", "pyproject.toml", "uv.lock", "3rdparty"];
+function sdkPrepareCacheStatePath(settings) {
+  return path.join(settings.runtimeRoot, ".agora", "sdk-prepare-cache", `${path.basename(settings.preparedRoot)}.json`);
+}
+function sdkPrepareCacheFingerprint(settings) {
+  const input = [
+    CACHE_VERSION,
+    process.env.AGORA_SDK_TOOLCHAIN_FINGERPRINT ?? TOOLCHAIN_FINGERPRINT,
+    settings.prepareCommand
+  ].join("\n");
+  return createHash("sha256").update(input).digest("hex");
+}
+function sdkPrepareSourceFingerprint(treeListing) {
+  return createHash("sha256").update(`${SOURCE_FINGERPRINT_VERSION}
+${treeListing}`).digest("hex");
+}
+function sdkPrepareCacheEnv(settings) {
+  const cacheRoot = path.join(settings.runtimeRoot, ".agora", "cache");
+  return {
+    ...sdkRuntimeToolchainEnv(),
+    UV_CACHE_DIR: process.env.UV_CACHE_DIR ?? path.join(cacheRoot, "uv"),
+    // The uv-managed CPython interpreter must live on the shared runtime volume, not the
+    // ephemeral container filesystem. The prepared .venv symlinks bin/python at this interpreter;
+    // if it defaults to ~/.local/share/uv/python inside the prepare job pod, the symlink dangles
+    // once that pod exits and every later probe/lowering from another pod fails with ENOENT.
+    UV_PYTHON_INSTALL_DIR: process.env.UV_PYTHON_INSTALL_DIR ?? path.join(cacheRoot, "python"),
+    CCACHE_DIR: process.env.CCACHE_DIR ?? path.join(cacheRoot, "ccache"),
+    CCACHE_BASEDIR: process.env.CCACHE_BASEDIR ?? settings.preparedRoot,
+    UV_LINK_MODE: process.env.UV_LINK_MODE ?? "copy",
+    UV_LOCK_TIMEOUT: process.env.UV_LOCK_TIMEOUT ?? "900"
+  };
+}
+function sdkRuntimeToolchainEnv(env = process.env) {
+  return {
+    PATH: prependPath(LLVM_BIN, env.PATH),
+    LD_LIBRARY_PATH: prependPath(LLVM_LIB, env.LD_LIBRARY_PATH),
+    CC: env.CC ?? "clang-20",
+    CXX: env.CXX ?? "clang++-20",
+    CMAKE_PREFIX_PATH: env.CMAKE_PREFIX_PATH ?? LLVM_ROOT,
+    LLVM_DIR: env.LLVM_DIR ?? `${LLVM_LIB}/cmake/llvm`,
+    MLIR_DIR: env.MLIR_DIR ?? `${LLVM_LIB}/cmake/mlir`,
+    OpenMP_ROOT: env.OpenMP_ROOT ?? LLVM_ROOT
+  };
+}
+function prependPath(prefix, value) {
+  return value ? `${prefix}${path.delimiter}${value}` : prefix;
+}
+async function readSdkPrepareCacheState(settings) {
+  try {
+    const parsed = JSON.parse(await readFile(sdkPrepareCacheStatePath(settings), "utf8"));
+    return parseCacheState(parsed);
+  } catch {
+    return void 0;
+  }
+}
+function sdkPrepareCacheStateMatches(settings, state, commitSha, sourceFingerprint) {
+  return Boolean(state) && state?.status === "ready" && state.repoUrl === settings.repoUrl && state.branch === settings.branch && state.fingerprint === sdkPrepareCacheFingerprint(settings) && (state.sourceFingerprint ? state.sourceFingerprint === sourceFingerprint : state.commitSha === commitSha) && path.resolve(state.preparedRoot) === settings.preparedRoot;
+}
+async function writeSdkPrepareCacheState(settings, commitSha, sourceFingerprint, updatedAt) {
+  const state = {
+    status: "ready",
+    repoUrl: settings.repoUrl,
+    branch: settings.branch,
+    commitSha,
+    fingerprint: sdkPrepareCacheFingerprint(settings),
+    sourceFingerprint,
+    preparedRoot: settings.preparedRoot,
+    updatedAt
+  };
+  const statePath = sdkPrepareCacheStatePath(settings);
+  await mkdir(path.dirname(statePath), { recursive: true });
+  await writeFile(statePath, `${JSON.stringify(state, null, 2)}
+`);
+  return state;
+}
+function parseCacheState(value) {
+  if (!isRecord(value)) return void 0;
+  if (value.status !== "ready") return void 0;
+  const repoUrl = readString(value, "repoUrl");
+  const branch = readString(value, "branch");
+  const commitSha = readString(value, "commitSha");
+  const fingerprint = readString(value, "fingerprint");
+  const sourceFingerprint = readString(value, "sourceFingerprint");
+  const preparedRoot = readString(value, "preparedRoot");
+  const updatedAt = readString(value, "updatedAt");
+  if (!repoUrl || !branch || !commitSha || !fingerprint || !preparedRoot || !updatedAt) return void 0;
+  return { status: "ready", repoUrl, branch, commitSha, fingerprint, sourceFingerprint, preparedRoot, updatedAt };
+}
+function readString(record, key) {
+  const value = record[key];
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+export {
+  SDK_PREPARE_SOURCE_PATHS,
+  sdkPrepareCacheStatePath,
+  sdkPrepareCacheFingerprint,
+  sdkPrepareSourceFingerprint,
+  sdkPrepareCacheEnv,
+  sdkRuntimeToolchainEnv,
+  readSdkPrepareCacheState,
+  sdkPrepareCacheStateMatches,
+  writeSdkPrepareCacheState
+};

package/dist/scripts/cli-auth.js

@@ -0,0 +1,348 @@
+import {
+  LagoraCliConfigStore,
+  baseApiUrl,
+  defaultApiUrl,
+  requestHeaders
+} from "./chunk-AZ3EEBVD.js";
+import "./chunk-TJZVQYBL.js";
+
+// scripts/cli-auth.ts
+import { pathToFileURL as packageFileUrl } from "node:url";
+import { execFile } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var callbackPath = "/oauth/callback";
+var loginTimeoutMs = 5 * 60 * 1e3;
+var logoutTimeoutMs = 3e3;
+async function loginWithBrowser(apiUrl, openBrowser = openSystemBrowser) {
+  const normalizedApiUrl = baseApiUrl(apiUrl);
+  const verifier = randomBytes(32).toString("base64url");
+  const state = randomBytes(24).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  const callback = await listenForCallback(state);
+  try {
+    const start = new URL(`${normalizedApiUrl}/api/auth/native/start`);
+    start.search = new URLSearchParams({
+      challenge,
+      state,
+      client: "cli",
+      callback: callback.url
+    }).toString();
+    console.log(`Open this URL to sign in:
+${start.toString()}`);
+    try {
+      await openBrowser(start.toString());
+    } catch (error) {
+      console.warn(`Could not open a browser automatically: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const code = await callback.code;
+    return await exchangeCode(normalizedApiUrl, code, verifier);
+  } finally {
+    await closeServer(callback.server);
+  }
+}
+async function validateCliSession(session) {
+  if (!session.token) throw new Error("Run `lagora login` first");
+  const target = baseApiUrl(session.apiUrl);
+  let response;
+  try {
+    response = await fetch(`${target}/api/auth/native/session`, {
+      headers: requestHeaders(session),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch {
+    throw new Error(`CLI session validation could not reach ${target}`);
+  }
+  if (response.status === 401) throw new Error("CLI login expired; run `lagora login` again");
+  if (!response.ok) throw new Error(`CLI session validation failed for ${target}: HTTP ${response.status}`);
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new Error(`CLI session validation returned an invalid response from ${target}`);
+    }
+    throw error;
+  }
+  const parsed = readSessionPayload(payload);
+  if (!parsed || parsed.scope !== "cli" || !parsed.user) {
+    throw new Error(`CLI session validation returned an invalid response from ${target}`);
+  }
+  return parsed.user;
+}
+async function revokeCliSession(session) {
+  if (!session.token) return;
+  const response = await fetch(`${baseApiUrl(session.apiUrl)}/api/auth/native/session`, {
+    method: "DELETE",
+    headers: requestHeaders(session),
+    signal: AbortSignal.timeout(logoutTimeoutMs)
+  });
+  if (!response.ok && response.status !== 401) {
+    throw new Error(`CLI logout failed: HTTP ${response.status}`);
+  }
+}
+async function logoutCliSession(session, clearLocalSession, revokeRemoteSession = revokeCliSession) {
+  await clearLocalSession();
+  if (!session) return { remoteRevoked: true };
+  try {
+    await revokeRemoteSession(session);
+    return { remoteRevoked: true };
+  } catch (error) {
+    return {
+      remoteRevoked: false,
+      warning: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function listCliTokens(session) {
+  const payload = await cliTokensRequest(session, "GET", "");
+  const tokens = Reflect.get(payload, "tokens");
+  if (!Array.isArray(tokens)) throw new Error("CLI token list returned an invalid response");
+  return {
+    tokens: tokens.map(readTokenSummary).filter((token) => Boolean(token)),
+    currentTokenId: readString(payload, "currentTokenId")
+  };
+}
+async function revokeCliTokens(session, target) {
+  if (Boolean(target.all) === Boolean(target.tokenId)) {
+    throw new Error("Usage: lagora tokens revoke --token <token-id> | --all");
+  }
+  const query = target.all ? "?all=1" : `?tokenId=${encodeURIComponent(target.tokenId ?? "")}`;
+  const payload = await cliTokensRequest(session, "DELETE", query);
+  const revoked = Reflect.get(payload, "revoked");
+  if (!Array.isArray(revoked)) throw new Error("CLI token revoke returned an invalid response");
+  return {
+    revoked: revoked.filter((id) => typeof id === "string"),
+    currentRevoked: Reflect.get(payload, "currentRevoked") === true
+  };
+}
+function formatCliTokens(listing) {
+  if (listing.tokens.length === 0) return "No active CLI tokens";
+  return listing.tokens.map((token) => `${token.id}  scope=${token.scope}  created=${token.createdAt}  expires=${token.expiresAt}${token.current ? "  (current)" : ""}`).join("\n");
+}
+async function cliTokensRequest(session, method, query) {
+  if (!session.token) throw new Error("Run `lagora login` first");
+  const response = await fetch(`${baseApiUrl(session.apiUrl)}/api/auth/native/cli-tokens${query}`, {
+    method,
+    headers: requestHeaders(session),
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (response.status === 401) throw new Error("CLI login expired; run `lagora login` again");
+  if (response.status === 403) throw new Error("That CLI token belongs to another account");
+  if (response.status === 404) throw new Error("No such active CLI token");
+  if (!response.ok) throw new Error(`CLI token request failed: HTTP ${response.status}`);
+  return response.json();
+}
+function readTokenSummary(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const id = readString(value, "id");
+  if (!id) return void 0;
+  return {
+    id,
+    scope: readString(value, "scope"),
+    createdAt: readString(value, "createdAt"),
+    expiresAt: readString(value, "expiresAt"),
+    current: Reflect.get(value, "current") === true
+  };
+}
+async function runTokensCommand(session, store, argv) {
+  const subcommand = argv[0] ?? "list";
+  if (subcommand === "list") {
+    console.log(formatCliTokens(await listCliTokens(session)));
+    return;
+  }
+  if (subcommand !== "revoke") throw new Error("Usage: lagora tokens list|revoke [--token <token-id>|--all]");
+  const tokenId = optionValue(argv, "--token");
+  const result = await revokeCliTokens(session, {
+    ...argv.includes("--all") ? { all: true } : {},
+    ...tokenId ? { tokenId } : {}
+  });
+  console.log(result.revoked.length === 1 ? "Revoked 1 CLI token" : `Revoked ${result.revoked.length} CLI tokens`);
+  if (!result.currentRevoked) return;
+  await store.clear();
+  console.log("This CLI login was revoked; run `lagora login` again");
+}
+var localStoreCommands = /* @__PURE__ */ new Set([
+  "report",
+  "search",
+  "fetch",
+  "comment",
+  "status",
+  "description",
+  "suggestion",
+  "assign",
+  "blocker",
+  "feedback",
+  "issue",
+  "verify"
+]);
+function invocationRequiresAuth(command, argv) {
+  if (argv.includes("--help") || argv.includes("-h")) return false;
+  if (command === "skill") return false;
+  return !(localStoreCommands.has(command) && argv.includes("--store") && !argv.includes("--api-url"));
+}
+async function main() {
+  const command = process.argv[2] ?? "";
+  const store = new LagoraCliConfigStore();
+  if (command === "login") {
+    const apiUrl = optionValue(process.argv.slice(3), "--api-url") ?? process.env.LAGORA_API_URL?.trim() ?? (await store.read()).apiUrl?.trim() ?? defaultApiUrl;
+    console.log("Opening your browser. Sign in with Keycloak, then choose the activity profile for that browser.");
+    const result = await loginWithBrowser(apiUrl);
+    await store.write({ apiUrl: baseApiUrl(apiUrl), name: result.user.displayName, nativeToken: result.token });
+    console.log(`Logged in as ${result.user.displayName}`);
+    return;
+  }
+  if (command === "require-auth") {
+    const targetCommand = process.argv[3] ?? "";
+    if (!invocationRequiresAuth(targetCommand, process.argv.slice(4))) return;
+  }
+  const stored = await store.apiSession(void 0);
+  if (command === "logout") {
+    const result = await logoutCliSession(stored, () => store.clear());
+    if (result.warning) console.warn(`Local logout completed, but remote token revocation failed: ${result.warning}`);
+    console.log("Logged out");
+    return;
+  }
+  if (!stored?.token) throw new Error("Run `lagora login` first");
+  const explicitApiUrl = optionValue(process.argv.slice(3), "--api-url");
+  if (explicitApiUrl && baseApiUrl(explicitApiUrl) !== baseApiUrl(stored.apiUrl)) {
+    throw new Error(`Saved CLI login belongs to ${stored.apiUrl}; run \`lagora login --api-url ${baseApiUrl(explicitApiUrl)}\` first`);
+  }
+  const session = { apiUrl: stored.apiUrl, cookie: stored.cookie, token: stored.token };
+  if (command === "token") {
+    process.stdout.write(stored.token);
+    return;
+  }
+  if (command === "target") {
+    process.stdout.write(stored.apiUrl);
+    return;
+  }
+  if (command === "tokens") {
+    await runTokensCommand(session, store, process.argv.slice(3));
+    return;
+  }
+  const user = await validateCliSession(session);
+  if (command === "whoami") {
+    console.log(user.displayName);
+    return;
+  }
+  if (command === "require-auth") return;
+  throw new Error("Usage: lagora login|logout|whoami|tokens");
+}
+async function listenForCallback(state) {
+  let resolveCode;
+  let rejectCode;
+  const code = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (request.method !== "GET" || url.pathname !== callbackPath) {
+      response.writeHead(404).end();
+      return;
+    }
+    if (url.searchParams.get("state") !== state) {
+      response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Invalid login state.");
+      return;
+    }
+    const authorizationCode = url.searchParams.get("code")?.trim();
+    if (!authorizationCode) {
+      response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Missing authorization code.");
+      return;
+    }
+    response.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+    response.end("Lagora CLI login complete. You can close this window.");
+    resolveCode?.(authorizationCode);
+  });
+  server.on("error", (error) => rejectCode?.(error));
+  await new Promise((resolve, reject) => {
+    server.listen(0, "127.0.0.1", resolve);
+    server.once("error", reject);
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") throw new Error("Failed to bind OAuth callback");
+  const timer = setTimeout(() => rejectCode?.(new Error("Browser login timed out")), loginTimeoutMs);
+  timer.unref();
+  void code.then(() => clearTimeout(timer), () => clearTimeout(timer));
+  return { server, url: `http://127.0.0.1:${address.port}${callbackPath}`, code };
+}
+async function exchangeCode(apiUrl, code, codeVerifier) {
+  const response = await fetch(`${apiUrl}/api/auth/native/exchange`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, codeVerifier }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) throw new Error(`CLI token exchange failed: HTTP ${response.status}`);
+  const payload = await response.json();
+  const parsed = readSessionPayload(payload);
+  const token = readString(payload, "token");
+  if (!parsed || parsed.scope !== "cli" || !parsed.user || !token) {
+    throw new Error("CLI token exchange returned an invalid response");
+  }
+  return { token, user: parsed.user };
+}
+function readSessionPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const scope = readString(value, "scope");
+  const rawUser = Reflect.get(value, "user");
+  if (rawUser === null) return { scope, user: null };
+  if (!rawUser || typeof rawUser !== "object" || Array.isArray(rawUser)) return void 0;
+  const id = readString(rawUser, "id");
+  const displayName = readString(rawUser, "displayName");
+  return id && displayName ? { scope, user: { id, displayName } } : void 0;
+}
+function readString(value, key) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "";
+  const field = Reflect.get(value, key);
+  return typeof field === "string" ? field.trim() : "";
+}
+function optionValue(argv, option) {
+  let value;
+  let seen = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] !== option) continue;
+    if (seen) throw new Error(`Pass ${option} at most once`);
+    seen = true;
+    const candidate = argv[index + 1]?.trim();
+    if (!candidate || candidate.startsWith("--")) throw new Error(`${option} requires a value`);
+    value = candidate;
+  }
+  return value;
+}
+async function openSystemBrowser(url) {
+  if (process.platform === "darwin") {
+    await execFileAsync("open", [url]);
+    return;
+  }
+  if (process.platform === "win32") {
+    await execFileAsync("cmd", ["/c", "start", "", url]);
+    return;
+  }
+  await execFileAsync("xdg-open", [url]);
+}
+async function closeServer(server) {
+  if (!server.listening) return;
+  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+}
+if (import.meta.url === packageFileUrl(process.argv[1]).href) {
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+  });
+}
+export {
+  formatCliTokens,
+  invocationRequiresAuth,
+  listCliTokens,
+  loginWithBrowser,
+  logoutCliSession,
+  revokeCliSession,
+  revokeCliTokens,
+  validateCliSession
+};

package/dist/scripts/cli-config-IA7EOSYD.js

@@ -0,0 +1,7 @@
+import {
+  LagoraCliConfigStore
+} from "./chunk-AZ3EEBVD.js";
+import "./chunk-TJZVQYBL.js";
+export {
+  LagoraCliConfigStore
+};