openpond 0.2.0 → 0.2.2

package/dist/chunks/organizations-CPNC47DO.js

@@ -1,806 +0,0 @@
-import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
-import "./chunk-XA4KBDMY.js";
-import "./chunk-NTK22KJD.js";
-import "./chunk-R3C3MNSI.js";
-import "./chunk-X7ZG4TSW.js";
-import {
-  resolveSandboxClient
-} from "./chunk-3VEYNDHN.js";
-import "./chunk-FJ2JGB2N.js";
-import "./chunk-SMNFI2FU.js";
-import "./chunk-KSRWKXRB.js";
-import "./chunk-PS37DB5F.js";
-import "./chunk-4KA25HUP.js";
-import "./chunk-ZNQEROWP.js";
-import "./chunk-7RIGZB7N.js";
-import "./chunk-4L3ZJS2T.js";
-import {
-  DEFAULT_OPENPOND_API_BASE_URL,
-  DEFAULT_OPENPOND_WEB_BASE_URL
-} from "./chunk-JTHL5XJ2.js";
-import "./chunk-FQS2QL5F.js";
-import {
-  parseBooleanOption,
-  parseCsvOption,
-  parseIntegerOption,
-  parseJsonOption
-} from "./chunk-MUMPWI4O.js";
-import "./chunk-UACZUFIA.js";
-
-// src/cli/organizations.ts
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-
-// ../../packages/runtime/src/urls.ts
-var DEFAULT_OPENPOND_API_HOST = new URL(DEFAULT_OPENPOND_API_BASE_URL).hostname;
-var DEFAULT_OPENPOND_WEB_HOST = new URL(DEFAULT_OPENPOND_WEB_BASE_URL).hostname;
-var DEFAULT_OPENPOND_OPCHAT_API_BASE_URL = `${DEFAULT_OPENPOND_API_BASE_URL}/opchat/v1`;
-
-// ../../packages/runtime/src/system-browser.ts
-import { spawn } from "node:child_process";
-function resolveSystemBrowserCommand(url, platform = process.platform) {
-  if (platform === "darwin") return { command: "open", args: [url] };
-  if (platform === "win32") {
-    return {
-      command: "rundll32.exe",
-      args: ["url.dll,FileProtocolHandler", url]
-    };
-  }
-  return { command: "xdg-open", args: [url] };
-}
-async function openUrlWithSystemBrowser(url, options = {}) {
-  const browser = options.command ?? resolveSystemBrowserCommand(url);
-  const handoffTimeoutMs = options.handoffTimeoutMs ?? 1500;
-  return new Promise((resolve) => {
-    let settled = false;
-    let timer = null;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      resolve(result);
-    };
-    const child = spawn(browser.command, browser.args, {
-      detached: false,
-      shell: false,
-      stdio: "ignore",
-      windowsHide: true
-    });
-    child.once("error", (error) => {
-      const code = error.code;
-      finish({
-        opened: false,
-        error: code ? `browser launcher ${browser.command} failed (${code})` : `browser launcher ${browser.command} failed`
-      });
-    });
-    child.once("close", (code, signal) => {
-      if (code === 0) {
-        finish({ opened: true });
-        return;
-      }
-      const detail = signal ? `signal ${signal}` : `code ${code ?? "unknown"}`;
-      finish({ opened: false, error: `browser launcher ${browser.command} exited with ${detail}` });
-    });
-    timer = setTimeout(() => {
-      child.unref();
-      finish({ opened: true });
-    }, handoffTimeoutMs);
-    timer.unref();
-  });
-}
-
-// src/cli/organizations.ts
-function formatOrganizationLine(organization) {
-  return [
-    organization.slug,
-    `team=${organization.teamId}`,
-    `role=${organization.role}`,
-    `status=${organization.status}`,
-    organization.displayName
-  ].join("  ");
-}
-function formatOrganizationMemberLine(member) {
-  return [
-    member.email ?? member.userId,
-    `user=${member.userId}`,
-    `role=${member.role}`,
-    member.createdAt
-  ].join("  ");
-}
-function formatOrganizationMcpServerLine(server) {
-  if (!server) return "no mcp server configured";
-  return [
-    server.slug,
-    `team=${server.teamId}`,
-    `status=${server.status}`,
-    `tools=${server.toolset.join(",") || "-"}`,
-    server.resourceUrl
-  ].join("  ");
-}
-var DEFAULT_MCP_AUTHORIZE_SCOPES = [
-  "estimate.read",
-  "estimate.write",
-  "estimate.execute",
-  "artifacts.read",
-  "artifacts.write"
-];
-function normalizeMcpResourceUrl(url) {
-  const trimmed = url.trim().replace(/\/$/, "");
-  if (!trimmed) {
-    throw new Error("MCP resource URL must be non-empty");
-  }
-  const parsed = new URL(trimmed);
-  return parsed.toString().replace(/\/$/, "");
-}
-function resolveMcpProbeResourceUrl(server, options) {
-  const explicit = typeof options.resourceUrl === "string" && options.resourceUrl.trim() ? options.resourceUrl.trim() : typeof options.url === "string" && options.url.trim() ? options.url.trim() : "";
-  if (explicit) {
-    return normalizeMcpResourceUrl(explicit);
-  }
-  if (!server?.resourceUrl) {
-    throw new Error(
-      "organization does not have an MCP server; run organizations mcp-generate first"
-    );
-  }
-  return normalizeMcpResourceUrl(server.resourceUrl);
-}
-function resolveMcpProbeOrigin(resourceUrl, options) {
-  const explicit = typeof options.origin === "string" && options.origin.trim() ? options.origin.trim() : "";
-  if (explicit) {
-    return normalizeMcpResourceUrl(explicit);
-  }
-  return new URL(resourceUrl).origin;
-}
-function randomOauthToken(bytes = 32) {
-  return randomBytes(bytes).toString("base64url");
-}
-function buildMcpOauthPkceChallenge(verifier) {
-  return createHash("sha256").update(verifier).digest("base64url");
-}
-function parseMcpOAuthScopes(options) {
-  const raw = typeof options.scope === "string" && options.scope.trim() ? options.scope : typeof options.scopes === "string" && options.scopes.trim() ? options.scopes : "";
-  if (!raw) {
-    return [...DEFAULT_MCP_AUTHORIZE_SCOPES];
-  }
-  const scopes = raw.split(/[,\s]+/g).map((scope) => scope.trim()).filter(Boolean);
-  if (scopes.length === 0) {
-    throw new Error("scope must include at least one OAuth scope");
-  }
-  return scopes;
-}
-function resolveMcpOAuthClientId(options) {
-  const value = typeof options.clientId === "string" && options.clientId.trim() ? options.clientId.trim() : "openpond-code-mcp-proof";
-  if (value === "true") {
-    throw new Error("client-id must be a non-empty value");
-  }
-  return value;
-}
-function resolveMcpOAuthTimeoutMs(options) {
-  const timeoutSeconds = parseIntegerOption(options.timeoutSeconds, "timeout-seconds") ?? parseIntegerOption(options.timeout, "timeout") ?? 180;
-  if (timeoutSeconds <= 0) {
-    throw new Error("timeout must be greater than zero");
-  }
-  return timeoutSeconds * 1e3;
-}
-function resolveMcpOAuthCallbackPort(options) {
-  const port = parseIntegerOption(options.callbackPort, "callback-port") ?? 0;
-  if (port < 0 || port > 65535) {
-    throw new Error("callback-port must be between 0 and 65535");
-  }
-  return port;
-}
-function closeServer(server) {
-  return new Promise((resolve, reject) => {
-    server.close((error) => {
-      if (error) reject(error);
-      else resolve();
-    });
-  });
-}
-async function startMcpOAuthCallbackListener(input) {
-  let settled = false;
-  let timeout = null;
-  let resolveCallback = null;
-  let rejectCallback = null;
-  const callbackPromise = new Promise(
-    (resolve, reject) => {
-      resolveCallback = resolve;
-      rejectCallback = reject;
-    }
-  );
-  const settle = (response, status, body, result, error) => {
-    if (settled) {
-      response.writeHead(204).end();
-      return;
-    }
-    settled = true;
-    response.writeHead(status, {
-      "cache-control": "no-store",
-      "content-type": "text/html; charset=utf-8"
-    });
-    response.end(body);
-    if (timeout) clearTimeout(timeout);
-    if (result) {
-      resolveCallback?.(result);
-    } else {
-      rejectCallback?.(error ?? new Error("oauth_callback_failed"));
-    }
-  };
-  const server = createServer((request, response) => {
-    const host = request.headers.host ?? "127.0.0.1";
-    const url = new URL(request.url ?? "/", `http://${host}`);
-    if (url.pathname !== "/callback") {
-      response.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      response.end("Not found");
-      return;
-    }
-    const state = url.searchParams.get("state") ?? "";
-    const error = url.searchParams.get("error") ?? "";
-    const code = url.searchParams.get("code") ?? "";
-    if (state !== input.expectedState) {
-      settle(
-        response,
-        400,
-        "<!doctype html><title>OpenPond OAuth failed</title><p>State mismatch. Return to the terminal and retry.</p>",
-        void 0,
-        new Error("oauth_state_mismatch")
-      );
-      return;
-    }
-    if (error) {
-      settle(
-        response,
-        400,
-        "<!doctype html><title>OpenPond OAuth denied</title><p>Authorization was not completed. Return to the terminal.</p>",
-        void 0,
-        new Error(`oauth_authorization_failed:${error}`)
-      );
-      return;
-    }
-    if (!code) {
-      settle(
-        response,
-        400,
-        "<!doctype html><title>OpenPond OAuth failed</title><p>Missing authorization code. Return to the terminal and retry.</p>",
-        void 0,
-        new Error("oauth_code_missing")
-      );
-      return;
-    }
-    settle(
-      response,
-      200,
-      "<!doctype html><title>OpenPond OAuth complete</title><p>Authorization complete. You can return to the terminal.</p>",
-      { code, state }
-    );
-  });
-  await new Promise((resolve, reject) => {
-    const onError = (error) => {
-      server.off("listening", onListening);
-      reject(error);
-    };
-    const onListening = () => {
-      server.off("error", onError);
-      resolve();
-    };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(input.port, "127.0.0.1");
-  });
-  const address = server.address();
-  if (!address || typeof address.port !== "number") {
-    await closeServer(server);
-    throw new Error("oauth_callback_listener_failed");
-  }
-  timeout = setTimeout(() => {
-    if (!settled) {
-      settled = true;
-      rejectCallback?.(new Error("oauth_callback_timeout"));
-    }
-  }, input.timeoutMs);
-  return {
-    close: async () => {
-      if (timeout) clearTimeout(timeout);
-      await closeServer(server).catch(() => {
-      });
-    },
-    redirectUri: `http://127.0.0.1:${address.port}/callback`,
-    waitForCallback: () => callbackPromise
-  };
-}
-function openUrlWithSystemBrowser2(url) {
-  void openUrlWithSystemBrowser(url);
-}
-function buildMcpOAuthAuthorizeUrl(input) {
-  const url = new URL(input.authorizationEndpoint);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", input.clientId);
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  url.searchParams.set("code_challenge", input.codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("resource", input.resourceUrl);
-  url.searchParams.set("scope", input.scopes.join(" "));
-  url.searchParams.set("state", input.state);
-  return url.toString();
-}
-async function exchangeMcpOAuthAuthorizationCode(input) {
-  const params = new URLSearchParams();
-  params.set("grant_type", "authorization_code");
-  params.set("client_id", input.clientId);
-  params.set("redirect_uri", input.redirectUri);
-  params.set("code", input.code);
-  params.set("code_verifier", input.codeVerifier);
-  const response = await fetch(`${input.origin}/oauth/token`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/x-www-form-urlencoded"
-    },
-    body: params
-  });
-  const body = await readMcpProbeBody(response);
-  if (!response.ok) {
-    throw new Error(
-      `oauth_token_exchange_failed:${response.status}:${JSON.stringify(body)}`
-    );
-  }
-  if (!body || typeof body !== "object" || Array.isArray(body)) {
-    throw new Error("oauth_token_exchange_invalid_response");
-  }
-  const token = body;
-  if (typeof token.access_token !== "string" || !token.access_token.trim()) {
-    throw new Error("oauth_token_exchange_missing_access_token");
-  }
-  return {
-    access_token: token.access_token,
-    ...typeof token.expires_in === "number" ? { expires_in: token.expires_in } : {},
-    ...typeof token.refresh_token === "string" ? { refresh_token: token.refresh_token } : {},
-    ...typeof token.scope === "string" ? { scope: token.scope } : {},
-    ...typeof token.token_type === "string" ? { token_type: token.token_type } : {}
-  };
-}
-async function readMcpProbeBody(response) {
-  const text = await response.text().catch(() => "");
-  if (!text) {
-    return null;
-  }
-  const trimmed = text.trim();
-  const contentType = response.headers.get("content-type") ?? "";
-  if (contentType.toLowerCase().includes("application/json") || trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    try {
-      return JSON.parse(trimmed);
-    } catch {
-      return text;
-    }
-  }
-  return text;
-}
-async function fetchMcpProbe(url, init = {}) {
-  const response = await fetch(url, init);
-  return {
-    url,
-    status: response.status,
-    ok: response.ok,
-    headers: {
-      contentType: response.headers.get("content-type"),
-      location: response.headers.get("location"),
-      wwwAuthenticate: response.headers.get("www-authenticate")
-    },
-    body: await readMcpProbeBody(response)
-  };
-}
-function buildMcpJsonRpcRequest(id, method, params) {
-  return params ? { jsonrpc: "2.0", id, method, params } : { jsonrpc: "2.0", id, method };
-}
-function parseMcpToolArguments(options) {
-  const raw = typeof options.arguments === "string" && options.arguments.trim() ? options.arguments : typeof options.args === "string" && options.args.trim() ? options.args : "";
-  if (!raw) {
-    return {};
-  }
-  const parsed = parseJsonOption(raw, "arguments");
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("arguments must be a JSON object");
-  }
-  return parsed;
-}
-async function postMcpJsonRpcProbe(input) {
-  const headers = {
-    "content-type": "application/json"
-  };
-  if (input.accessToken) {
-    headers.authorization = `Bearer ${input.accessToken}`;
-  }
-  return fetchMcpProbe(input.resourceUrl, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(
-      buildMcpJsonRpcRequest(input.id, input.method, input.params)
-    )
-  });
-}
-async function probeOrganizationMcp(input) {
-  const resourceUrl = normalizeMcpResourceUrl(input.resourceUrl);
-  const origin = normalizeMcpResourceUrl(input.origin);
-  const protectedResourceUrl = `${resourceUrl}/.well-known/oauth-protected-resource`;
-  const authorizationServerUrl = `${origin}/.well-known/oauth-authorization-server`;
-  const [
-    protectedResource,
-    authorizationServer,
-    directGetChallenge,
-    initialize,
-    toolsList,
-    unauthenticatedToolCall,
-    authenticatedToolCall
-  ] = await Promise.all([
-    fetchMcpProbe(protectedResourceUrl),
-    fetchMcpProbe(authorizationServerUrl),
-    fetchMcpProbe(resourceUrl),
-    postMcpJsonRpcProbe({
-      resourceUrl,
-      id: 1,
-      method: "initialize"
-    }),
-    postMcpJsonRpcProbe({
-      resourceUrl,
-      id: 2,
-      method: "tools/list"
-    }),
-    postMcpJsonRpcProbe({
-      resourceUrl,
-      id: 3,
-      method: "tools/call",
-      params: {
-        name: input.toolName,
-        arguments: input.toolArguments
-      }
-    }),
-    input.accessToken ? postMcpJsonRpcProbe({
-      resourceUrl,
-      id: 4,
-      method: "tools/call",
-      params: {
-        name: input.toolName,
-        arguments: input.toolArguments
-      },
-      accessToken: input.accessToken
-    }) : Promise.resolve(null)
-  ]);
-  return {
-    resourceUrl,
-    origin,
-    protectedResource,
-    authorizationServer,
-    directGetChallenge,
-    initialize,
-    toolsList,
-    unauthenticatedToolCall,
-    ...authenticatedToolCall ? { authenticatedToolCall } : {}
-  };
-}
-function parseOrganizationRole(value) {
-  const role = typeof value === "string" ? value.trim() : "";
-  if (role === "owner" || role === "admin" || role === "member") {
-    return role;
-  }
-  throw new Error("role must be owner, admin, or member");
-}
-function buildOrganizationCreateInput(options) {
-  const displayName = typeof options.displayName === "string" && options.displayName.trim() ? options.displayName.trim() : typeof options.name === "string" && options.name.trim() ? options.name.trim() : "";
-  if (!displayName) {
-    throw new Error(
-      "usage: organizations create --name <name> [--slug <slug>]"
-    );
-  }
-  return {
-    displayName,
-    ...typeof options.slug === "string" && options.slug.trim() ? { slug: options.slug.trim() } : {},
-    ...typeof options.primaryContactEmail === "string" && options.primaryContactEmail.trim() ? { primaryContactEmail: options.primaryContactEmail.trim() } : {},
-    ...typeof options.customDomain === "string" && options.customDomain.trim() ? { customDomain: options.customDomain.trim() } : {}
-  };
-}
-function buildOrganizationUpdateInput(options) {
-  const input = {};
-  const displayName = typeof options.displayName === "string" && options.displayName.trim() ? options.displayName.trim() : typeof options.name === "string" && options.name.trim() ? options.name.trim() : "";
-  if (displayName) input.displayName = displayName;
-  if (typeof options.slug === "string" && options.slug.trim()) {
-    input.slug = options.slug.trim();
-  }
-  if (typeof options.primaryContactEmail === "string") {
-    input.primaryContactEmail = options.primaryContactEmail.trim() || null;
-  }
-  if (typeof options.customDomain === "string") {
-    input.customDomain = options.customDomain.trim() || null;
-  }
-  if (typeof options.status === "string" && options.status.trim()) {
-    const status = options.status.trim();
-    if (status !== "active" && status !== "disabled" && status !== "archived") {
-      throw new Error("status must be active, disabled, or archived");
-    }
-    input.status = status;
-  }
-  if (Object.keys(input).length === 0) {
-    throw new Error("organizations update requires at least one changed field");
-  }
-  return input;
-}
-function buildOrganizationMemberInput(options) {
-  const email = typeof options.email === "string" ? options.email.trim() : "";
-  if (!email) {
-    throw new Error(
-      "usage: organizations member-upsert <slug> --email <email> --role <role>"
-    );
-  }
-  return {
-    email,
-    role: parseOrganizationRole(options.role)
-  };
-}
-function buildOrganizationMcpGenerateInput(options) {
-  return {
-    ...typeof options.origin === "string" && options.origin.trim() ? { origin: options.origin.trim() } : {},
-    ...typeof options.toolset === "string" && options.toolset.trim() ? { toolset: parseCsvOption(options.toolset) } : {}
-  };
-}
-async function runOrganizationsCommand(options, rest) {
-  const subcommand = rest[0] || "list";
-  const client = await resolveSandboxClient(options);
-  const outputJson = parseBooleanOption(options.json);
-  if (subcommand === "list") {
-    const organizations = await client.listOrganizations();
-    if (outputJson) {
-      console.log(JSON.stringify({ organizations }, null, 2));
-      return;
-    }
-    if (organizations.length === 0) {
-      console.log("no organizations found");
-      return;
-    }
-    for (const organization of organizations) {
-      console.log(formatOrganizationLine(organization));
-    }
-    return;
-  }
-  if (subcommand === "create") {
-    const organization = await client.createOrganization(
-      buildOrganizationCreateInput(options)
-    );
-    console.log(JSON.stringify({ organization }, null, 2));
-    return;
-  }
-  if (subcommand === "get") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error("usage: organizations get <slug>");
-    }
-    const organization = await client.getOrganization(slug);
-    console.log(JSON.stringify({ organization }, null, 2));
-    return;
-  }
-  if (subcommand === "update") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error("usage: organizations update <slug> [--name <name>]");
-    }
-    const organization = await client.updateOrganization(
-      slug,
-      buildOrganizationUpdateInput(options)
-    );
-    console.log(JSON.stringify({ organization }, null, 2));
-    return;
-  }
-  if (subcommand === "members" || subcommand === "member-list") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error("usage: organizations members <slug>");
-    }
-    const members = await client.listOrganizationMembers(slug);
-    if (outputJson) {
-      console.log(JSON.stringify({ members }, null, 2));
-      return;
-    }
-    if (members.length === 0) {
-      console.log("no organization members found");
-      return;
-    }
-    for (const member of members) {
-      console.log(formatOrganizationMemberLine(member));
-    }
-    return;
-  }
-  if (subcommand === "member-upsert" || subcommand === "member-add") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error(
-        "usage: organizations member-upsert <slug> --email <email> --role <role>"
-      );
-    }
-    const member = await client.upsertOrganizationMember(
-      slug,
-      buildOrganizationMemberInput(options)
-    );
-    console.log(JSON.stringify({ member }, null, 2));
-    return;
-  }
-  if (subcommand === "mcp-get" || subcommand === "mcp-server") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error("usage: organizations mcp-get <slug>");
-    }
-    const mcpServer = await client.getOrganizationMcpServer(slug);
-    if (outputJson) {
-      console.log(JSON.stringify({ mcpServer }, null, 2));
-      return;
-    }
-    console.log(formatOrganizationMcpServerLine(mcpServer));
-    return;
-  }
-  if (subcommand === "mcp-generate") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error(
-        "usage: organizations mcp-generate <slug> [--origin <url>]"
-      );
-    }
-    const mcpServer = await client.generateOrganizationMcpServer(
-      slug,
-      buildOrganizationMcpGenerateInput(options)
-    );
-    console.log(JSON.stringify({ mcpServer }, null, 2));
-    return;
-  }
-  if (subcommand === "mcp-probe" || subcommand === "mcp-inspect") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error(
-        "usage: organizations mcp-probe <slug> [--origin <url>] [--tool <name>] [--arguments <json>] [--access-token <token>]"
-      );
-    }
-    const mcpServer = await client.getOrganizationMcpServer(slug);
-    const resourceUrl = resolveMcpProbeResourceUrl(mcpServer, options);
-    const origin = resolveMcpProbeOrigin(resourceUrl, options);
-    const toolName = typeof options.tool === "string" && options.tool.trim() ? options.tool.trim() : typeof options.toolName === "string" && options.toolName.trim() ? options.toolName.trim() : "estimate_search_history";
-    const toolArguments = parseMcpToolArguments(options);
-    const accessToken = typeof options.accessToken === "string" && options.accessToken.trim() ? options.accessToken.trim() : "";
-    const probe = await probeOrganizationMcp({
-      resourceUrl,
-      origin,
-      toolName,
-      toolArguments,
-      ...accessToken ? { accessToken } : {}
-    });
-    console.log(JSON.stringify({ mcpServer, probe }, null, 2));
-    return;
-  }
-  if (subcommand === "mcp-authorize" || subcommand === "mcp-oauth") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error(
-        "usage: organizations mcp-authorize <slug> [--origin <url>] [--scope <csv|space>] [--tool <name>] [--arguments <json>] [--open]"
-      );
-    }
-    const mcpServer = await client.getOrganizationMcpServer(slug);
-    const resourceUrl = resolveMcpProbeResourceUrl(mcpServer, options);
-    const origin = resolveMcpProbeOrigin(resourceUrl, options);
-    const clientId = resolveMcpOAuthClientId(options);
-    const scopes = parseMcpOAuthScopes(options);
-    const state = randomOauthToken(18);
-    const codeVerifier = randomOauthToken(48);
-    const codeChallenge = buildMcpOauthPkceChallenge(codeVerifier);
-    const callback = await startMcpOAuthCallbackListener({
-      expectedState: state,
-      port: resolveMcpOAuthCallbackPort(options),
-      timeoutMs: resolveMcpOAuthTimeoutMs(options)
-    });
-    const authorizationUrl = buildMcpOAuthAuthorizeUrl({
-      authorizationEndpoint: `${origin}/oauth/authorize`,
-      clientId,
-      codeChallenge,
-      redirectUri: callback.redirectUri,
-      resourceUrl,
-      scopes,
-      state
-    });
-    console.error(
-      "Open this URL to authorize the organization MCP connection:"
-    );
-    console.error(authorizationUrl);
-    console.error(`Waiting for OAuth callback on ${callback.redirectUri}`);
-    if (parseBooleanOption(options.open)) {
-      try {
-        openUrlWithSystemBrowser2(authorizationUrl);
-      } catch (error) {
-        console.error(
-          `Unable to open a browser automatically: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-    try {
-      const callbackResult = await callback.waitForCallback();
-      const token = await exchangeMcpOAuthAuthorizationCode({
-        clientId,
-        code: callbackResult.code,
-        codeVerifier,
-        origin,
-        redirectUri: callback.redirectUri
-      });
-      const toolName = typeof options.tool === "string" && options.tool.trim() ? options.tool.trim() : typeof options.toolName === "string" && options.toolName.trim() ? options.toolName.trim() : "estimate_search_history";
-      const toolArguments = parseMcpToolArguments(options);
-      const probe = await probeOrganizationMcp({
-        accessToken: token.access_token,
-        origin,
-        resourceUrl,
-        toolArguments,
-        toolName
-      });
-      const printToken = parseBooleanOption(options.printToken);
-      console.log(
-        JSON.stringify(
-          {
-            mcpServer,
-            oauth: {
-              accessTokenReceived: true,
-              clientId,
-              expiresIn: token.expires_in ?? null,
-              refreshTokenReceived: Boolean(token.refresh_token),
-              scope: token.scope ?? scopes.join(" "),
-              tokenType: token.token_type ?? "Bearer",
-              ...printToken ? {
-                accessToken: token.access_token,
-                refreshToken: token.refresh_token ?? null
-              } : {}
-            },
-            probe
-          },
-          null,
-          2
-        )
-      );
-    } finally {
-      await callback.close();
-    }
-    return;
-  }
-  if (subcommand === "mcp-rotate" || subcommand === "mcp-disable" || subcommand === "mcp-enable") {
-    const slug = rest[1];
-    if (!slug) {
-      throw new Error(`usage: organizations ${subcommand} <slug>`);
-    }
-    const mcpServer = subcommand === "mcp-rotate" ? await client.rotateOrganizationMcpServer(slug) : subcommand === "mcp-disable" ? await client.disableOrganizationMcpServer(slug) : await client.enableOrganizationMcpServer(slug);
-    console.log(JSON.stringify({ mcpServer }, null, 2));
-    return;
-  }
-  throw new Error(
-    "usage: organizations <list|create|get|update|members|member-upsert|mcp-get|mcp-generate|mcp-probe|mcp-authorize|mcp-rotate|mcp-disable|mcp-enable> [args]"
-  );
-}
-export {
-  DEFAULT_MCP_AUTHORIZE_SCOPES,
-  buildMcpJsonRpcRequest,
-  buildMcpOAuthAuthorizeUrl,
-  buildMcpOauthPkceChallenge,
-  buildOrganizationCreateInput,
-  buildOrganizationMcpGenerateInput,
-  buildOrganizationMemberInput,
-  buildOrganizationUpdateInput,
-  closeServer,
-  exchangeMcpOAuthAuthorizationCode,
-  fetchMcpProbe,
-  formatOrganizationLine,
-  formatOrganizationMcpServerLine,
-  formatOrganizationMemberLine,
-  normalizeMcpResourceUrl,
-  openUrlWithSystemBrowser2 as openUrlWithSystemBrowser,
-  parseMcpOAuthScopes,
-  parseMcpToolArguments,
-  parseOrganizationRole,
-  postMcpJsonRpcProbe,
-  probeOrganizationMcp,
-  randomOauthToken,
-  readMcpProbeBody,
-  resolveMcpOAuthCallbackPort,
-  resolveMcpOAuthClientId,
-  resolveMcpOAuthTimeoutMs,
-  resolveMcpProbeOrigin,
-  resolveMcpProbeResourceUrl,
-  runOrganizationsCommand,
-  startMcpOAuthCallbackListener
-};