recappi 0.1.0 → 0.1.1

package/dist/index.js

@@ -692,6 +692,7 @@ var init_tui = __esm({
 
 // src/cli.ts
 import { Command, CommanderError, InvalidArgumentError } from "commander/esm.mjs";
+import os3 from "os";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -15208,7 +15209,7 @@ function date4(params) {
 config(en_default());
 
 // ../../packages/contracts/src/index.ts
-var CLI_SCHEMA_VERSION = "2026-06-24";
+var CLI_SCHEMA_VERSION = "2026-06-25";
 function toJsonSchema(schema) {
   return external_exports.toJSONSchema(schema, { target: "draft-2020-12" });
 }
@@ -15262,6 +15263,22 @@ var authStatusDataSchema = external_exports.object({
   email: external_exports.string().optional(),
   userId: external_exports.string().optional()
 });
+var authLoginDataSchema = external_exports.object({
+  loggedIn: external_exports.literal(true),
+  origin: external_exports.string(),
+  email: external_exports.string().optional(),
+  userId: external_exports.string().optional()
+});
+var authLogoutDataSchema = external_exports.object({
+  loggedIn: external_exports.literal(false),
+  origin: external_exports.string(),
+  cleared: external_exports.boolean()
+});
+var authImportDataSchema = external_exports.object({
+  imported: external_exports.boolean(),
+  origin: external_exports.string(),
+  source: external_exports.literal("macos-keychain")
+});
 var uploadSuccessSchema = external_exports.object({
   filePath: external_exports.string(),
   recordingId: external_exports.string(),
@@ -15543,17 +15560,19 @@ async function resolveAuthContext(opts = {}) {
       token: config2.token,
       source: "config"
     };
-  const platform = opts.platform ?? process.platform;
-  if (platform === "darwin" && env.RECAPPI_DISABLE_KEYCHAIN_AUTH !== "1") {
-    const token = await readMacOSAppToken();
-    if (token) return { origin, token, source: "macos-keychain" };
+  if (opts.includeMacOSKeychain === true) {
+    const keychain = await inspectMacOSAppKeychain({
+      env,
+      platform: opts.platform
+    });
+    if (keychain.token) return { origin, token: keychain.token, source: "macos-keychain" };
   }
   return { origin, token: null, source: "none" };
 }
 function requireToken(ctx) {
   if (!ctx.token) {
     throw cliError("auth.not_logged_in", "Not logged in to Recappi.", {
-      hint: "Set RECAPPI_AUTH_TOKEN, or open Recappi Mini and sign in before retrying."
+      hint: "Run recappi auth login, or set RECAPPI_AUTH_TOKEN for automation."
     });
   }
   return ctx.token;
@@ -15579,14 +15598,61 @@ function validateOrigin(value) {
   }
   return url2.origin;
 }
+async function saveAuthConfig(homeDir, config2) {
+  const target = primaryConfigPath(homeDir);
+  await fs.mkdir(path.dirname(target), { recursive: true, mode: 448 });
+  const existing = await readConfigObject(target);
+  const next = {
+    ...existing,
+    origin: validateOrigin(config2.origin),
+    authToken: config2.token
+  };
+  const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
+  await fs.writeFile(tmp, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  await fs.rename(tmp, target);
+  await fs.chmod(target, 384).catch(() => {
+  });
+}
+async function clearAuthConfig(homeDir) {
+  const target = primaryConfigPath(homeDir);
+  const existing = await readConfigObject(target);
+  if (!("authToken" in existing)) return false;
+  delete existing.authToken;
+  await fs.mkdir(path.dirname(target), { recursive: true, mode: 448 });
+  await fs.writeFile(target, `${JSON.stringify(existing, null, 2)}
+`, { mode: 384 });
+  await fs.chmod(target, 384).catch(() => {
+  });
+  return true;
+}
+async function inspectMacOSAppKeychain(opts = {}) {
+  const env = opts.env ?? process.env;
+  if (env.RECAPPI_DISABLE_KEYCHAIN_AUTH === "1") {
+    return {
+      status: "disabled",
+      token: null,
+      message: "macOS app keychain lookup is disabled by RECAPPI_DISABLE_KEYCHAIN_AUTH=1."
+    };
+  }
+  const platform = opts.platform ?? process.platform;
+  if (platform !== "darwin") {
+    return {
+      status: "unsupported",
+      token: null,
+      message: "macOS app keychain lookup is only available on macOS."
+    };
+  }
+  return readMacOSAppToken();
+}
+function primaryConfigPath(homeDir) {
+  return path.join(homeDir, ".config", "recappi", "config.json");
+}
 async function readConfig(homeDir) {
-  const candidates = [
-    path.join(homeDir, ".config", "recappi", "config.json"),
-    path.join(homeDir, ".recappi", "config.json")
-  ];
+  const candidates = [primaryConfigPath(homeDir), path.join(homeDir, ".recappi", "config.json")];
   for (const candidate of candidates) {
     try {
-      const parsed = JSON.parse(await fs.readFile(candidate, "utf8"));
+      const parsed = await readConfigObject(candidate);
       const token = typeof parsed.authToken === "string" ? parsed.authToken.trim() : void 0;
       const origin = typeof parsed.origin === "string" ? parsed.origin.trim() : void 0;
       if (token || origin) return { ...token ? { token } : {}, ...origin ? { origin } : {} };
@@ -15601,6 +15667,14 @@ async function readConfig(homeDir) {
   }
   return {};
 }
+async function readConfigObject(candidate) {
+  try {
+    return JSON.parse(await fs.readFile(candidate, "utf8"));
+  } catch (error51) {
+    if (error51.code === "ENOENT") return {};
+    throw error51;
+  }
+}
 async function readMacOSAppToken() {
   try {
     const { stdout } = await execFileAsync(
@@ -15609,10 +15683,165 @@ async function readMacOSAppToken() {
       { timeout: 2e3, maxBuffer: 1024 * 1024 }
     );
     const token = stdout.trim();
-    return token.length > 0 ? token : null;
-  } catch {
-    return null;
+    if (token.length > 0) {
+      return {
+        status: "ok",
+        token,
+        message: "Found a Recappi Mini app token in the macOS keychain."
+      };
+    }
+    return {
+      status: "missing",
+      token: null,
+      message: "Recappi Mini app keychain item was present but empty."
+    };
+  } catch (error51) {
+    const err = error51;
+    const timedOut = err.killed || err.signal === "SIGTERM";
+    const stderr = typeof err.message === "string" ? err.message : "";
+    if (!timedOut && /could not be found|The specified item could not be found/i.test(stderr)) {
+      return {
+        status: "missing",
+        token: null,
+        message: "No Recappi Mini app token was found in the macOS keychain."
+      };
+    }
+    return {
+      status: "error",
+      token: null,
+      message: timedOut ? "Timed out while reading the Recappi Mini app keychain token." : "Could not read the Recappi Mini app keychain token.",
+      hint: "Use recappi auth login for the CLI, or run recappi auth import-macos explicitly if you want to import the app session."
+    };
+  }
+}
+
+// src/auth-login.ts
+import { execFile as execFile2 } from "child_process";
+import os2 from "os";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+async function loginWithDeviceCode(opts) {
+  const origin = validateOrigin(opts.origin);
+  const fetchImpl = opts.deps?.fetchImpl ?? fetch;
+  const sleep = opts.deps?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const start = await startDeviceAuth(origin, fetchImpl);
+  opts.onPrompt?.(
+    [
+      "To sign in to Recappi CLI:",
+      `  1. Open ${start.verificationUri}`,
+      `  2. Enter code: ${start.userCode}`,
+      ""
+    ].join("\n")
+  );
+  if (!opts.noOpen) {
+    const openUrl2 = opts.deps?.openUrl ?? openUrlWithSystemBrowser;
+    await openUrl2(start.verificationUriComplete).catch((error51) => {
+      opts.onPrompt?.(
+        `Could not open the browser automatically: ${error51 instanceof Error ? error51.message : String(error51)}
+`
+      );
+    });
+  }
+  let intervalMs = start.interval * 1e3;
+  const expiresAt = Date.now() + start.expiresIn * 1e3;
+  while (Date.now() < expiresAt) {
+    await sleep(intervalMs);
+    const poll = await pollDeviceAuth(origin, start.deviceCode, fetchImpl);
+    if (poll.status === "pending") {
+      if (typeof poll.interval === "number") intervalMs = poll.interval * 1e3;
+      continue;
+    }
+    if (poll.status === "slow_down") {
+      intervalMs = (typeof poll.interval === "number" ? poll.interval : intervalMs / 1e3 + 5) * 1e3;
+      continue;
+    }
+    if (poll.status === "denied") {
+      throw cliError("auth.unauthorized", "Recappi CLI sign-in was denied.");
+    }
+    if (poll.status === "expired") {
+      throw cliError("auth.unauthorized", "Recappi CLI sign-in code expired.", {
+        hint: "Run recappi auth login again."
+      });
+    }
+    if (poll.status === "authorized") {
+      const token = typeof poll.token === "string" ? poll.token.trim() : "";
+      if (!token) {
+        throw cliError("cloud.invalid_response", "Recappi device auth returned no token.");
+      }
+      const user = isRecord(poll.user) ? poll.user : {};
+      await saveAuthConfig(opts.homeDir ?? os2.homedir(), { origin, token });
+      return {
+        loggedIn: true,
+        origin,
+        ...typeof user.email === "string" ? { email: user.email } : {},
+        ...typeof user.id === "string" ? { userId: user.id } : {}
+      };
+    }
+    throw cliError("cloud.invalid_response", "Recappi device auth returned an unknown status.");
+  }
+  throw cliError("auth.unauthorized", "Recappi CLI sign-in timed out.", {
+    hint: "Run recappi auth login again."
+  });
+}
+async function startDeviceAuth(origin, fetchImpl) {
+  const response = await fetchImpl(new URL("/api/device-auth/start", origin), {
+    method: "POST"
+  });
+  if (!response.ok) {
+    throw cliError(
+      "cloud.http_error",
+      `Could not start Recappi device sign-in (${response.status}).`,
+      {
+        retryable: response.status >= 500
+      }
+    );
+  }
+  const body = await response.json();
+  const deviceCode = stringField(body.device_code, "device_code");
+  const userCode = stringField(body.user_code, "user_code");
+  const verificationUri = stringField(body.verification_uri, "verification_uri");
+  const verificationUriComplete = stringField(
+    body.verification_uri_complete,
+    "verification_uri_complete"
+  );
+  const expiresIn = numberField(body.expires_in, "expires_in");
+  const interval = numberField(body.interval, "interval");
+  return { deviceCode, userCode, verificationUri, verificationUriComplete, expiresIn, interval };
+}
+async function pollDeviceAuth(origin, deviceCode, fetchImpl) {
+  const response = await fetchImpl(new URL("/api/device-auth/poll", origin), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ device_code: deviceCode })
+  });
+  if (!response.ok) {
+    throw cliError("cloud.http_error", `Recappi device sign-in poll failed (${response.status}).`, {
+      retryable: response.status >= 500
+    });
   }
+  return await response.json();
+}
+async function openUrlWithSystemBrowser(url2) {
+  if (process.platform === "darwin") {
+    await execFileAsync2("/usr/bin/open", [url2]);
+    return;
+  }
+  if (process.platform === "win32") {
+    await execFileAsync2("cmd", ["/c", "start", "", url2]);
+    return;
+  }
+  await execFileAsync2("xdg-open", [url2]);
+}
+function stringField(value, name) {
+  if (typeof value === "string" && value.length > 0) return value;
+  throw cliError("cloud.invalid_response", `Recappi device auth response is missing ${name}.`);
+}
+function numberField(value, name) {
+  if (typeof value === "number" && Number.isFinite(value) && value > 0) return value;
+  throw cliError("cloud.invalid_response", `Recappi device auth response is missing ${name}.`);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
 }
 
 // src/api.ts
@@ -15779,9 +16008,11 @@ var RecappiApiClient = class {
     this.auth = auth;
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    this.env = opts.env ?? process.env;
   }
   fetchImpl;
   sleep;
+  env;
   async authStatus() {
     if (!this.auth.token) {
       return { loggedIn: false, origin: this.auth.origin };
@@ -15793,7 +16024,7 @@ var RecappiApiClient = class {
       return { loggedIn: false, origin: this.auth.origin };
     }
     const body = await parseJson(response);
-    const user = isRecord(body) && isRecord(body.user) ? body.user : void 0;
+    const user = isRecord2(body) && isRecord2(body.user) ? body.user : void 0;
     return {
       loggedIn: Boolean(user),
       origin: this.auth.origin,
@@ -15820,7 +16051,7 @@ var RecappiApiClient = class {
       status: this.auth.token ? "ok" : "error",
       message: this.auth.token ? `Found auth token from ${this.auth.source}.` : "No Recappi auth token found.",
       ...this.auth.token ? {} : {
-        hint: "Set RECAPPI_AUTH_TOKEN, configure ~/.config/recappi/config.json, or sign in with Recappi Mini on macOS."
+        hint: "Run recappi auth login, or set RECAPPI_AUTH_TOKEN for automation."
       }
     });
     if (this.auth.token) {
@@ -15830,7 +16061,9 @@ var RecappiApiClient = class {
           name: "auth.session",
           status: status2.loggedIn ? "ok" : "error",
           message: status2.loggedIn ? `Cloud session is valid${status2.email ? ` for ${status2.email}` : ""}.` : "Cloud did not accept the configured auth token.",
-          ...status2.loggedIn ? {} : { hint: "Refresh the token or sign in again before retrying cloud commands." }
+          ...status2.loggedIn ? {} : {
+            hint: `Run recappi auth login again. If you use --origin, make sure the token belongs to ${this.auth.origin}.`
+          }
         });
       } catch (error51) {
         const cli = toCliError(error51);
@@ -15842,6 +16075,13 @@ var RecappiApiClient = class {
         });
       }
     }
+    const keychain = await inspectMacOSAppKeychain({ env: this.env });
+    checks.push({
+      name: "auth.macos_keychain",
+      status: keychain.status === "error" ? "warn" : "ok",
+      message: keychain.message,
+      ...keychain.status === "ok" ? { hint: "Run recappi auth import-macos to copy this app session into CLI config." } : keychain.hint ? { hint: keychain.hint } : {}
+    });
     checks.push({
       name: "audio.wav",
       status: "ok",
@@ -15882,7 +16122,7 @@ var RecappiApiClient = class {
       limit: String(opts.limit)
     });
     const parsed = await this.getJson(`/api/jobs?${params}`);
-    const items = Array.isArray(parsed.items) ? parsed.items.filter(isRecord).map(mapJobListItem) : [];
+    const items = Array.isArray(parsed.items) ? parsed.items.filter(isRecord2).map(mapJobListItem) : [];
     return jobListDataSchema.parse({
       items,
       status: typeof parsed.status === "string" ? parsed.status : opts.status,
@@ -16035,7 +16275,7 @@ var RecappiApiClient = class {
           }
         );
         const parsed = await parseJson(response);
-        if (!isRecord(parsed) || typeof parsed.etag !== "string") {
+        if (!isRecord2(parsed) || typeof parsed.etag !== "string") {
           throw cliError("cloud.invalid_response", "Upload part response was missing etag.");
         }
         parts.push({ partNumber, etag: parsed.etag });
@@ -16107,8 +16347,8 @@ async function parseJson(response) {
 async function responseMessage(response) {
   try {
     const parsed = await response.clone().json();
-    if (isRecord(parsed) && typeof parsed.message === "string") return parsed.message;
-    if (isRecord(parsed) && typeof parsed.error === "string") return parsed.error;
+    if (isRecord2(parsed) && typeof parsed.message === "string") return parsed.message;
+    if (isRecord2(parsed) && typeof parsed.error === "string") return parsed.error;
   } catch {
   }
   try {
@@ -16118,7 +16358,7 @@ async function responseMessage(response) {
     return response.statusText;
   }
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function mapTranscript(row) {
@@ -16162,7 +16402,7 @@ function requiredNumber(row, key) {
 }
 function parseSegments(value, text, durationMs) {
   const decoded = decodeJsonArray(value);
-  const rawSegments = decoded.filter(isRecord).map((segment) => {
+  const rawSegments = decoded.filter(isRecord2).map((segment) => {
     const segmentText = typeof segment.text === "string" ? segment.text.trim() : "";
     if (!segmentText) return null;
     const start = typeof segment.start === "number" && segment.start >= 0 ? segment.start : 0;
@@ -16213,12 +16453,12 @@ function parseSummary(row) {
       if (strings.length > 0) summary[key] = strings;
     }
   }
-  const actionItems = Array.isArray(payload?.actionItems) ? payload.actionItems.filter(isRecord).flatMap((item) => {
+  const actionItems = Array.isArray(payload?.actionItems) ? payload.actionItems.filter(isRecord2).flatMap((item) => {
     if (typeof item.what !== "string" || !item.what.trim()) return [];
     return [{ what: item.what, ...typeof item.who === "string" ? { who: item.who } : {} }];
   }) : [];
   if (actionItems.length > 0) summary.actionItems = actionItems;
-  const quotes = Array.isArray(payload?.quotes) ? payload.quotes.filter(isRecord).flatMap((item) => {
+  const quotes = Array.isArray(payload?.quotes) ? payload.quotes.filter(isRecord2).flatMap((item) => {
     if (typeof item.text !== "string" || !item.text.trim()) return [];
     return [
       {
@@ -16228,7 +16468,7 @@ function parseSummary(row) {
     ];
   }) : [];
   if (quotes.length > 0) summary.quotes = quotes;
-  const timeline = Array.isArray(payload?.timeline) ? payload.timeline.filter(isRecord).flatMap((item) => {
+  const timeline = Array.isArray(payload?.timeline) ? payload.timeline.filter(isRecord2).flatMap((item) => {
     if (typeof item.startMs !== "number" || typeof item.endMs !== "number" || typeof item.title !== "string" || typeof item.summary !== "string") {
       return [];
     }
@@ -16248,7 +16488,7 @@ function parseSummary(row) {
   return summary;
 }
 function mapJobListItem(row) {
-  const recording = isRecord(row.recording) ? row.recording : {};
+  const recording = isRecord2(row.recording) ? row.recording : {};
   return {
     jobId: stringValue(row.jobId) ?? stringValue(row.id) ?? "",
     recordingId: stringValue(row.recordingId) ?? "",
@@ -16295,11 +16535,11 @@ function decodeJsonArray(value) {
   }
 }
 function decodeJsonRecord(value) {
-  if (isRecord(value)) return value;
+  if (isRecord2(value)) return value;
   if (typeof value !== "string" || !value.trim()) return null;
   try {
     const decoded = JSON.parse(value);
-    return isRecord(decoded) ? decoded : null;
+    return isRecord2(decoded) ? decoded : null;
   } catch {
     return null;
   }
@@ -16385,7 +16625,20 @@ function renderEnvelope(envelope, opts) {
 `);
 }
 function renderHumanSuccess(command, data, opts) {
-  if (command === "auth status" && isRecord2(data)) {
+  if (command === "auth login" && isRecord3(data)) {
+    opts.stdout(`Signed in${typeof data.email === "string" ? ` as ${data.email}` : ""}
+`);
+    return;
+  }
+  if (command === "auth logout" && isRecord3(data)) {
+    opts.stdout(data.cleared ? "Signed out of Recappi CLI\n" : "No Recappi CLI session to clear\n");
+    return;
+  }
+  if (command === "auth import-macos" && isRecord3(data)) {
+    opts.stdout("Imported the Recappi Mini app session into Recappi CLI\n");
+    return;
+  }
+  if (command === "auth status" && isRecord3(data)) {
     if (data.loggedIn) {
       opts.stdout(`Signed in${typeof data.email === "string" ? ` as ${data.email}` : ""}
 `);
@@ -16394,17 +16647,17 @@ function renderHumanSuccess(command, data, opts) {
     opts.stdout("Not logged in\n");
     return;
   }
-  if (command === "version" && isRecord2(data) && typeof data.version === "string") {
+  if (command === "version" && isRecord3(data) && typeof data.version === "string") {
     opts.stdout(`${data.version}
 `);
     return;
   }
-  if (command === "doctor" && isRecord2(data) && Array.isArray(data.checks)) {
+  if (command === "doctor" && isRecord3(data) && Array.isArray(data.checks)) {
     const status = typeof data.status === "string" ? data.status : "unknown";
     opts.stdout(`Doctor: ${status}
 `);
     for (const check2 of data.checks) {
-      if (!isRecord2(check2)) continue;
+      if (!isRecord3(check2)) continue;
       const checkStatus = typeof check2.status === "string" ? check2.status : "unknown";
       const name = typeof check2.name === "string" ? check2.name : "check";
       const message = typeof check2.message === "string" ? ` \u2014 ${check2.message}` : "";
@@ -16415,7 +16668,7 @@ function renderHumanSuccess(command, data, opts) {
     }
     return;
   }
-  if (command === "transcript get" && isRecord2(data)) {
+  if (command === "transcript get" && isRecord3(data)) {
     renderTranscriptHuman(data, opts);
     return;
   }
@@ -16448,7 +16701,7 @@ Next:
     }
     return;
   }
-  if ((command === "jobs wait" || command === "upload") && isRecord2(data)) {
+  if ((command === "jobs wait" || command === "upload") && isRecord3(data)) {
     if (typeof data.transcriptId === "string") {
       opts.stdout("Transcription ready\n");
       opts.stdout(`  transcriptId: ${data.transcriptId}
@@ -16469,10 +16722,10 @@ Next:
     }
     return;
   }
-  if (command === "schema" && isRecord2(data) && Array.isArray(data.commands)) {
+  if (command === "schema" && isRecord3(data) && Array.isArray(data.commands)) {
     opts.stdout("Commands:\n");
     for (const entry of data.commands) {
-      if (!isRecord2(entry) || typeof entry.name !== "string") continue;
+      if (!isRecord3(entry) || typeof entry.name !== "string") continue;
       const summary = typeof entry.summary === "string" ? ` \u2014 ${entry.summary}` : "";
       opts.stdout(`  ${entry.name}${summary}
 `);
@@ -16562,7 +16815,7 @@ function renderTranscriptHuman(data, opts) {
   const segments = Array.isArray(data.segments) ? data.segments : [];
   let printedBody = false;
   for (const segment of segments) {
-    if (!isRecord2(segment) || typeof segment.text !== "string") continue;
+    if (!isRecord3(segment) || typeof segment.text !== "string") continue;
     const clock = typeof segment.startMs === "number" ? `[${formatClock(segment.startMs / 1e3)}] ` : "";
     const speaker = typeof segment.speaker === "string" ? `${segment.speaker}: ` : "";
     opts.stdout(`${clock}${speaker}${segment.text}
@@ -16574,7 +16827,7 @@ function renderTranscriptHuman(data, opts) {
 `);
     printedBody = true;
   }
-  const summary = isRecord2(data.summary) ? data.summary : void 0;
+  const summary = isRecord3(data.summary) ? data.summary : void 0;
   if (!summary || summary.status !== "succeeded") return;
   if (typeof summary.tldr === "string" && summary.tldr.length > 0) {
     opts.stdout(`
@@ -16592,7 +16845,7 @@ Summary:
   if (Array.isArray(summary.actionItems) && summary.actionItems.length > 0) {
     opts.stdout("\nAction items:\n");
     for (const item of summary.actionItems) {
-      if (!isRecord2(item) || typeof item.what !== "string") continue;
+      if (!isRecord3(item) || typeof item.what !== "string") continue;
       const who = typeof item.who === "string" ? `${item.who}: ` : "";
       opts.stdout(`  - ${who}${item.what}
 `);
@@ -16627,7 +16880,7 @@ function applyFields(command, data, fields, compact) {
     };
     return compact ? compactData(filtered2) : filtered2;
   }
-  if (!isRecord2(data)) return data;
+  if (!isRecord3(data)) return data;
   const allowed = new Set(Object.keys(data));
   assertKnownFields(fields, allowed);
   const filtered = pickFields(data, fields);
@@ -16652,7 +16905,7 @@ function compactData(value) {
   if (Array.isArray(value)) {
     return value.map(compactData).filter((item) => item !== void 0);
   }
-  if (isRecord2(value)) {
+  if (isRecord3(value)) {
     const out = {};
     for (const [key, child] of Object.entries(value)) {
       const compacted = compactData(child);
@@ -16670,20 +16923,23 @@ function stableStringify(value, compact) {
 }
 function sortKeys(value) {
   if (Array.isArray(value)) return value.map(sortKeys);
-  if (!isRecord2(value)) return value;
+  if (!isRecord3(value)) return value;
   return Object.fromEntries(
     Object.keys(value).sort().map((key) => [key, sortKeys(value[key])])
   );
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isUploadBatch(value) {
-  return isRecord2(value) && Array.isArray(value.successes) && Array.isArray(value.failures);
+  return isRecord3(value) && Array.isArray(value.successes) && Array.isArray(value.failures);
 }
 
 // src/schema.ts
 var COMMAND_DATA_SCHEMAS = {
+  "auth login": authLoginDataSchema,
+  "auth logout": authLogoutDataSchema,
+  "auth import-macos": authImportDataSchema,
   "auth status": authStatusDataSchema,
   doctor: doctorDataSchema,
   upload: uploadBatchDataSchema,
@@ -16814,8 +17070,16 @@ async function runCli(deps = {}) {
       renderSuccess("version", { version: CLI_VERSION }, render2);
       return 0;
     }
-    const auth = await resolveAuthContext({ origin: parsed.options.origin, env: deps.env });
-    const client = new RecappiApiClient(auth, { fetchImpl: deps.fetchImpl, sleep: deps.sleep });
+    const auth = await resolveAuthContext({
+      origin: parsed.options.origin,
+      env: deps.env,
+      homeDir: deps.homeDir
+    });
+    const client = new RecappiApiClient(auth, {
+      fetchImpl: deps.fetchImpl,
+      sleep: deps.sleep,
+      env: deps.env
+    });
     if (parsed.kind === "dashboard") {
       const runDashboard2 = deps.runDashboard ?? (await Promise.resolve().then(() => (init_tui(), tui_exports))).runDashboard;
       await runDashboard2({
@@ -16830,6 +17094,44 @@ async function runCli(deps = {}) {
       renderSuccess("auth status", data, render2);
       return data.loggedIn ? 0 : 3;
     }
+    if (parsed.kind === "auth-login") {
+      const data = await loginWithDeviceCode({
+        origin: auth.origin,
+        homeDir: deps.homeDir,
+        noOpen: parsed.noOpen,
+        onPrompt: (message) => stderr(message),
+        deps: {
+          fetchImpl: deps.fetchImpl,
+          openUrl: deps.openUrl,
+          sleep: deps.sleep
+        }
+      });
+      renderSuccess("auth login", data, render2);
+      return 0;
+    }
+    if (parsed.kind === "auth-logout") {
+      const cleared = await clearAuthConfig(deps.homeDir ?? os3.homedir());
+      renderSuccess("auth logout", { loggedIn: false, origin: auth.origin, cleared }, render2);
+      return 0;
+    }
+    if (parsed.kind === "auth-import-macos") {
+      const keychain = await inspectMacOSAppKeychain({ env: deps.env });
+      if (!keychain.token) {
+        throw cliError("auth.not_logged_in", keychain.message, {
+          hint: keychain.hint ?? "Run recappi auth login instead."
+        });
+      }
+      await saveAuthConfig(deps.homeDir ?? os3.homedir(), {
+        origin: auth.origin,
+        token: keychain.token
+      });
+      renderSuccess(
+        "auth import-macos",
+        { imported: true, origin: auth.origin, source: "macos-keychain" },
+        render2
+      );
+      return 0;
+    }
     if (parsed.kind === "doctor") {
       const data = await client.doctor();
       renderSuccess("doctor", data, render2);
@@ -17027,6 +17329,34 @@ Agent mode:
   addCommonOptions(program);
   const auth = program.command("auth").description("Authentication commands");
   addCommonOptions(auth);
+  const authLogin = auth.command("login").description("Sign in to Recappi Cloud with a device code").option("--no-open", "print the device URL without opening a browser");
+  addCommonOptions(authLogin);
+  authLogin.action((opts, command) => {
+    onSelect({
+      kind: "auth-login",
+      options: collectGlobalOptions(command),
+      commandName: "auth login",
+      ...opts.noOpen === true ? { noOpen: true } : {}
+    });
+  });
+  const authLogout = auth.command("logout").description("Remove the Recappi CLI sign-in token");
+  addCommonOptions(authLogout);
+  authLogout.action((_options, command) => {
+    onSelect({
+      kind: "auth-logout",
+      options: collectGlobalOptions(command),
+      commandName: "auth logout"
+    });
+  });
+  const authImportMacOS = auth.command("import-macos").description("Copy the Recappi Mini macOS app session into CLI config");
+  addCommonOptions(authImportMacOS);
+  authImportMacOS.action((_options, command) => {
+    onSelect({
+      kind: "auth-import-macos",
+      options: collectGlobalOptions(command),
+      commandName: "auth import-macos"
+    });
+  });
   const authStatus = auth.command("status").description("Show Recappi Cloud sign-in status");
   addCommonOptions(authStatus);
   authStatus.action((_options, command) => {