frontier-runner 0.2.3__tar.gz → 0.2.4__tar.gz

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.4] — 2026-09-27
+
+- CLI browser login (`frontier login`) uses a PKCE device-code flow and stores a short-lived user token separately from project API keys.
+- `frontier project create` / `frontier profile create --create-project` create a SaaS project with user authorization, issue a project key, and bind a named Frontier profile without printing the key.
+
 ## [0.2.3] — 2026-09-27
 
 - Named Frontier profiles: local execution contexts that bind a SaaS project credential, API origin, optional dbt target, and optional profiles.yml path without replacing `dbt_project.yml` `profile:`.
@@ -107,6 +112,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - SaaS commands resolve stored keychain credentials through one shared
   resolver instead of requiring `FRONTIER_API_KEY` in the environment.
 
+[0.2.4]: https://github.com/jadsamara/frontier-runner/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/jadsamara/frontier-runner/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/jadsamara/frontier-runner/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/jadsamara/frontier-runner/compare/v0.2.0...v0.2.1

{frontier_runner-0.2.3/frontier_runner.egg-info → frontier_runner-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: frontier-runner
-Version: 0.2.3
+Version: 0.2.4
 Summary: Customer-side Frontier CLI for dbt + Snowflake or BigQuery + GitHub impact assessments.
 Author: Frontier
 License: MIT License
@@ -92,7 +92,7 @@ Until the package is on PyPI, install the GitHub Release wheel for a version
 tag. You do not need a commit SHA:
 
 ```bash
-pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.3/frontier_runner-0.2.3-py3-none-any.whl"
+pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.4/frontier_runner-0.2.4-py3-none-any.whl"
 pipx inject frontier-runner "snowflake-connector-python>=3.12,<4"
 ```
 
@@ -248,9 +248,9 @@ workflow uses `FRONTIER_BLOCKING=false` unless you pass `--blocking`.
 Pin an immutable released version:
 
 ```bash
-pip install "frontier-runner[snowflake]==0.2.3"
+pip install "frontier-runner[snowflake]==0.2.4"
 # or
-pip install "frontier-runner[bigquery]==0.2.3"
+pip install "frontier-runner[bigquery]==0.2.4"
 ```
 
 Until PyPI trusted publishing is reviewed and live, install the GitHub Release

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/README.md

@@ -34,7 +34,7 @@ Until the package is on PyPI, install the GitHub Release wheel for a version
 tag. You do not need a commit SHA:
 
 ```bash
-pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.3/frontier_runner-0.2.3-py3-none-any.whl"
+pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.4/frontier_runner-0.2.4-py3-none-any.whl"
 pipx inject frontier-runner "snowflake-connector-python>=3.12,<4"
 ```
 
@@ -190,9 +190,9 @@ workflow uses `FRONTIER_BLOCKING=false` unless you pass `--blocking`.
 Pin an immutable released version:
 
 ```bash
-pip install "frontier-runner[snowflake]==0.2.3"
+pip install "frontier-runner[snowflake]==0.2.4"
 # or
-pip install "frontier-runner[bigquery]==0.2.3"
+pip install "frontier-runner[bigquery]==0.2.4"
 ```
 
 Until PyPI trusted publishing is reviewed and live, install the GitHub Release

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/frontier/__init__.py

@@ -1,3 +1,3 @@
 """Customer-side Frontier runner."""
 
-__version__ = "0.2.3"
+__version__ = "0.2.4"

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/frontier/cli.py

@@ -148,6 +148,14 @@ from frontier.onboard.profile_commands import (
     cmd_profile_status,
     cmd_profile_use,
 )
+from frontier.onboard.project_commands import (
+    cmd_organization_list,
+    cmd_project_create,
+    cmd_project_key_create,
+    cmd_project_list,
+    cmd_project_status,
+)
+from frontier.onboard.user_auth import cmd_auth_user_logout, cmd_auth_user_status
 from frontier.onboard.constants import DEFAULT_API_URL
 from frontier.onboard.routes import (
     derive_source_route,
@@ -2681,15 +2689,23 @@ def _add_project_dir(parser: argparse.ArgumentParser) -> None:
         dest="project_dir_opt",
         help="dbt project directory (same as the positional path)",
     )
-    _add_profile_option(parser)
+    _add_profile_option(parser, inherit_parent=True)
 
 
-def _add_profile_option(parser: argparse.ArgumentParser) -> None:
+def _add_profile_option(
+    parser: argparse.ArgumentParser,
+    *,
+    inherit_parent: bool = False,
+) -> None:
+    # Nested subparsers overwrite a parent dest when they declare the same
+    # option with default=None. SUPPRESS lets `frontier --profile b …` win
+    # over a later subparser default, while still accepting `--profile` after
+    # the subcommand.
     parser.add_argument(
         "--profile",
         dest="frontier_profile",
         metavar="NAME",
-        default=None,
+        default=argparse.SUPPRESS if inherit_parent else None,
         help=FRONTIER_PROFILE_HELP,
     )
 
@@ -2979,14 +2995,14 @@ def build_parser() -> argparse.ArgumentParser:
     signup.add_argument("--api-url", help="SaaS origin")
     signup.set_defaults(func=cmd_signup)
 
-    login = sub.add_parser("login", help="Store a project API key in the OS keychain")
+    login = sub.add_parser("login", help="Sign in as a Frontier user, or store a project API key")
     login.add_argument("--api-key", action="store_true", help="Paste a project API key (hidden input). Never pass the key as a positional argument.")
     login.add_argument("--api-url", help="SaaS origin")
-    _add_profile_option(login)
+    _add_profile_option(login, inherit_parent=True)
     login.set_defaults(func=cmd_login)
 
     logout = sub.add_parser("logout", help="Remove stored Frontier API credentials")
-    _add_profile_option(logout)
+    _add_profile_option(logout, inherit_parent=True)
     logout.add_argument(
         "--remove-metadata",
         action="store_true",
@@ -2997,8 +3013,15 @@ def build_parser() -> argparse.ArgumentParser:
     auth = sub.add_parser("auth", help="Show authentication status")
     auth_sub = auth.add_subparsers(dest="auth_command", required=True)
     auth_status = auth_sub.add_parser("status", help="Show whether the CLI is authenticated")
-    _add_profile_option(auth_status)
+    _add_profile_option(auth_status, inherit_parent=True)
+    auth_status.add_argument("--api-url", help="SaaS origin")
     auth_status.set_defaults(func=cmd_auth_status)
+    auth_user_status = auth_sub.add_parser("user-status", help="Show Frontier user authorization")
+    auth_user_status.add_argument("--api-url", help="SaaS origin")
+    auth_user_status.set_defaults(func=cmd_auth_user_status)
+    auth_user_logout = auth_sub.add_parser("user-logout", help="Revoke stored Frontier user authorization")
+    auth_user_logout.add_argument("--api-url", help="SaaS origin")
+    auth_user_logout.set_defaults(func=cmd_auth_user_logout)
 
     profile = sub.add_parser(
         "profile",
@@ -3008,6 +3031,7 @@ def build_parser() -> argparse.ArgumentParser:
             "dbt `profile:` in dbt_project.yml."
         ),
     )
+    _add_profile_option(profile, inherit_parent=True)
     profile_sub = profile.add_subparsers(dest="profile_command", required=True)
     profile_create = profile_sub.add_parser(
         "create",
@@ -3022,6 +3046,14 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Prompt securely for the project API key (never pass the key as an argument)",
     )
+    profile_create.add_argument(
+        "--create-project",
+        metavar="NAME",
+        help="Create a SaaS project with this name, issue a key, and bind this Frontier profile",
+    )
+    profile_create.add_argument("--organization", help="Organization ID or unambiguous slug")
+    profile_create.add_argument("--use", action="store_true", help="Select this Frontier profile for the current repository")
+    profile_create.add_argument("--non-interactive", action="store_true", help="Do not prompt; require --organization when multiple orgs exist")
     profile_create.add_argument("--force", action="store_true", help="Replace an existing Frontier profile")
     profile_create.add_argument("--yes", action="store_true", help="Accept the default API origin")
     _add_project_dir(profile_create)
@@ -3048,6 +3080,61 @@ def build_parser() -> argparse.ArgumentParser:
     _add_project_dir(profile_remove)
     profile_remove.set_defaults(func=cmd_profile_remove)
 
+    organization = sub.add_parser("organization", help="List organizations for the signed-in Frontier user")
+    organization_sub = organization.add_subparsers(dest="organization_command", required=True)
+    organization_list = organization_sub.add_parser("list", help="List organizations you can access")
+    organization_list.add_argument("--api-url", help="SaaS origin")
+    organization_list.set_defaults(func=cmd_organization_list)
+
+    project = sub.add_parser("project", help="Create and inspect Frontier SaaS projects")
+    project_sub = project.add_subparsers(dest="project_command", required=True)
+    project_list = project_sub.add_parser("list", help="List accessible Frontier projects")
+    project_list.add_argument("--api-url", help="SaaS origin")
+    project_list.set_defaults(func=cmd_project_list)
+    project_status = project_sub.add_parser("status", help="Show one accessible Frontier project")
+    project_status.add_argument("project", help="Project name or ID")
+    project_status.add_argument("--api-url", help="SaaS origin")
+    project_status.set_defaults(func=cmd_project_status)
+    project_create = project_sub.add_parser("create", help="Create a Frontier SaaS project")
+    project_create.add_argument("name", help="SaaS project name")
+    project_create.add_argument("--organization", help="Organization ID or unambiguous slug")
+    project_create.add_argument("--profile", dest="profile", help="Create this named Frontier profile after issuing a key")
+    project_create.add_argument("--target", help="Default dbt target for the Frontier profile")
+    project_create.add_argument("--profiles", help="Optional profiles.yml path for the Frontier profile")
+    project_create.add_argument("--api-url", help="SaaS origin")
+    project_create.add_argument("--warehouse", help="Warehouse type (default snowflake)")
+    project_create.add_argument("--no-profile", action="store_true", help="Do not create a named Frontier profile")
+    project_create.add_argument("--use", action="store_true", help="Select the new Frontier profile for this repository")
+    project_create.add_argument("--non-interactive", action="store_true", help="Do not prompt")
+    project_create.add_argument("--force", action="store_true", help="Replace an existing Frontier profile")
+    project_create.add_argument(
+        "project_dir",
+        nargs="?",
+        default=".",
+        help="dbt project directory (default: current directory)",
+    )
+    project_create.add_argument(
+        "--project-dir",
+        dest="project_dir_opt",
+        help="dbt project directory for --use",
+    )
+    project_create.set_defaults(func=cmd_project_create)
+    project_key = project_sub.add_parser("key", help="Manage project API keys")
+    project_key_sub = project_key.add_subparsers(dest="project_key_command", required=True)
+    project_key_create = project_key_sub.add_parser("create", help="Issue a replacement project API key")
+    project_key_create.add_argument("project", help="Project name or ID")
+    project_key_create.add_argument("--profile", dest="profile", help="Store the key on this Frontier profile")
+    project_key_create.add_argument("--target", help="Default dbt target when creating profile metadata")
+    project_key_create.add_argument("--profiles", help="Optional profiles.yml path")
+    project_key_create.add_argument("--api-url", help="SaaS origin")
+    project_key_create.add_argument("--non-interactive", action="store_true", help="Do not prompt")
+    project_key_create.add_argument(
+        "--project-dir",
+        dest="project_dir_opt",
+        help="dbt project directory",
+    )
+    project_key_create.set_defaults(func=cmd_project_key_create)
+
     discover = sub.add_parser(
         "discover",
         help="Derive and upload a generated semantic configuration from dbt artifacts",
@@ -3275,7 +3362,17 @@ def main(argv: Sequence[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
     command = getattr(args, "command", None)
-    if command not in {"update-check", "doctor", "login", "logout", "signup", "profile"}:
+    if command not in {
+        "update-check",
+        "doctor",
+        "login",
+        "logout",
+        "signup",
+        "profile",
+        "organization",
+        "project",
+        "auth",
+    }:
         from frontier.onboard.constants import DEFAULT_API_URL
 
         maybe_version_notice(str(getattr(args, "api_url", None) or DEFAULT_API_URL))

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/frontier/context.py

@@ -56,6 +56,17 @@ SOURCE_ENV_PROFILE = "env"
 SOURCE_LOCAL = "local"
 SOURCE_NONE = "none"
 
+PROFILE_SOURCE_LABELS = {
+    SOURCE_FLAG: "--profile",
+    SOURCE_ENV_PROFILE: "FRONTIER_PROFILE",
+    SOURCE_LOCAL: "local selection",
+    SOURCE_NONE: "none (legacy)",
+}
+
+
+def profile_source_label(source: str) -> str:
+    return PROFILE_SOURCE_LABELS.get(source, source)
+
 
 @dataclass(frozen=True)
 class ExecutionContext:

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/frontier/credentials.py

@@ -17,6 +17,8 @@ SOURCE_KEYRING = "keyring"
 SOURCE_FILE = "file"
 SOURCE_DEMO = "FRONTIER_DEMO_API_KEY"
 PROFILE_KEYRING_PREFIX = "profile:"
+USER_KEYRING_PREFIX = "user:"
+SOURCE_USER_ENV = "FRONTIER_USER_TOKEN"
 
 
 @dataclass(frozen=True)
@@ -69,6 +71,11 @@ def keyring_username(profile_name: str | None = None) -> str:
     return f"{PROFILE_KEYRING_PREFIX}{name}"
 
 
+def user_keyring_username(api_url: str) -> str:
+    origin = (api_url or "").strip().rstrip("/").lower()
+    return f"{USER_KEYRING_PREFIX}{origin or 'default'}"
+
+
 def key_prefix(api_key: str) -> str:
     key = api_key.strip()
     if len(key) <= 12:
@@ -248,17 +255,37 @@ def _read_file_store(path: Path) -> tuple[StoredCredentials | None, dict[str, St
     return parsed, {}
 
 
+def _read_user_store(path: Path) -> dict[str, "StoredUserAuthorization"]:
+    if not path.is_file():
+        return {}
+    try:
+        payload = json.loads(path.read_text())
+    except json.JSONDecodeError:
+        return {}
+    if not isinstance(payload, dict) or not isinstance(payload.get("users"), dict):
+        return {}
+    users: dict[str, StoredUserAuthorization] = {}
+    for origin, item in payload["users"].items():
+        if not isinstance(item, dict):
+            continue
+        parsed = _user_from_mapping(item, source=SOURCE_FILE)
+        if parsed:
+            users[str(origin)] = parsed
+    return users
+
+
 def _write_file_store(
     path: Path,
     *,
     legacy: StoredCredentials | None,
     named: dict[str, StoredCredentials],
 ) -> None:
-    if not named:
-        if legacy is None:
-            if path.is_file():
-                path.unlink()
-            return
+    users = _read_user_store(path)
+    if not named and legacy is None and not users:
+        if path.is_file():
+            path.unlink()
+        return
+    if not named and not users and legacy is not None:
         _write_fallback(path, json.dumps(legacy.to_payload()))
         return
     payload: dict[str, Any] = {
@@ -267,6 +294,10 @@ def _write_file_store(
     }
     if legacy is not None:
         payload["legacy"] = legacy.to_payload()
+    if users:
+        payload["users"] = {origin: auth.to_payload() for origin, auth in users.items()}
+    if not payload["profiles"]:
+        payload.pop("profiles")
     _write_fallback(path, json.dumps(payload))
 
 
@@ -409,3 +440,169 @@ def delete_credentials(
 
 def redact_credentials_dict(value: dict[str, Any]) -> dict[str, Any]:
     return redact(value)
+
+
+@dataclass(frozen=True)
+class StoredUserAuthorization:
+    api_url: str
+    access_token: str
+    email: str
+    user_id: str
+    expires_at: str
+    source: str = SOURCE_KEYRING
+    issuer: str = ""
+    audience: str = "frontier-cli"
+
+    def to_payload(self) -> dict[str, str]:
+        return {
+            "apiUrl": self.api_url,
+            "accessToken": self.access_token,
+            "email": self.email,
+            "userId": self.user_id,
+            "expiresAt": self.expires_at,
+            "issuer": self.issuer or self.api_url,
+            "audience": self.audience,
+        }
+
+    def expired(self) -> bool:
+        value = (self.expires_at or "").strip()
+        if not value:
+            return True
+        try:
+            from datetime import datetime, timezone
+
+            parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+        except ValueError:
+            return True
+        now = datetime.now(tz=timezone.utc)
+        if parsed.tzinfo is None:
+            parsed = parsed.replace(tzinfo=timezone.utc)
+        return parsed <= now
+
+
+def _user_from_mapping(payload: dict[str, Any], *, source: str) -> StoredUserAuthorization | None:
+    token = str(payload.get("accessToken") or "").strip()
+    url = str(payload.get("apiUrl") or "").strip()
+    if not token or not url:
+        return None
+    return StoredUserAuthorization(
+        api_url=url.rstrip("/"),
+        access_token=token,
+        email=str(payload.get("email") or "").strip(),
+        user_id=str(payload.get("userId") or "").strip(),
+        expires_at=str(payload.get("expiresAt") or "").strip(),
+        source=source,
+        issuer=str(payload.get("issuer") or url).strip().rstrip("/"),
+        audience=str(payload.get("audience") or "frontier-cli").strip() or "frontier-cli",
+    )
+
+
+def _write_user_file_store(path: Path, users: dict[str, StoredUserAuthorization]) -> None:
+    legacy, named = _read_file_store(path)
+    if not named and legacy is None and not users:
+        if path.is_file():
+            path.unlink()
+        return
+    if not named and not users and legacy is not None:
+        _write_fallback(path, json.dumps(legacy.to_payload()))
+        return
+    payload: dict[str, Any] = {
+        "version": 1,
+        "profiles": {name: creds.to_payload() for name, creds in named.items()},
+        "users": {origin: auth.to_payload() for origin, auth in users.items()},
+    }
+    if legacy is not None:
+        payload["legacy"] = legacy.to_payload()
+    if not payload["profiles"]:
+        payload.pop("profiles")
+    if not payload["users"]:
+        payload.pop("users")
+    _write_fallback(path, json.dumps(payload))
+
+
+def save_user_authorization(
+    auth: StoredUserAuthorization,
+    *,
+    fallback_path: Path | None = None,
+) -> str:
+    encoded = json.dumps(auth.to_payload())
+    if _set_keyring_entry(user_keyring_username(auth.api_url), encoded):
+        return SOURCE_KEYRING
+    path = fallback_path or default_fallback_path()
+    users = _read_user_store(path)
+    stored = StoredUserAuthorization(
+        api_url=auth.api_url,
+        access_token=auth.access_token,
+        email=auth.email,
+        user_id=auth.user_id,
+        expires_at=auth.expires_at,
+        source=SOURCE_FILE,
+        issuer=auth.issuer,
+        audience=auth.audience,
+    )
+    users[auth.api_url.rstrip("/").lower()] = stored
+    _write_user_file_store(path, users)
+    mode = path.stat().st_mode & 0o777
+    if mode != 0o600:
+        raise ConfigError("PROJECT_KEY_STORAGE_FAILED: credential file must be mode 0600.")
+    return SOURCE_FILE
+
+
+def load_user_authorization(
+    api_url: str,
+    *,
+    fallback_path: Path | None = None,
+) -> StoredUserAuthorization | None:
+    env_token = (os.environ.get(SOURCE_USER_ENV) or "").strip()
+    env_url = (os.environ.get("FRONTIER_API_URL") or "").strip() or api_url
+    if env_token:
+        auth = StoredUserAuthorization(
+            api_url=env_url.rstrip("/"),
+            access_token=env_token,
+            email="",
+            user_id="",
+            expires_at="9999-12-31T00:00:00+00:00",
+            source=SOURCE_USER_ENV,
+        )
+        return None if auth.expired() else auth
+    origin = api_url.rstrip("/")
+    raw = _get_keyring_entry(user_keyring_username(origin))
+    if raw:
+        try:
+            payload = json.loads(raw)
+        except json.JSONDecodeError:
+            payload = None
+        parsed = _user_from_mapping(payload, source=SOURCE_KEYRING) if isinstance(payload, dict) else None
+        if parsed and not parsed.expired():
+            return parsed
+    path = fallback_path or default_fallback_path()
+    stored = _read_user_store(path).get(origin.lower())
+    if stored and not stored.expired():
+        return stored
+    return None
+
+
+def delete_user_authorization(
+    api_url: str,
+    *,
+    fallback_path: Path | None = None,
+) -> None:
+    origin = api_url.rstrip("/")
+    _delete_keyring_entry(user_keyring_username(origin))
+    path = fallback_path or default_fallback_path()
+    users = _read_user_store(path)
+    users.pop(origin.lower(), None)
+    _write_user_file_store(path, users)
+
+
+def user_authorization_backend(api_url: str) -> str | None:
+    origin = api_url.rstrip("/")
+    raw = _get_keyring_entry(user_keyring_username(origin))
+    if raw:
+        return SOURCE_KEYRING
+    path = default_fallback_path()
+    if origin.lower() in _read_user_store(path):
+        return SOURCE_FILE
+    if (os.environ.get(SOURCE_USER_ENV) or "").strip():
+        return SOURCE_USER_ENV
+    return None

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/frontier/onboard/commands.py

@@ -94,10 +94,14 @@ def cmd_login(args: Any) -> int:
     profile_name = (getattr(args, "frontier_profile", None) or "").strip() or None
     api_url = (getattr(args, "api_url", None) or DEFAULT_API_URL).rstrip("/")
     if not getattr(args, "api_key", False):
-        print("Browser login is not available in this runner version.")
-        print("Run: frontier login --api-key")
-        print(f"Create a key at {api_url}/settings after signing in.")
-        return 1
+        from frontier.onboard.user_auth import complete_user_login
+
+        return complete_user_login(
+            args,
+            sleeper=getattr(args, "_sleep", None),
+            opener=getattr(args, "_open_browser", None),
+            clock=getattr(args, "_clock", None),
+        )
     reader = getattr(args, "_getpass", None) or getpass.getpass
     try:
         api_key = str(reader("Project API key: ")).strip()
@@ -179,10 +183,22 @@ def cmd_logout(args: Any) -> int:
 
 
 def cmd_auth_status(args: Any) -> int:
+    from frontier.credentials import load_user_authorization
+    from frontier.onboard.user_auth import require_user_authorization
+
+    api_url = (getattr(args, "api_url", None) or DEFAULT_API_URL).rstrip("/")
+    user_line = "User: not authenticated"
+    if load_user_authorization(api_url):
+        try:
+            user = require_user_authorization(api_url)
+            user_line = f"User: {user.email or user.user_id} (expires {user.expires_at})"
+        except InstallError:
+            user_line = "User: stored authorization was rejected"
+    print(user_line)
     ctx = resolve_execution_context(args, _project_dir_from_args(args), require_credential=False)
     creds = ctx.creds
     if not creds:
-        print("Not authenticated")
+        print("Project key: not authenticated")
         if ctx.profile_name:
             print(f"Frontier profile: {ctx.profile_name}")
             print(f"Next: frontier login --api-key --profile {ctx.profile_name}")
@@ -199,6 +215,7 @@ def cmd_auth_status(args: Any) -> int:
         print("Next: frontier login --api-key")
         return 1
     print("Authenticated")
+    print("Project key: authenticated")
     if ctx.profile_name:
         print(f"Frontier profile: {ctx.profile_name}")
     print(f"Organization: {identity.organization or creds.organization or '(unknown)'}")

{frontier_runner-0.2.3 → frontier_runner-0.2.4}/frontier/onboard/profile_commands.py

@@ -6,11 +6,8 @@ from pathlib import Path
 from typing import Any
 
 from frontier.context import (
-    SOURCE_FLAG,
-    SOURCE_ENV_PROFILE,
-    SOURCE_LOCAL,
-    SOURCE_NONE,
     ensure_named_profile_ids,
+    profile_source_label,
     resolve_execution_context,
 )
 from frontier.credentials import (
@@ -171,6 +168,10 @@ def _maybe_validate_target(project_dir: Path, target: str | None, profiles: str
 
 
 def cmd_profile_create(args: Any) -> int:
+    if str(getattr(args, "create_project", "") or "").strip():
+        from frontier.onboard.project_commands import cmd_profile_create_project
+
+        return cmd_profile_create_project(args)
     name = validate_profile_name(str(getattr(args, "name", "") or ""))
     api_url = _resolve_create_api_url(args)
     want_prompt = bool(getattr(args, "api_key", False))
@@ -306,14 +307,8 @@ def _identity_status(ctx) -> str:
 def cmd_profile_status(args: Any) -> int:
     project_dir = _project_dir(args)
     ctx = resolve_execution_context(args, project_dir, honor_local_config_target=False, require_credential=False)
-    source_label = {
-        SOURCE_FLAG: "--profile",
-        SOURCE_ENV_PROFILE: "FRONTIER_PROFILE",
-        SOURCE_LOCAL: "local selection",
-        SOURCE_NONE: "none (legacy)",
-    }.get(ctx.profile_source, ctx.profile_source)
     print(f"Frontier profile: {ctx.profile_name or '(none)'}")
-    print(f"Selection source: {source_label}")
+    print(f"Selection source: {profile_source_label(ctx.profile_source)}")
     print(
         f"Organization: {format_organization_identity(ctx.organization_name, ctx.organization_id)}"
     )