tai auth claim
Exchange a one-time claim link for its API key — runs WITHOUT a credential.
Pass the bare token or the whole claim URL; the token is taken from the #claim=
fragment. Pass - to read the token (or claim URL) from stdin, stripped, keeping it
off the command line. The exchanged API key is printed ONCE — capture it now (there is
no second exchange; the link is single-use). A used/unknown/expired token answers the
same unknown or already used claim token.
Example: tai auth claim 'https://host/login#claim=<token>'
tai auth whoami
Print the caller’s derived capability projection.
Example: tai auth whoami