@01.software/cli 0.17.4 → 0.19.5

package/dist/index.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createRequire } from "module";
+import { realpathSync } from "fs";
+import { createRequire as createRequire2 } from "module";
+import { fileURLToPath } from "url";
 import { Command } from "commander";
 
 // src/lib/client.ts
@@ -11,6 +13,386 @@ import {
   TenantIntrospectionApi
 } from "@01.software/sdk/server";
 
+// ../../internal/http-contracts/src/index.ts
+var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
+var operation = (collection, method, path2, errorFamily) => Object.freeze({
+  [operationBrand]: true,
+  collection,
+  method,
+  path: path2,
+  ...errorFamily && { errorFamily }
+});
+var strictCommerceOperation = (collection, method, path2) => operation(collection, method, path2, "commerce");
+var selectiveCommerceOperation = (collection, method, path2, typedCommerceErrorReasons) => Object.freeze({
+  ...operation(collection, method, path2),
+  typedCommerceErrorReasons: Object.freeze([...typedCommerceErrorReasons])
+});
+var COMMERCE_ENDPOINT_OPERATIONS = {
+  products: {
+    detail: operation("products", "get", "/detail"),
+    detailCatalog: operation("products", "get", "/detail/catalog"),
+    listingGroups: operation("products", "get", "/listing-groups"),
+    listingGroupsCatalog: operation(
+      "products",
+      "get",
+      "/listing-groups/catalog"
+    ),
+    listingGroupsQuery: operation("products", "post", "/listing-groups/query"),
+    listingGroupsQueryGet: operation(
+      "products",
+      "get",
+      "/listing-groups/query"
+    ),
+    listingGroupsQueryCatalog: operation(
+      "products",
+      "get",
+      "/listing-groups/query/catalog"
+    ),
+    stockCheck: operation("products", "post", "/stock-check"),
+    stockSnapshot: operation("products", "get", "/stock"),
+    upsert: operation("products", "post", "/upsert")
+  },
+  orders: {
+    create: operation("orders", "post", "/create"),
+    update: operation("orders", "post", "/update"),
+    confirmPayment: operation("orders", "post", "/confirm-payment"),
+    byPayment: operation("orders", "get", "/by-payment"),
+    cancel: operation("orders", "post", "/cancel"),
+    resolveCancelRefund: selectiveCommerceOperation(
+      "orders",
+      "post",
+      "/resolve-cancel-refund",
+      ["managed_refund_attestation_forbidden"]
+    ),
+    checkout: strictCommerceOperation("orders", "post", "/checkout"),
+    createFulfillment: operation("orders", "post", "/create-fulfillment"),
+    updateFulfillment: operation("orders", "post", "/update-fulfillment")
+  },
+  checkouts: {
+    detail: strictCommerceOperation("checkouts", "post", "/detail"),
+    query: strictCommerceOperation("checkouts", "post", "/query")
+  },
+  draftOrders: {
+    calculate: operation("draft-orders", "post", "/:id/calculate"),
+    complete: operation("draft-orders", "post", "/:id/complete"),
+    finalize: operation("draft-orders", "post", "/:id/finalize")
+  },
+  transactions: {
+    update: operation("transactions", "post", "/update")
+  },
+  returns: {
+    create: operation("returns", "post", "/create"),
+    update: operation("returns", "post", "/update"),
+    returnRefund: operation("returns", "post", "/return-refund")
+  },
+  fulfillmentOrders: {
+    prepare: operation(
+      "fulfillment-orders",
+      "post",
+      "/prepare-fulfillment-order"
+    )
+  },
+  fulfillments: {
+    bulkImport: operation("fulfillments", "post", "/bulk-import")
+  },
+  carts: {
+    create: strictCommerceOperation("carts", "post", "/create"),
+    retrieve: strictCommerceOperation("carts", "post", "/retrieve"),
+    mine: strictCommerceOperation("carts", "post", "/mine"),
+    merge: strictCommerceOperation("carts", "post", "/merge"),
+    addItem: strictCommerceOperation("carts", "post", "/add-item"),
+    updateItem: strictCommerceOperation("carts", "post", "/update-item"),
+    removeItem: strictCommerceOperation("carts", "post", "/remove-item"),
+    updateDiscountCodes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-discount-codes"
+    ),
+    updateAttributes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-attributes"
+    ),
+    clear: strictCommerceOperation("carts", "post", "/clear")
+  },
+  paymentSessions: {
+    create: strictCommerceOperation("payment-sessions", "post", "/create"),
+    retrieve: strictCommerceOperation("payment-sessions", "post", "/retrieve"),
+    cancel: strictCommerceOperation("payment-sessions", "post", "/cancel"),
+    server: {
+      create: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/create"
+      ),
+      retrieve: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/retrieve"
+      ),
+      cancel: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/cancel"
+      ),
+      confirm: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/confirm"
+      ),
+      findPortOne: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/portone/find"
+      ),
+      reconcilePortOne: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/portone/reconcile"
+      )
+    },
+    custom: {
+      create: operation("orders", "post", "/custom-payment-sessions"),
+      retrieve: operation(
+        "orders",
+        "post",
+        "/custom-payment-sessions/retrieve"
+      ),
+      confirm: operation("orders", "post", "/custom-payment-sessions/confirm")
+    }
+  },
+  shippingPolicies: {
+    calculate: operation("shipping-policies", "post", "/calculate")
+  },
+  discounts: {
+    validate: operation("discounts", "post", "/validate")
+  }
+};
+var portOneStandardActionCapabilityOperations = /* @__PURE__ */ new Set([
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create,
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve,
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create,
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
+]);
+var MEMBERSHIP_ENDPOINT_OPERATIONS = {
+  subscribe: operation(null, "post", "/memberships/subscribe"),
+  cancel: operation(null, "post", "/memberships/:id/cancel"),
+  me: operation(null, "get", "/memberships/me"),
+  chargeResult: operation(null, "post", "/memberships/:id/charge-result"),
+  refundResult: operation(null, "post", "/memberships/:id/refund-result"),
+  revoke: operation(null, "post", "/memberships/:id/revoke")
+};
+var CUSTOMER_GROUP_ENDPOINT_OPERATIONS = {
+  members: operation("customer-groups", "get", "/:id/members"),
+  grant: operation("customer-groups", "post", "/:id/members/grant"),
+  revoke: operation("customer-groups", "post", "/:id/members/revoke")
+};
+var EMBEDDED_ADMIN_ENDPOINT_OPERATIONS = {
+  show: operation("tenants", "get", "/embedded-admin-app"),
+  configure: operation("tenants", "patch", "/embedded-admin-app"),
+  disable: operation("tenants", "delete", "/embedded-admin-app")
+};
+var EVENTS_ENDPOINT_OPERATIONS = {
+  events: {
+    convertSchedule: operation("events", "post", "/:id/schedule")
+  },
+  occurrences: {
+    range: operation("event-occurrences", "get", "/range"),
+    admissionAvailability: operation(
+      "event-occurrences",
+      "get",
+      "/admission-availability"
+    )
+  }
+};
+var COMMUNITY_ENDPOINT_OPERATIONS = {
+  posts: {
+    detail: operation("posts", "get", "/detail")
+  }
+};
+function resolveOperationTemplate(descriptor) {
+  return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
+}
+function resolveOperationPath(descriptor, options) {
+  const path2 = resolveOperationTemplate(descriptor).replace(
+    /:([A-Za-z][A-Za-z0-9_]*)/g,
+    (_, key) => {
+      const value = options?.pathParams?.[key];
+      if (value === void 0) {
+        throw new TypeError(`Missing path parameter: ${key}`);
+      }
+      return encodeURIComponent(value);
+    }
+  );
+  const unresolved = path2.match(/:([A-Za-z][A-Za-z0-9_]*)/);
+  if (unresolved) {
+    throw new TypeError(`Missing path parameter: ${unresolved[1]}`);
+  }
+  const query = options?.query?.toString().replace(/^\?/, "");
+  return query ? `${path2}?${query}` : path2;
+}
+function resolveOperationMethod(descriptor) {
+  return descriptor.method.toUpperCase();
+}
+
+// src/lib/embedded-admin-management.ts
+import {
+  normalizeEmbeddedAdminBindingConfiguration
+} from "@01.software/sdk/embedded-admin";
+var REQUEST_TIMEOUT_MS = 3e4;
+var EmbeddedAdminManagementError = class extends Error {
+  constructor(message, status, options = {}) {
+    super(message);
+    this.name = "EmbeddedAdminManagementError";
+    this.status = status;
+    this.reason = options.reason;
+    this.requestId = options.requestId;
+  }
+};
+function resolveApiUrl(explicit) {
+  const buildDefault = true ? "https://api.01.software" : "https://api.01.software";
+  return (explicit ?? process.env.SOFTWARE_API_URL ?? process.env.NEXT_PUBLIC_SOFTWARE_API_URL ?? buildDefault).replace(/\/$/, "");
+}
+function inferConsoleOrigin(apiUrl) {
+  const url = new URL(apiUrl);
+  if (url.hostname === "api.01.software") {
+    return {
+      allowLoopbackConsoleHttp: false,
+      consoleOrigin: "https://console.01.software"
+    };
+  }
+  if (url.hostname === "api.stg.01.software") {
+    return {
+      allowLoopbackConsoleHttp: false,
+      consoleOrigin: "https://console.stg.01.software"
+    };
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  return {
+    allowLoopbackConsoleHttp: loopback && url.protocol === "http:",
+    ...loopback ? { consoleOrigin: url.origin } : {}
+  };
+}
+function parseBindingState(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Embedded admin binding response is invalid.");
+  }
+  const input = value;
+  if (typeof input.tenantId !== "string" || input.tenantId.length === 0 || typeof input.tenantName !== "string" || input.status !== "unconfigured" && input.status !== "disabled" && input.status !== "enabled" && input.status !== "invalid") {
+    throw new Error("Embedded admin binding response is invalid.");
+  }
+  if (input.status === "unconfigured" || input.status === "invalid") {
+    if (input.binding !== null) {
+      throw new Error("Embedded admin binding response is invalid.");
+    }
+    return {
+      binding: null,
+      status: input.status,
+      tenantId: input.tenantId,
+      tenantName: input.tenantName
+    };
+  }
+  const binding = normalizeEmbeddedAdminBindingConfiguration(input.binding);
+  if (binding.enabled !== (input.status === "enabled")) {
+    throw new Error("Embedded admin binding response is invalid.");
+  }
+  return {
+    binding,
+    status: input.status,
+    tenantId: input.tenantId,
+    tenantName: input.tenantName
+  };
+}
+var EmbeddedAdminManagementClient = class {
+  constructor(options) {
+    this.apiUrl = resolveApiUrl(options.apiUrl);
+    this.fetchImplementation = options.fetch ?? globalThis.fetch;
+    this.publishableKey = options.publishableKey;
+    this.secretKey = options.secretKey;
+  }
+  validateConfiguration(input) {
+    this.validateManagementAccess();
+    const console2 = inferConsoleOrigin(this.apiUrl);
+    return normalizeEmbeddedAdminBindingConfiguration(
+      { ...input, enabled: true, path: input.path ?? "/" },
+      console2
+    );
+  }
+  show() {
+    this.validateManagementAccess();
+    return this.request(EMBEDDED_ADMIN_ENDPOINT_OPERATIONS.show);
+  }
+  configure(input) {
+    const binding = this.validateConfiguration(input);
+    return this.request(EMBEDDED_ADMIN_ENDPOINT_OPERATIONS.configure, {
+      label: binding.label,
+      origin: binding.origin,
+      path: binding.path
+    });
+  }
+  disable() {
+    this.validateManagementAccess();
+    return this.request(EMBEDDED_ADMIN_ENDPOINT_OPERATIONS.disable);
+  }
+  validateManagementAccess() {
+    if (!this.secretKey.startsWith("pat01_")) {
+      const error = new Error(
+        "Embedded admin binding management requires a user PAT (pat01_...)."
+      );
+      error.name = "ConfigError";
+      throw error;
+    }
+  }
+  async request(operation2, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    let response;
+    try {
+      response = await this.fetchImplementation(
+        new URL(resolveOperationPath(operation2), `${this.apiUrl}/`),
+        {
+          method: resolveOperationMethod(operation2),
+          headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${this.secretKey}`,
+            "Content-Type": "application/json",
+            "X-Publishable-Key": this.publishableKey
+          },
+          ...body === void 0 ? {} : { body: JSON.stringify(body) },
+          signal: controller.signal
+        }
+      );
+    } catch (cause) {
+      const error = new Error(
+        "Embedded admin binding request failed."
+      );
+      error.cause = cause;
+      error.name = "NetworkError";
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (!response.ok) {
+      const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+      throw new EmbeddedAdminManagementError(
+        typeof record.error === "string" ? record.error : `Embedded admin binding request failed (${response.status}).`,
+        response.status,
+        {
+          ...typeof record.reason === "string" ? { reason: record.reason } : {},
+          ...response.headers.get("x-request-id") ? { requestId: response.headers.get("x-request-id") } : {}
+        }
+      );
+    }
+    return parseBindingState(payload);
+  }
+};
+
 // src/lib/credentials.ts
 import {
   chmodSync,
@@ -573,7 +955,10 @@ function adminErrorExitCode(err) {
 }
 
 // src/lib/i18n.ts
-var CLI_I18N_KO = {
+function withDoctorActionTranslations(translations) {
+  return translations;
+}
+var CLI_I18N_KO = withDoctorActionTranslations({
   // CLI-surface microcopy
   AuthenticationRequired: "\uC778\uC99D\uC774 \uD544\uC694\uD569\uB2C8\uB2E4",
   RunLoginToAuthenticate: "`01 login` \uBA85\uB839\uC73C\uB85C \uBE0C\uB77C\uC6B0\uC800 \uC778\uC99D\uC744 \uC9C4\uD589\uD558\uAC70\uB098,",
@@ -587,6 +972,26 @@ var CLI_I18N_KO = {
   Empty: "(\uC5C6\uC74C)",
   Total: "\uCD1D {{n}}\uAC1C",
   PageOf: "{{page}} / {{total}} \uD398\uC774\uC9C0",
+  // Redacted app-integration doctor remediation keys. These are stable
+  // machine references; the human CLI renders this locale-specific copy.
+  DoctorProjectPackageJsonReady: "package.json\uC744 \uC77D\uC744 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
+  DoctorProjectPackageJsonBlocked: "package.json\uC774 \uC788\uB294 \uC571 \uB514\uB809\uD130\uB9AC\uC5D0\uC11C \uC2E4\uD589\uD558\uC138\uC694.",
+  DoctorNodeEngineReady: "\uD604\uC7AC Node.js\uAC00 \uC120\uC5B8\uB41C engine\uC744 \uCDA9\uC871\uD569\uB2C8\uB2E4.",
+  DoctorNodeEngineAttention: "package.json\uC758 Node.js engine\uACFC \uD604\uC7AC \uBC84\uC804\uC744 \uD655\uC778\uD558\uC138\uC694.",
+  DoctorNodeEngineNotDeclared: "package.json\uC5D0 \uC9C0\uC6D0\uD558\uB294 Node.js engine \uBC94\uC704\uB97C \uC120\uC5B8\uD558\uC138\uC694.",
+  DoctorSdkDeclarationReady: "@01.software/sdk\uAC00 package.json\uC5D0 \uC120\uC5B8\uB418\uC5B4 \uC788\uC2B5\uB2C8\uB2E4.",
+  DoctorSdkDeclarationBlocked: "package.json\uC5D0 @01.software/sdk\uB97C \uCD94\uAC00\uD558\uC138\uC694.",
+  DoctorSdkInstallationReady: "@01.software/sdk\uC758 server export\uB97C \uD655\uC778\uD588\uC2B5\uB2C8\uB2E4.",
+  DoctorSdkInstallationAttention: "\uC571\uC744 \uC2E4\uD589\uD558\uAE30 \uC804\uC5D0 \uC120\uC5B8\uB41C \uC758\uC874\uC131\uC744 \uC124\uCE58\uD558\uC138\uC694.",
+  DoctorEnvCredentialsReady: "\uC571 \uC790\uACA9\uC99D\uBA85 \uD615\uC2DD\uACFC API \uB300\uC0C1\uC774 \uC62C\uBC14\uB985\uB2C8\uB2E4.",
+  DoctorEnvCredentialsBlocked: "\uD558\uB098\uC758 pk01_/sk01_ \uC571 \uC30D\uC744 \uC0AC\uC6A9\uD558\uACE0 \uACF5\uAC1C \uD658\uACBD \uBCC0\uC218\uB098 PAT\uC5D0 secret\uC744 \uB123\uC9C0 \uB9C8\uC138\uC694.",
+  DoctorEnvFileInvalid: "\uC77C\uBC18 \uD30C\uC77C\uC778 \uC571 \uD658\uACBD \uD30C\uC77C\uC744 \uC9C0\uC815\uD558\uACE0 symlink\xB7\uD2B9\uC218 \uD30C\uC77C\uC744 \uC81C\uAC70\uD558\uC138\uC694.",
+  DoctorOriginInputInvalid: "\uC808\uB300 http(s) origin URL\uC744 \uC9C0\uC815\uD558\uC138\uC694.",
+  DoctorTenantContextReady: "\uC571 \uC790\uACA9\uC99D\uBA85\uC73C\uB85C \uD14C\uB10C\uD2B8 \uCEE8\uD14D\uC2A4\uD2B8\uC5D0 \uC5F0\uACB0\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4.",
+  DoctorTenantContextBlocked: "\uC571 \uC790\uACA9\uC99D\uBA85, \uD14C\uB10C\uD2B8 \uC811\uADFC \uAD8C\uD55C \uBC0F API \uC5F0\uACB0\uC744 \uD655\uC778\uD558\uC138\uC694.",
+  DoctorOriginCorsReady: "API CORS \uC815\uCC45\uC5D0\uC11C origin\uC774 \uD5C8\uC6A9\uB429\uB2C8\uB2E4.",
+  DoctorOriginCorsBlocked: "\uC774 origin\uC744 \uD14C\uB10C\uD2B8 CORS \uC815\uCC45\uC5D0 \uCD94\uAC00\uD558\uC138\uC694.",
+  DoctorOriginCorsAttention: "API URL \uBC0F CORS \uC815\uCC45\uC744 \uD655\uC778\uD558\uC138\uC694.",
   // AdminError code translations (mirrors apps/console admin.ts).
   tenant_mismatch: "\uAD8C\uD55C\uC774 \uC5C6\uB294 \uD14C\uB10C\uD2B8",
   account_suspended: "\uACC4\uC815\uC774 \uC815\uC9C0\uB418\uC5C8\uC2B5\uB2C8\uB2E4",
@@ -597,7 +1002,7 @@ var CLI_I18N_KO = {
   publishable_key_mismatch: "\uACF5\uAC1C \uD0A4\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4",
   scope_denied: "\uBC94\uC704 \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4",
   redis_unavailable: "\uCE90\uC2DC\uAC00 \uC77C\uC2DC\uC801\uC73C\uB85C \uC0AC\uC6A9 \uBD88\uAC00\uD569\uB2C8\uB2E4",
-  provider_unavailable: "\uC678\uBD80 \uACF5\uAE09\uC790\uAC00 \uC751\uB2F5\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4",
+  provider_unavailable: "\uC678\uBD80 \uC81C\uACF5\uC790\uAC00 \uC751\uB2F5\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4",
   rate_limited: "\uC694\uCCAD\uC774 \uB108\uBB34 \uB9CE\uC2B5\uB2C8\uB2E4 \u2014 \uC7A0\uC2DC \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694",
   upstream_timeout: "\uC751\uB2F5 \uC2DC\uAC04\uC774 \uCD08\uACFC\uB418\uC5C8\uC2B5\uB2C8\uB2E4",
   upstream_5xx: "\uC678\uBD80 \uC11C\uBE44\uC2A4 \uC624\uB958",
@@ -605,7 +1010,7 @@ var CLI_I18N_KO = {
   not_found: "\uB9AC\uC18C\uC2A4\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4",
   invalid_argument: "\uC778\uC790\uAC00 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4",
   unknown: "\uC54C \uC218 \uC5C6\uB294 \uC624\uB958"
-};
+});
 var CLI_I18N_EN = {
   AuthenticationRequired: "Authentication required",
   RunLoginToAuthenticate: "Run `01 login` to authenticate via browser, or",
@@ -619,6 +1024,24 @@ var CLI_I18N_EN = {
   Empty: "(empty)",
   Total: "{{n}} total",
   PageOf: "page {{page}}/{{total}}",
+  DoctorProjectPackageJsonReady: "package.json is readable.",
+  DoctorProjectPackageJsonBlocked: "Run this command in an app directory with package.json.",
+  DoctorNodeEngineReady: "Current Node.js satisfies the declared engine.",
+  DoctorNodeEngineAttention: "Check the package.json Node.js engine and current version.",
+  DoctorNodeEngineNotDeclared: "Declare a supported Node.js engine range in package.json.",
+  DoctorSdkDeclarationReady: "@01.software/sdk is declared in package.json.",
+  DoctorSdkDeclarationBlocked: "Add @01.software/sdk to package.json.",
+  DoctorSdkInstallationReady: "@01.software/sdk server export is installed and resolvable.",
+  DoctorSdkInstallationAttention: "Install declared dependencies before running the app.",
+  DoctorEnvCredentialsReady: "App credentials and the API target are structurally valid.",
+  DoctorEnvCredentialsBlocked: "Use one pk01_/sk01_ app pair; never put a secret in a public env variable or use a PAT.",
+  DoctorEnvFileInvalid: "Use a regular app env file and remove symlinks or special files.",
+  DoctorOriginInputInvalid: "Use an absolute http(s) origin URL.",
+  DoctorTenantContextReady: "Tenant context is reachable with the app credential pair.",
+  DoctorTenantContextBlocked: "Check app credentials, tenant access, and API reachability.",
+  DoctorOriginCorsReady: "Origin is allowed by the API CORS policy.",
+  DoctorOriginCorsBlocked: "Add this origin to the tenant CORS policy.",
+  DoctorOriginCorsAttention: "Check the API URL and CORS policy.",
   tenant_mismatch: "Tenant access denied",
   account_suspended: "Your account has been suspended",
   feature_disabled: "This feature is disabled",
@@ -749,7 +1172,7 @@ function printError(error, options = {}) {
   const rawMessage = rawErr && typeof rawErr.message === "string" ? rawErr.message : "";
   const stringErr = typeof error === "string" ? error : "";
   const detailMessage = rawErr && rawErr.detail && typeof rawErr.detail === "object" && typeof rawErr.detail.message === "string" ? String(rawErr.detail.message) : "";
-  const headline = rawMessage || stringErr || detailMessage || localized || adminError.code;
+  const headline = (options.headlineKey ? t(options.headlineKey) : null) || rawMessage || stringErr || detailMessage || localized || adminError.code;
   console.error(pc.red(`Error: ${headline}`));
   if (rawErr && typeof rawErr.code === "string" && rawErr.code !== adminError.code) {
     console.error(pc.dim(`Code: ${rawErr.code}`));
@@ -830,6 +1253,7 @@ function resolveClientOrThrow(apiKeyFlag) {
     ),
     commerce: new ServerCommerceClient(serverOptions),
     tenant: new TenantIntrospectionApi(serverOptions),
+    embeddedAdmin: new EmbeddedAdminManagementClient(serverOptions),
     publishableKey,
     secretKey
   };
@@ -929,15 +1353,15 @@ function readFileAsBlob(filePath) {
   const buffer = readFileSync2(filePath);
   return { blob: new Blob([buffer]), filename: basename(filePath) };
 }
-function registerCrudCommands(program2, getClient2, getFormat2) {
-  program2.command("query <collection>").description("Query documents from a collection").option("--where <json>", "Filter conditions (JSON)").option("--limit <n>", "Max results", (v) => parseInt(v, 10)).option("--page <n>", "Page number", (v) => parseInt(v, 10)).option("--sort <field>", "Sort field (prefix with - for descending)").option(
+function registerCrudCommands(program, getClient, getFormat) {
+  program.command("query <collection>").description("Query documents from a collection").option("--where <json>", "Filter conditions (JSON)").option("--limit <n>", "Max results", (v) => parseInt(v, 10)).option("--page <n>", "Page number", (v) => parseInt(v, 10)).option("--sort <field>", "Sort field (prefix with - for descending)").option(
     "--depth <n>",
     "Relationship depth (0 = no population)",
     (v) => parseInt(v, 10)
   ).option("--select <fields>", "Comma-separated fields to select").action(async (collection, opts) => {
     try {
       const col = validateCollection(collection);
-      const client = getClient2();
+      const client = getClient();
       const options = {};
       if (opts.where) options.where = parseJson(opts.where, "where");
       if (opts.limit) options.limit = opts.limit;
@@ -946,29 +1370,29 @@ function registerCrudCommands(program2, getClient2, getFormat2) {
       if (opts.depth != null) options.depth = opts.depth;
       if (opts.select) options.select = parseSelect(opts.select);
       const result = await client.collections.from(col).find(options);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
   });
-  program2.command("get <collection> <id>").description("Get a document by ID").option(
+  program.command("get <collection> <id>").description("Get a document by ID").option(
     "--depth <n>",
     "Relationship depth (0 = no population)",
     (v) => parseInt(v, 10)
   ).option("--select <fields>", "Comma-separated fields to select").action(async (collection, id, opts) => {
     try {
       const col = validateCollection(collection);
-      const client = getClient2();
+      const client = getClient();
       const options = {};
       if (opts.depth != null) options.depth = opts.depth;
       if (opts.select) options.select = parseSelect(opts.select);
       const result = await client.collections.from(col).findById(id, options);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
   });
-  program2.command("create <collection>").description("Create a new document").requiredOption("--data <json>", "Document data (JSON)").option("--file <path>", "File to upload (for upload collections)").option("--dry-run", "Validate inputs without executing").action(async (collection, opts) => {
+  program.command("create <collection>").description("Create a new document").requiredOption("--data <json>", "Document data (JSON)").option("--file <path>", "File to upload (for upload collections)").option("--dry-run", "Validate inputs without executing").action(async (collection, opts) => {
     try {
       const col = validateCollection(collection);
       const data = parseJson(opts.data, "data");
@@ -981,23 +1405,23 @@ function registerCrudCommands(program2, getClient2, getFormat2) {
             collection: col,
             data
           },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       let fileOpts;
       if (opts.file) {
         const { blob, filename } = readFileAsBlob(opts.file);
         fileOpts = { file: blob, filename };
       }
       const result = await client.collections.from(col).create(data, fileOpts);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
   });
-  program2.command("update <collection> <id>").description("Update a document by ID").requiredOption("--data <json>", "Document data (JSON)").option("--file <path>", "File to upload (for upload collections)").option("--dry-run", "Validate inputs without executing").action(async (collection, id, opts) => {
+  program.command("update <collection> <id>").description("Update a document by ID").requiredOption("--data <json>", "Document data (JSON)").option("--file <path>", "File to upload (for upload collections)").option("--dry-run", "Validate inputs without executing").action(async (collection, id, opts) => {
     try {
       const col = validateCollection(collection);
       const data = parseJson(opts.data, "data");
@@ -1011,23 +1435,23 @@ function registerCrudCommands(program2, getClient2, getFormat2) {
             id,
             data
           },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       let fileOpts;
       if (opts.file) {
         const { blob, filename } = readFileAsBlob(opts.file);
         fileOpts = { file: blob, filename };
       }
       const result = await client.collections.from(col).update(id, data, fileOpts);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
   });
-  program2.command("delete <collection> <id>").description("Delete a document by ID").option("--dry-run", "Validate inputs without executing").action(async (collection, id, opts) => {
+  program.command("delete <collection> <id>").description("Delete a document by ID").option("--dry-run", "Validate inputs without executing").action(async (collection, id, opts) => {
     try {
       const col = validateCollection(collection);
       if (opts.dryRun) {
@@ -1039,18 +1463,18 @@ function registerCrudCommands(program2, getClient2, getFormat2) {
             collection: col,
             id
           },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.collections.from(col).remove(id);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
   });
-  program2.command("update-many <collection>").description("Update multiple documents matching a filter").requiredOption("--where <json>", "Filter conditions (JSON)").requiredOption("--data <json>", "Update data (JSON)").option("--dry-run", "Validate inputs without executing").action(async (collection, opts) => {
+  program.command("update-many <collection>").description("Update multiple documents matching a filter").requiredOption("--where <json>", "Filter conditions (JSON)").requiredOption("--data <json>", "Update data (JSON)").option("--dry-run", "Validate inputs without executing").action(async (collection, opts) => {
     try {
       const col = validateCollection(collection);
       const where = parseJson(opts.where, "where");
@@ -1065,18 +1489,18 @@ function registerCrudCommands(program2, getClient2, getFormat2) {
             where,
             data
           },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.collections.from(col).updateMany(where, data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
   });
-  program2.command("delete-many <collection>").description("Delete multiple documents matching a filter").requiredOption("--where <json>", "Filter conditions (JSON)").option("--dry-run", "Validate inputs without executing").action(async (collection, opts) => {
+  program.command("delete-many <collection>").description("Delete multiple documents matching a filter").requiredOption("--where <json>", "Filter conditions (JSON)").option("--dry-run", "Validate inputs without executing").action(async (collection, opts) => {
     try {
       const col = validateCollection(collection);
       const where = parseJson(opts.where, "where");
@@ -1089,13 +1513,13 @@ function registerCrudCommands(program2, getClient2, getFormat2) {
             collection: col,
             where
           },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.collections.from(col).removeMany(where);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -1868,6 +2292,9 @@ var updateCartAttributesParamsSchema = updateCartAttributesBodySchema.extend({
 // ../../internal/contracts/src/ecommerce/checkout.ts
 import { z as z6 } from "zod";
 
+// ../../internal/contracts/src/ecommerce/managed-payment-provider.ts
+var CHECKOUT_PAYMENT_SESSION_PROVIDERS = ["toss", "portone"];
+
 // ../../internal/contracts/src/ecommerce/payment-session.ts
 import { z as z5 } from "zod";
 var tossProviderOrderIdSchema = z5.string().min(6).max(64).regex(
@@ -1943,20 +2370,29 @@ var createPortOnePaymentSessionBodySchema = z5.object({
     portOneStandardProviderOptionsSchema
   ])
 }).strict();
-var createPaymentSessionBodySchema = z5.discriminatedUnion("provider", [
-  createTossPaymentSessionBodySchema,
-  createPortOnePaymentSessionBodySchema
-]);
-var createPaymentSessionParamsSchema = z5.discriminatedUnion(
-  "provider",
-  [
-    createTossPaymentSessionBodySchema.extend({
-      idempotencyKey: commerceIdempotencyKeySchema
-    }),
-    createPortOnePaymentSessionBodySchema.extend({
-      idempotencyKey: commerceIdempotencyKeySchema
-    })
-  ]
+var createPaymentSessionBodySchemasByProvider = {
+  toss: createTossPaymentSessionBodySchema,
+  portone: createPortOnePaymentSessionBodySchema
+};
+function providerDiscriminatedUnion(schemas) {
+  const variants = CHECKOUT_PAYMENT_SESSION_PROVIDERS.map(
+    (provider) => schemas[provider]
+  );
+  return z5.discriminatedUnion("provider", variants);
+}
+var createPaymentSessionBodySchema = providerDiscriminatedUnion(
+  createPaymentSessionBodySchemasByProvider
+);
+var createPaymentSessionParamsSchemasByProvider = {
+  toss: createTossPaymentSessionBodySchema.extend({
+    idempotencyKey: commerceIdempotencyKeySchema
+  }),
+  portone: createPortOnePaymentSessionBodySchema.extend({
+    idempotencyKey: commerceIdempotencyKeySchema
+  })
+};
+var createPaymentSessionParamsSchema = providerDiscriminatedUnion(
+  createPaymentSessionParamsSchemasByProvider
 );
 var retrieveBrowserPaymentSessionParamsSchema = z5.object({
   paymentSessionId: commerceResourceIdSchema,
@@ -1991,6 +2427,17 @@ var confirmTossPaymentSessionBodySchema = z5.object({
 var confirmTossPaymentSessionParamsSchema = confirmTossPaymentSessionBodySchema.extend({
   idempotencyKey: commerceIdempotencyKeySchema
 });
+var portOneProviderIdentitySchema = z5.string().min(1).max(512).refine((value) => /\S/u.test(value), "Provider identity must not be blank");
+var portOnePaymentSelectorSchema = z5.object({
+  provider: z5.literal("portone"),
+  providerAccountKey: portOneProviderIdentitySchema,
+  environment: z5.enum(["test", "live"]),
+  providerPaymentId: portOneProviderIdentitySchema
+}).strict();
+var reconcilePortOnePaymentBodySchema = portOnePaymentSelectorSchema;
+var reconcilePortOnePaymentParamsSchema = reconcilePortOnePaymentBodySchema.extend({
+  idempotencyKey: commerceIdempotencyKeySchema
+});
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -2059,6 +2506,15 @@ var confirmCustomPaymentSessionResponseSchema = z5.object({
   status: z5.literal("paid"),
   alreadyConfirmed: z5.boolean().optional()
 }).strict();
+var PORTONE_RECONCILIATION_DISPOSITIONS = [
+  "applied",
+  "observed",
+  "recovered_after_ambiguous_result",
+  "requires_attention"
+];
+var portOneReconciliationDispositionSchema = z5.enum(
+  PORTONE_RECONCILIATION_DISPOSITIONS
+);
 var tossPaymentNextActionSchema = z5.object({
   type: z5.literal("toss_widget"),
   clientKey: z5.string().min(1).max(255),
@@ -2077,7 +2533,8 @@ var portOnePaymentNextActionSchema = z5.object({
     return url.username === "" && url.password === "";
   }, "checkoutUrl must not contain embedded credentials")
 }).strict();
-var portOneSdkPaymentNextActionSchema = z5.object({
+var PORTONE_STANDARD_ACTION_RETRY_POLICY = "same_action_only";
+var portOneSdkPaymentRequestSchema = z5.object({
   type: z5.literal("portone_sdk"),
   version: z5.literal("v2"),
   storeId: z5.string().min(1).max(255),
@@ -2093,7 +2550,21 @@ var portOneSdkPaymentNextActionSchema = z5.object({
     return (url.protocol === "https:" || loopback) && !url.username && !url.password;
   }, "redirectUrl must be HTTPS (or development loopback) without embedded credentials")
 }).strict();
-var paymentNextActionSchema = z5.discriminatedUnion("type", [
+var portOneSdkPaymentCapabilityNextActionSchema = portOneSdkPaymentRequestSchema.extend({
+  cancelable: z5.literal(false),
+  retryPolicy: z5.literal(PORTONE_STANDARD_ACTION_RETRY_POLICY)
+}).strict();
+var portOneSdkPaymentNextActionSchema = z5.union([
+  portOneSdkPaymentCapabilityNextActionSchema,
+  portOneSdkPaymentRequestSchema
+]).transform(
+  (action) => "cancelable" in action ? action : {
+    ...action,
+    cancelable: false,
+    retryPolicy: PORTONE_STANDARD_ACTION_RETRY_POLICY
+  }
+);
+var paymentNextActionSchema = z5.union([
   tossPaymentNextActionSchema,
   portOnePaymentNextActionSchema,
   portOneSdkPaymentNextActionSchema
@@ -2304,17 +2775,61 @@ function providerSessionSchemas(provider, action) {
     }).strict()
   );
 }
-var publicPaymentSessionVariants = [
-  ...providerSessionSchemas("toss", tossPaymentNextActionSchema),
-  ...providerSessionSchemas(
-    "portone",
-    z5.union([
-      portOnePaymentNextActionSchema,
-      portOneSdkPaymentNextActionSchema
-    ])
+var paymentNextActionSchemasByProvider = {
+  toss: tossPaymentNextActionSchema,
+  portone: z5.union([
+    portOnePaymentNextActionSchema,
+    portOneSdkPaymentNextActionSchema
+  ])
+};
+var publicPaymentSessionVariants = CHECKOUT_PAYMENT_SESSION_PROVIDERS.flatMap(
+  (provider) => providerSessionSchemas(
+    provider,
+    paymentNextActionSchemasByProvider[provider]
   )
-];
+);
 var publicPaymentSessionSchema = z5.union(publicPaymentSessionVariants);
+var portOneReconciliationSummarySchema = z5.union([
+  noReconciliationSchema,
+  z5.object({
+    status: z5.literal("required"),
+    reasons: z5.array(paymentReconciliationReasonSchema).min(1).readonly()
+  }).strict()
+]);
+var portOnePaymentCurrentStateSchema = z5.object({
+  paymentSession: z5.object({
+    id: commerceResourceIdSchema,
+    provider: z5.literal("portone"),
+    providerStatus: paymentProviderStatusSchema,
+    finalizationStatus: z5.enum(["not_ready", "pending", "committed"]),
+    sessionRole: paymentSessionRoleSchema,
+    reconciliation: portOneReconciliationSummarySchema
+  }).strict(),
+  checkout: z5.object({ id: commerceResourceIdSchema }).strict(),
+  order: orderReferenceSchema.nullable(),
+  money: moneySchema
+}).strict();
+var findPortOnePaymentResultSchema = z5.discriminatedUnion("found", [
+  z5.object({ found: z5.literal(false) }).strict(),
+  z5.object({
+    found: z5.literal(true),
+    current: portOnePaymentCurrentStateSchema
+  }).strict()
+]);
+var reconcilePortOnePaymentResultSchema = z5.discriminatedUnion(
+  "found",
+  [
+    z5.object({
+      found: z5.literal(false),
+      disposition: z5.literal("requires_attention")
+    }).strict(),
+    z5.object({
+      found: z5.literal(true),
+      disposition: portOneReconciliationDispositionSchema,
+      current: portOnePaymentCurrentStateSchema
+    }).strict()
+  ]
+);
 var CreatePaymentSessionParamsSchema = createPaymentSessionParamsSchema;
 var CancelServerPaymentSessionParamsSchema = cancelServerPaymentSessionParamsSchema;
 var ConfirmTossPaymentSessionParamsSchema = confirmTossPaymentSessionParamsSchema;
@@ -2367,7 +2882,6 @@ var checkoutAmountsSchema = z6.object({
     });
   }
 });
-var CHECKOUT_PAYMENT_SESSION_PROVIDERS = ["toss", "portone"];
 var checkoutPaymentSessionRefSchema = z6.object({
   id: z6.string().min(1),
   provider: z6.enum(CHECKOUT_PAYMENT_SESSION_PROVIDERS),
@@ -2564,40 +3078,62 @@ var returnCancellationReasonCodeSchema = z7.enum(
   RETURN_CANCELLATION_REASON_CODES
 );
 var restockActionSchema = z7.enum(["return_to_stock", "discard"]);
+var returnRefundMoneySchema = z7.number().int("amount must be an integer minor-unit value").safe("amount must be a safe integer").nonnegative("amount must be non-negative");
+var positiveReturnRefundMoneySchema = z7.number().int("amount must be an integer minor-unit value").safe("amount must be a safe integer").positive("amount must be positive");
+function trimmedReturnRefundScalarString(maxScalars, emptyMessage, maximumMessage) {
+  return z7.string().trim().min(1, emptyMessage).refine((value) => Array.from(value).length <= maxScalars, maximumMessage);
+}
 var returnWithRefundItemSchema = z7.object({
-  orderItem: z7.union([z7.string().min(1), z7.number()]).transform(String),
-  quantity: z7.number().int().positive("quantity must be a positive integer"),
+  orderItem: z7.union([z7.string().trim().min(1), z7.number().int().safe().positive()]).transform(String),
+  quantity: z7.number().int("quantity must be an integer").safe("quantity must be a safe integer").positive("quantity must be a positive integer"),
   restockAction: restockActionSchema.default("return_to_stock"),
-  restockingFee: z7.number().min(0, "restockingFee must be non-negative").optional().describe("Restocking fee charged for this line (ADR 0005 \xA7Gap 1)")
+  restockingFee: returnRefundMoneySchema.optional().describe("Restocking fee charged for this line (ADR 0005 \xA7Gap 1)")
 }).strict();
 var returnWithRefundSchema = z7.object({
-  orderNumber: z7.string().min(1, "orderNumber is required").describe("Order number (required)"),
+  orderNumber: z7.string().trim().min(1, "orderNumber is required").describe("Order number (required)"),
   reason: returnReasonSchema.optional().describe("Return reason (optional)"),
-  reasonDetail: z7.string().optional().describe("Detailed reason text (optional)"),
+  reasonDetail: trimmedReturnRefundScalarString(
+    2e3,
+    "reasonDetail must not be empty",
+    "reasonDetail must be 2000 Unicode code points or fewer"
+  ).optional().describe("Detailed reason text (optional)"),
   returnItems: z7.array(returnWithRefundItemSchema).min(1, "At least one return item is required").max(100, "Too many return items").describe("Array of products to return (required)"),
-  refundAmount: z7.number().min(0, "refundAmount must be non-negative").describe("Refund amount (required, min 0)"),
-  returnShippingFee: z7.number().min(0, "returnShippingFee must be non-negative").optional().describe(
+  refundAmount: positiveReturnRefundMoneySchema.describe(
+    "Refund amount (required, min 1)"
+  ),
+  returnShippingFee: returnRefundMoneySchema.optional().describe(
     "Return shipping fee charged to the customer (ADR 0005 \xA7Gap 1)"
   ),
-  initialShippingRefundAmount: z7.number().min(0, "initialShippingRefundAmount must be non-negative").optional().describe("Initial order shipping amount refunded to the customer"),
-  initialShippingRefundOverrideNote: z7.string().min(1).optional().describe(
+  initialShippingRefundAmount: returnRefundMoneySchema.optional().describe("Initial order shipping amount refunded to the customer"),
+  initialShippingRefundOverrideNote: trimmedReturnRefundScalarString(
+    2e3,
+    "initialShippingRefundOverrideNote must not be empty",
+    "initialShippingRefundOverrideNote must be 2000 Unicode code points or fewer"
+  ).optional().describe(
     "Operator audit note required when overriding policy suggestion"
   ),
-  pgPaymentId: z7.string().min(1, "pgPaymentId is required").describe("PG payment ID for refund (required)"),
-  paymentKey: z7.string().min(1).optional().describe("Provider payment key for verified refund"),
-  refundReceiptUrl: z7.string().optional().describe("Refund receipt URL (optional)")
+  pgPaymentId: z7.string().trim().min(1, "pgPaymentId is required").describe("PG payment ID for refund (required)"),
+  paymentKey: z7.string().trim().min(1).optional().describe("Provider payment key for verified refund"),
+  refundReceiptUrl: trimmedReturnRefundScalarString(
+    2048,
+    "refundReceiptUrl must not be empty",
+    "refundReceiptUrl must be 2048 Unicode code points or fewer"
+  ).optional().describe("Refund receipt URL (optional)")
 }).strict();
 var createReturnSchema = z7.object({
   orderNumber: z7.string().min(1, "orderNumber is required").describe("Order number (required)"),
   reason: returnReasonSchema.optional().describe("Return reason (optional)"),
-  reasonDetail: z7.string().optional().describe("Detailed reason text (optional)"),
+  reasonDetail: z7.string().max(2e3, "reasonDetail must be 2000 characters or fewer").optional().describe("Detailed reason text (optional)"),
   returnItems: z7.array(returnWithRefundItemSchema).min(1, "At least one return item is required").max(100, "Too many return items").describe("Array of products to return (required)"),
-  refundAmount: z7.number().min(0, "refundAmount must be non-negative").describe(
+  refundAmount: returnRefundMoneySchema.describe(
     "Line refund amount before initial shipping refund (required, min 0)"
   ),
-  returnShippingFee: z7.number().min(0, "returnShippingFee must be non-negative").optional().describe("Return shipping fee charged to the customer"),
-  initialShippingRefundAmount: z7.number().min(0, "initialShippingRefundAmount must be non-negative").optional().describe("Initial order shipping amount refunded to the customer"),
-  initialShippingRefundOverrideNote: z7.string().min(1).optional().describe(
+  returnShippingFee: returnRefundMoneySchema.optional().describe("Return shipping fee charged to the customer"),
+  initialShippingRefundAmount: returnRefundMoneySchema.optional().describe("Initial order shipping amount refunded to the customer"),
+  initialShippingRefundOverrideNote: z7.string().min(1).max(
+    2e3,
+    "initialShippingRefundOverrideNote must be 2000 characters or fewer"
+  ).optional().describe(
     "Operator audit note required when overriding policy suggestion"
   )
 }).strict();
@@ -2773,8 +3309,8 @@ var fulfillmentItemsSchema = z8.array(
     quantity: z8.number().int().positive("quantity must be a positive integer")
   }).strict()
 ).min(1, "At least one fulfillment item is required").max(100, "Maximum 100 items per fulfillment");
-function registerOrderCommands(program2, getClient2, getFormat2) {
-  const order = program2.command("order").description("Order management");
+function registerOrderCommands(program, getClient, getFormat) {
+  const order = program.command("order").description("Order management");
   order.command("update <orderNumber>").description("Confirm a delivered order purchase").requiredOption("--status <status>", "New status (confirmed only)").option("--dry-run", "Validate inputs without executing").action(async (orderNumber, opts) => {
     try {
       const status = parseWithSchema(opts.status, "status", orderStatusSchema);
@@ -2782,13 +3318,13 @@ function registerOrderCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "order update", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.update(data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -2810,13 +3346,13 @@ function registerOrderCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "order cancel", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.cancelOrder(data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -2827,13 +3363,13 @@ function registerOrderCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "order prepare", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.prepareFulfillmentOrder(data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -2854,18 +3390,18 @@ function registerOrderCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "order fulfill", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.createFulfillment({
         ...data,
         ...items ? {
           items
         } : {}
       });
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -2890,13 +3426,13 @@ function registerOrderCommands(program2, getClient2, getFormat2) {
             action: "order update-fulfillment",
             data
           },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.updateFulfillment(data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -2911,8 +3447,8 @@ var returnStatusSchema = z9.enum([
   "rejected",
   "completed"
 ]);
-function registerReturnCommands(program2, getClient2, getFormat2) {
-  const ret = program2.command("return").description("Return management");
+function registerReturnCommands(program, getClient, getFormat) {
+  const ret = program.command("return").description("Return management");
   ret.command("create <orderNumber>").description("Create a return request").requiredOption("--products <json>", "Return products array (JSON)").requiredOption("--refund-amount <n>", "Refund amount", parseFloat).option(
     "--return-shipping-fee <n>",
     "Return shipping fee charged to the customer",
@@ -2946,16 +3482,16 @@ function registerReturnCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "return create", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.createReturn({
         ...data,
         returnItems: data.returnItems
       });
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -2974,13 +3510,13 @@ function registerReturnCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "return update", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.updateReturn(data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3018,16 +3554,16 @@ function registerReturnCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "return refund", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.orders.returnWithRefund({
         ...data,
         returnItems: data.returnItems
       });
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3112,8 +3648,8 @@ function sensitiveDryRunResult(action) {
 }
 
 // src/commands/cart.ts
-function registerCartCommands(program2, getClient2, getFormat2) {
-  const cart = program2.command("cart").description("Cart management");
+function registerCartCommands(program, getClient, getFormat) {
+  const cart = program.command("cart").description("Cart management");
   cart.command("create").description("Create a cart and print its cartToken capability").option("--data-stdin", "Read market and attributes JSON from stdin").option("--data-file <path>", "Read market and attributes JSON from file").option("--dry-run", "Validate inputs without executing").action(async (opts) => {
     try {
       const input = opts.dataStdin || opts.dataFile ? await readSensitiveJsonObject(opts) : {};
@@ -3123,10 +3659,10 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         createCartParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart create"), getFormat2());
+        printResult(sensitiveDryRunResult("cart create"), getFormat());
         return;
       }
-      printResult(await getClient2().commerce.carts.create(data), getFormat2());
+      printResult(await getClient().commerce.carts.create(data), getFormat());
     } catch (error) {
       exitWithError(error);
     }
@@ -3139,8 +3675,8 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         retrieveCartParamsSchema
       );
       printResult(
-        await getClient2().commerce.carts.retrieve(data),
-        getFormat2()
+        await getClient().commerce.carts.retrieve(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3154,10 +3690,10 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         addItemParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart add"), getFormat2());
+        printResult(sensitiveDryRunResult("cart add"), getFormat());
         return;
       }
-      printResult(await getClient2().commerce.carts.addItem(data), getFormat2());
+      printResult(await getClient().commerce.carts.addItem(data), getFormat());
     } catch (error) {
       exitWithError(error);
     }
@@ -3170,12 +3706,12 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         updateItemParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart update"), getFormat2());
+        printResult(sensitiveDryRunResult("cart update"), getFormat());
         return;
       }
       printResult(
-        await getClient2().commerce.carts.updateItem(data),
-        getFormat2()
+        await getClient().commerce.carts.updateItem(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3189,12 +3725,12 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         removeItemParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart remove"), getFormat2());
+        printResult(sensitiveDryRunResult("cart remove"), getFormat());
         return;
       }
       printResult(
-        await getClient2().commerce.carts.removeItem(data),
-        getFormat2()
+        await getClient().commerce.carts.removeItem(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3208,10 +3744,10 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         clearCartParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart clear"), getFormat2());
+        printResult(sensitiveDryRunResult("cart clear"), getFormat());
         return;
       }
-      printResult(await getClient2().commerce.carts.clear(data), getFormat2());
+      printResult(await getClient().commerce.carts.clear(data), getFormat());
     } catch (error) {
       exitWithError(error);
     }
@@ -3224,12 +3760,12 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         updateDiscountCodesParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart discounts"), getFormat2());
+        printResult(sensitiveDryRunResult("cart discounts"), getFormat());
         return;
       }
       printResult(
-        await getClient2().commerce.carts.updateDiscountCodes(data),
-        getFormat2()
+        await getClient().commerce.carts.updateDiscountCodes(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3246,12 +3782,12 @@ function registerCartCommands(program2, getClient2, getFormat2) {
         updateCartAttributesParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("cart attributes"), getFormat2());
+        printResult(sensitiveDryRunResult("cart attributes"), getFormat());
         return;
       }
       printResult(
-        await getClient2().commerce.carts.updateAttributes(data),
-        getFormat2()
+        await getClient().commerce.carts.updateAttributes(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3260,17 +3796,17 @@ function registerCartCommands(program2, getClient2, getFormat2) {
 }
 
 // src/commands/stock.ts
-function registerStockCommands(program2, getClient2, getFormat2) {
-  const stock = program2.command("stock").description("Stock management");
+function registerStockCommands(program, getClient, getFormat) {
+  const stock = program.command("stock").description("Stock management");
   stock.command("check").description("Check stock availability").requiredOption(
     "--items <json>",
     "Items to check (JSON array of { optionId, quantity })"
   ).action(async (opts) => {
     try {
-      const client = getClient2();
+      const client = getClient();
       const items = parseJsonArray(opts.items, "items");
       const result = await client.commerce.product.stockCheck({ items });
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3282,8 +3818,8 @@ function paymentProvider(value) {
   if (value === "toss" || value === "portone") return value;
   throw new Error("payment provider must be toss or portone");
 }
-function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
-  const checkout = program2.command("checkout").description("Checkout management");
+function registerCommerceSessionCommands(program, getClient, getFormat) {
+  const checkout = program.command("checkout").description("Checkout management");
   checkout.command("create").description("Create a Checkout from a server-authoritative Cart").option("--data-stdin", "Read capability and customer JSON from stdin").option("--data-file <path>", "Read capability and customer JSON from file").option("--dry-run", "Validate inputs without executing").action(async (opts) => {
     try {
       const data = parseWithSchema(
@@ -3292,12 +3828,12 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
         CreateServerCheckoutParamsSchema
       );
       if (opts.dryRun) {
-        printResult(sensitiveDryRunResult("checkout create"), getFormat2());
+        printResult(sensitiveDryRunResult("checkout create"), getFormat());
         return;
       }
       printResult(
-        await getClient2().commerce.checkouts.create(data),
-        getFormat2()
+        await getClient().commerce.checkouts.create(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3306,8 +3842,8 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
   checkout.command("retrieve <checkoutId>").description("Retrieve a Checkout by ID with server credentials").action(async (checkoutId) => {
     try {
       printResult(
-        await getClient2().commerce.checkouts.retrieve({ checkoutId }),
-        getFormat2()
+        await getClient().commerce.checkouts.retrieve({ checkoutId }),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3321,14 +3857,14 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
         CanonicalCheckoutQuerySchema
       );
       printResult(
-        await getClient2().commerce.checkouts.query(data),
-        getFormat2()
+        await getClient().commerce.checkouts.query(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
     }
   });
-  const sessions = program2.command("payment-session").description("PaymentSession management");
+  const sessions = program.command("payment-session").description("PaymentSession management");
   sessions.command("create").description("Create a canonical provider-configured PaymentSession").option("--data-stdin", "Read canonical create parameters from stdin").option("--data-file <path>", "Read canonical create parameters from file").option("--dry-run", "Validate inputs without executing").action(async (opts) => {
     try {
       const data = parseWithSchema(
@@ -3339,28 +3875,27 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           sensitiveDryRunResult("payment-session create"),
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const paymentSessions = getClient2().commerce.paymentSessions;
+      const paymentSessions = getClient().commerce.paymentSessions;
       const result = data.provider === "portone" ? await paymentSessions.createPortOne(data) : await paymentSessions.create(data);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (error) {
       exitWithError(error);
     }
   });
-  sessions.command("retrieve <paymentSessionId>").description("Retrieve a PaymentSession").option(
+  sessions.command("retrieve <paymentSessionId>").description("Retrieve a PaymentSession").requiredOption(
     "--provider <provider>",
-    "Payment provider (toss or portone)",
-    "toss"
+    "Payment provider (toss or portone)"
   ).action(async (paymentSessionId, opts) => {
     try {
       const provider = paymentProvider(opts.provider);
-      const paymentSessions = getClient2().commerce.paymentSessions;
+      const paymentSessions = getClient().commerce.paymentSessions;
       printResult(
         provider === "portone" ? await paymentSessions.retrievePortOne({ paymentSessionId }) : await paymentSessions.retrieve({ paymentSessionId }),
-        getFormat2()
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3369,10 +3904,9 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
   sessions.command("cancel").description("Cancel a PaymentSession and release its payment slot").option("--data-stdin", "Read session ID and idempotency key from stdin").option(
     "--data-file <path>",
     "Read session ID and idempotency key from file"
-  ).option(
+  ).requiredOption(
     "--provider <provider>",
-    "Payment provider (toss or portone)",
-    "toss"
+    "Payment provider (toss or portone)"
   ).option("--dry-run", "Validate inputs without executing").action(async (opts) => {
     try {
       const data = parseWithSchema(
@@ -3384,14 +3918,14 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           sensitiveDryRunResult("payment-session cancel"),
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const paymentSessions = getClient2().commerce.paymentSessions;
+      const paymentSessions = getClient().commerce.paymentSessions;
       printResult(
         provider === "portone" ? await paymentSessions.cancelPortOne(data) : await paymentSessions.cancel(data),
-        getFormat2()
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3407,13 +3941,13 @@ function registerCommerceSessionCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           sensitiveDryRunResult("payment-session confirm-toss"),
-          getFormat2()
+          getFormat()
         );
         return;
       }
       printResult(
-        await getClient2().commerce.paymentSessions.confirm(data),
-        getFormat2()
+        await getClient().commerce.paymentSessions.confirm(data),
+        getFormat()
       );
     } catch (error) {
       exitWithError(error);
@@ -3469,14 +4003,14 @@ function productDetailParamsFromOptions(options) {
 }
 
 // src/commands/product.ts
-function registerProductCommands(program2, getClient2, getFormat2) {
-  const product = program2.command("product").description("Product management");
+function registerProductCommands(program, getClient, getFormat) {
+  const product = program.command("product").description("Product management");
   product.command("detail").description("Get shaped product detail by slug or ID").option("--slug <slug>", "Product slug").option("--id <id>", "Product ID").option("--market <market>", "Market slug").option("--locale <locale>", "Locale: ko, en, or all").option("--fallback-locale <locale>", "Fallback locale: ko, en, or none").action(async (opts) => {
     try {
       const params = productDetailParamsFromOptions(opts);
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.product.detail(params);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3491,15 +4025,15 @@ function registerProductCommands(program2, getClient2, getFormat2) {
       if (opts.dryRun) {
         printResult(
           { dryRun: true, valid: true, action: "product upsert", data },
-          getFormat2()
+          getFormat()
         );
         return;
       }
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.product.upsert(
         data
       );
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3507,20 +4041,20 @@ function registerProductCommands(program2, getClient2, getFormat2) {
 }
 
 // src/commands/discount.ts
-function registerDiscountCommands(program2, getClient2, getFormat2) {
-  const discount = program2.command("discount").description("Discount management");
+function registerDiscountCommands(program, getClient, getFormat) {
+  const discount = program.command("discount").description("Discount management");
   discount.command("validate").description("Validate a discount code against an order amount").requiredOption("--code <code>", "Discount code").requiredOption(
     "--order-amount <n>",
     "Order amount",
     (v) => parseInt(v, 10)
   ).action(async (opts) => {
     try {
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.discounts.validate({
         code: opts.code,
         orderAmount: opts.orderAmount
       });
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3528,15 +4062,15 @@ function registerDiscountCommands(program2, getClient2, getFormat2) {
 }
 
 // src/commands/shipping.ts
-function registerShippingCommands(program2, getClient2, getFormat2) {
-  const shipping = program2.command("shipping").description("Shipping calculation");
+function registerShippingCommands(program, getClient, getFormat) {
+  const shipping = program.command("shipping").description("Shipping calculation");
   shipping.command("calculate").description("Calculate shipping for an order amount").requiredOption(
     "--order-amount <n>",
     "Order amount",
     (v) => parseInt(v, 10)
   ).option("--shipping-policy-id <id>", "Shipping policy ID").option("--country-code <code>", "Destination country code").option("--region-code <code>", "Destination region code").option("--postal-code <code>", "Destination postal code").action(async (opts) => {
     try {
-      const client = getClient2();
+      const client = getClient();
       const result = await client.commerce.shipping.calculate({
         orderAmount: opts.orderAmount,
         ...opts.shippingPolicyId ? { shippingPolicyId: opts.shippingPolicyId } : {},
@@ -3544,7 +4078,7 @@ function registerShippingCommands(program2, getClient2, getFormat2) {
         ...opts.regionCode ? { regionCode: opts.regionCode } : {},
         ...opts.postalCode ? { postalCode: opts.postalCode } : {}
       });
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3560,6 +4094,8 @@ import { URL as URL2 } from "url";
 import pc2 from "picocolors";
 var WEB_URL = process.env.SOFTWARE_WEB_URL || "https://01.software";
 var TIMEOUT_MS = 3 * 60 * 1e3;
+var EXCHANGE_TIMEOUT_MS = 3e4;
+var MAX_EXCHANGE_RESPONSE_BYTES = 1024 * 1024;
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -3602,16 +4138,72 @@ var ERROR_HTML = (msg) => `<!DOCTYPE html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>CLI Login Error</title>
 <style>${PAGE_STYLE}</style>
 </head><body><div class="card"><div class="icon err">!</div><h1>Authentication failed</h1><p>${escapeHtml(msg)}</p></div></body></html>`;
-async function exchangeCode(code) {
+async function readBoundedResponseBody(response, signal) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null && /^\d+$/.test(contentLength) && Number(contentLength) > MAX_EXCHANGE_RESPONSE_BYTES) {
+    void response.body?.cancel().catch(() => void 0);
+    throw new Error("response body exceeded 1 MiB");
+  }
+  const reader = response.body?.getReader();
+  if (!reader) return "";
+  const decoder = new TextDecoder();
+  let body = "";
+  let totalBytes = 0;
+  let completed = false;
+  let rejectAbort;
+  const aborted = new Promise((_, reject) => {
+    rejectAbort = reject;
+  });
+  const onAbort = () => rejectAbort(new Error("request timed out"));
+  signal.addEventListener("abort", onAbort, { once: true });
+  if (signal.aborted) onAbort();
+  try {
+    while (true) {
+      const { done, value } = await Promise.race([reader.read(), aborted]);
+      if (done) {
+        completed = true;
+        return body + decoder.decode();
+      }
+      totalBytes += value.byteLength;
+      if (totalBytes > MAX_EXCHANGE_RESPONSE_BYTES) {
+        throw new Error("response body exceeded 1 MiB");
+      }
+      body += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    if (!completed) void reader.cancel().catch(() => void 0);
+  }
+}
+async function exchangeCode(code, options = {}) {
   const url = `${WEB_URL}/api/cli/exchange`;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const timeoutMs = options.timeoutMs ?? EXCHANGE_TIMEOUT_MS;
+  const controller = new AbortController();
+  let timeoutId;
+  let rejectTimeout;
+  const timedOut = new Promise((_, reject) => {
+    rejectTimeout = reject;
+  });
   try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ code })
-    });
+    timeoutId = setTimeout(() => {
+      controller.abort();
+      rejectTimeout(new Error("request timed out"));
+    }, timeoutMs);
+    const res = await Promise.race([
+      fetchImpl(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code }),
+        signal: controller.signal
+      }),
+      timedOut
+    ]);
+    const body = await Promise.race([
+      readBoundedResponseBody(res, controller.signal),
+      timedOut
+    ]);
     if (!res.ok) {
-      const body = await res.text().catch(() => "");
       console.error(
         pc2.red(
           `Exchange failed: HTTP ${res.status} from ${url}${body ? ` \u2014 ${body.slice(0, 200)}` : ""}`
@@ -3619,7 +4211,13 @@ async function exchangeCode(code) {
       );
       return null;
     }
-    const data = await res.json();
+    let data;
+    try {
+      data = JSON.parse(body);
+    } catch {
+      console.error(pc2.red(`Exchange failed: malformed response from ${url}`));
+      return null;
+    }
     if (typeof data.publishableKey !== "string" || typeof data.secretKey !== "string" || typeof data.tenantName !== "string" || typeof data.tenantId !== "string") {
       console.error(pc2.red(`Exchange failed: malformed response from ${url}`));
       return null;
@@ -3640,10 +4238,12 @@ async function exchangeCode(code) {
       )
     );
     return null;
+  } finally {
+    clearTimeout(timeoutId);
   }
 }
 function startAuthServer(options) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer((req, res) => {
       if (!req.url) {
         res.writeHead(400).end();
@@ -3656,7 +4256,10 @@ function startAuthServer(options) {
       }
       const error = url.searchParams.get("error");
       if (error) {
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(ERROR_HTML(error));
+        res.writeHead(200, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close"
+        }).end(ERROR_HTML(error));
         console.error(pc2.red(`Login failed: ${error}`));
         cleanup(2);
         return;
@@ -3664,19 +4267,32 @@ function startAuthServer(options) {
       const code = url.searchParams.get("code");
       const receivedState = url.searchParams.get("state");
       if (!code || !receivedState) {
-        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(ERROR_HTML('Missing code or state. Start over with "01 login".'));
+        res.writeHead(400, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close"
+        }).end(ERROR_HTML('Missing code or state. Start over with "01 login".'));
         cleanup(2);
         return;
       }
       if (receivedState !== options.state) {
-        res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(ERROR_HTML('State mismatch. Start over with "01 login".'));
+        res.writeHead(403, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close"
+        }).end(ERROR_HTML('State mismatch. Start over with "01 login".'));
         console.error(pc2.red("Login failed: state mismatch."));
         cleanup(2);
         return;
       }
       exchangeCode(code).then((creds) => {
         if (!creds) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(ERROR_HTML('Invalid or expired code. Start over with "01 login".'));
+          res.writeHead(400, {
+            "Content-Type": "text/html; charset=utf-8",
+            Connection: "close"
+          }).end(
+            ERROR_HTML(
+              'Invalid or expired code. Start over with "01 login".'
+            )
+          );
           console.error(pc2.red("Login failed: code exchange failed."));
           cleanup(2);
           return;
@@ -3693,7 +4309,10 @@ function startAuthServer(options) {
         console.log(pc2.green(`
 Logged in successfully!`));
         console.log(pc2.dim(`Tenant: ${creds.tenantName}`));
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(SUCCESS_HTML);
+        res.writeHead(200, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close"
+        }).end(SUCCESS_HTML);
         cleanup(0);
       });
     });
@@ -3718,15 +4337,15 @@ Logged in successfully!`));
         );
         cleanup(4);
       }, TIMEOUT_MS);
-      resolve2({ port: addr.port, cleanup });
+      resolve3({ port: addr.port, cleanup });
     });
     server.on("error", (err) => {
       reject(err);
     });
   });
 }
-function registerAuthCommands(program2) {
-  program2.command("login").description("Login via browser and store credentials").action(async () => {
+function registerAuthCommands(program) {
+  program.command("login").description("Login via browser and store credentials").action(async () => {
     const state = randomBytes2(32).toString("hex");
     try {
       const { port } = await startAuthServer({
@@ -3751,7 +4370,7 @@ ${loginUrl}`));
       process.exit(4);
     }
   });
-  program2.command("logout").description("Remove stored credentials").action(() => {
+  program.command("logout").description("Remove stored credentials").action(() => {
     const deleted = deleteCredentials();
     if (deleted) {
       console.log(pc2.green("Logged out. Credentials removed."));
@@ -3759,7 +4378,7 @@ ${loginUrl}`));
       console.log(pc2.dim("No stored credentials found."));
     }
   });
-  program2.command("whoami").description("Show current authentication status").action(() => {
+  program.command("whoami").description("Show current authentication status").action(() => {
     const localCreds = loadLocalCredentials();
     const globalCreds = loadCredentials();
     const creds = localCreds || globalCreds;
@@ -3777,7 +4396,7 @@ ${loginUrl}`));
       `File:       ${pc2.dim(isLocal ? getLocalCredentialsPath() : getCredentialsPath())}`
     );
   });
-  const tenant = program2.command("tenant").description("Manage tenant switching");
+  const tenant = program.command("tenant").description("Manage tenant switching");
   tenant.command("list").description("Show cached tenant list").action(() => {
     const tenants = loadTenantList();
     if (!tenants || tenants.length === 0) {
@@ -3858,17 +4477,17 @@ ${loginUrl}`));
 
 // src/commands/schema.ts
 import { SERVER_COLLECTIONS as SERVER_COLLECTIONS2 } from "@01.software/sdk";
-function registerSchemaCommands(program2, getClient2, getFormat2) {
-  const schema = program2.command("schema").description("Collection schema introspection");
+function registerSchemaCommands(program, getClient, getFormat) {
+  const schema = program.command("schema").description("Collection schema introspection");
   schema.command("list").description("List available collections").action(() => {
-    printResult(SERVER_COLLECTIONS2, getFormat2());
+    printResult(SERVER_COLLECTIONS2, getFormat());
   });
   schema.command("show <collection>").description("Show collection field schema").action(async (collection) => {
     try {
       const col = validateCollection(collection);
-      const client = getClient2();
+      const client = getClient();
       const result = await client.tenant.collectionSchema(col);
-      printResult(result, getFormat2());
+      printResult(result, getFormat());
     } catch (e) {
       exitWithError(e);
     }
@@ -3887,8 +4506,8 @@ function flattenProgress(progress) {
     }))
   );
 }
-function registerFeatureCommands(program2, getClient2, getFormat2) {
-  const feature = program2.command("feature").description("Feature implementation progress checks");
+function registerFeatureCommands(program, getClient, getFormat) {
+  const feature = program.command("feature").description("Feature implementation progress checks");
   feature.command("check <feature>").description("Check tenant implementation progress for a feature").option("--evidence", "Include sanitized evidence counts and surface flags").action(async (featureName, options) => {
     try {
       const input = parseWithSchema(
@@ -3899,11 +4518,11 @@ function registerFeatureCommands(program2, getClient2, getFormat2) {
         "feature",
         tenantFeatureProgressInputSchema
       );
-      const client = getClient2();
+      const client = getClient();
       const result = tenantFeatureProgressResponseSchema.parse(
         await client.tenant.featureProgress(input)
       );
-      const format = getFormat2();
+      const format = getFormat();
       printResult(
         format === "table" ? flattenProgress(result) : result,
         format
@@ -4160,18 +4779,18 @@ function assertAgentPlanCapabilityMatrix(matrix) {
       );
     }
     const seen = /* @__PURE__ */ new Set();
-    for (const operation of operations) {
-      if (!AGENT_PLAN_OPERATIONS.has(operation)) {
+    for (const operation2 of operations) {
+      if (!AGENT_PLAN_OPERATIONS.has(operation2)) {
         throw new Error(
-          `Agent plan capability operation "${operation}" is invalid for "${collection}".`
+          `Agent plan capability operation "${operation2}" is invalid for "${collection}".`
         );
       }
-      if (seen.has(operation)) {
+      if (seen.has(operation2)) {
         throw new Error(
-          `Agent plan capability operation "${operation}" is duplicated for "${collection}".`
+          `Agent plan capability operation "${operation2}" is duplicated for "${collection}".`
         );
       }
-      seen.add(operation);
+      seen.add(operation2);
     }
   }
 }
@@ -4185,19 +4804,19 @@ function isAgentPlanCollection(collection) {
 function getAgentPlanOperations(collection) {
   return isAgentPlanCollection(collection) ? AGENT_PLAN_CAPABILITIES[collection] : [];
 }
-function isAgentPlanCapability(collection, operation) {
+function isAgentPlanCapability(collection, operation2) {
   if (!isAgentPlanCollection(collection)) return false;
   return AGENT_PLAN_CAPABILITIES[collection].includes(
-    operation
+    operation2
   );
 }
-function assertAgentPlanCapability(collection, operation) {
-  if (isAgentPlanCapability(collection, operation)) {
+function assertAgentPlanCapability(collection, operation2) {
+  if (isAgentPlanCapability(collection, operation2)) {
     return collection;
   }
   throw agentPlanError(
     "UNSUPPORTED_OPERATION",
-    `Operation "${operation}" is not supported for collection "${collection}" in agent plan mutations.`
+    `Operation "${operation2}" is not supported for collection "${collection}" in agent plan mutations.`
   );
 }
 
@@ -4296,11 +4915,11 @@ function parseStoredAgentPlan(raw, planId) {
     throw agentPlanError("PLAN_MISMATCH", "Stored plan has unsupported collection.");
   }
   const collection = record.collection;
-  const operation = record.operation;
-  if (operation !== "create" && operation !== "update" && operation !== "delete") {
+  const operation2 = record.operation;
+  if (operation2 !== "create" && operation2 !== "update" && operation2 !== "delete") {
     throw agentPlanError("PLAN_MISMATCH", "Stored plan has invalid operation.");
   }
-  if (!isAgentPlanCapability(collection, operation)) {
+  if (!isAgentPlanCapability(collection, operation2)) {
     throw agentPlanError(
       "PLAN_MISMATCH",
       "Stored plan has unsupported collection operation."
@@ -4318,7 +4937,7 @@ function parseStoredAgentPlan(raw, planId) {
   return {
     planId,
     planHash: record.planHash,
-    operation,
+    operation: operation2,
     collection,
     documentId,
     payload,
@@ -4444,8 +5063,8 @@ function readDocumentUpdatedAt(doc) {
   const updatedAt = doc.updatedAt;
   return typeof updatedAt === "string" && updatedAt.length > 0 ? updatedAt : void 0;
 }
-function assertPlanBaseUpdatedAt(operation, baseUpdatedAt) {
-  if (operation === "create") {
+function assertPlanBaseUpdatedAt(operation2, baseUpdatedAt) {
+  if (operation2 === "create") {
     return;
   }
   if (!baseUpdatedAt) {
@@ -4711,7 +5330,7 @@ async function runPlanAction(input) {
     input.outputOptions
   );
 }
-function registerAgentPlanCommands(agent, getClient2) {
+function registerAgentPlanCommands(agent, getClient) {
   const plan = configureAgentParser(
     agent.command("plan").description("Plan a mutation without executing")
   );
@@ -4730,7 +5349,7 @@ function registerAgentPlanCommands(agent, getClient2) {
             dataStdin: opts.dataStdin,
             dataFile: opts.dataFile,
             outputOptions,
-            getClient: getClient2
+            getClient
           });
         } catch (error) {
           exitWithAgentError(error, outputOptions);
@@ -4754,7 +5373,7 @@ function registerAgentPlanCommands(agent, getClient2) {
             dataStdin: opts.dataStdin,
             dataFile: opts.dataFile,
             outputOptions,
-            getClient: getClient2
+            getClient
           });
         } catch (error) {
           exitWithAgentError(error, outputOptions);
@@ -4776,7 +5395,7 @@ function registerAgentPlanCommands(agent, getClient2) {
             collection,
             documentId: id,
             outputOptions,
-            getClient: getClient2
+            getClient
           });
         } catch (error) {
           exitWithAgentError(error, outputOptions);
@@ -4800,7 +5419,7 @@ function registerAgentPlanCommands(agent, getClient2) {
               "Plan token does not match --hash."
             );
           }
-          const client = getClient2();
+          const client = getClient();
           const authFingerprint = buildAuthContextFingerprint({
             publishableKey: client.publishableKey,
             secretKey: client.secretKey
@@ -4915,7 +5534,7 @@ function buildAgentManifest() {
       ...AGENT_READ_OPERATIONS,
       ...collection === "products" ? AGENT_PRODUCT_OPERATIONS : [],
       ...getAgentPlanOperations(collection).map(
-        (operation) => `plan:${operation}`
+        (operation2) => `plan:${operation2}`
       )
     ];
     collections[collection] = {
@@ -4927,7 +5546,8 @@ function buildAgentManifest() {
     version: AGENT_PROTOCOL_VERSION,
     discovery: {
       context: { counts: true },
-      schema: { mode: "effective" }
+      schema: { mode: "effective" },
+      doctor: { appIntegration: true }
     },
     collections
   };
@@ -4940,9 +5560,9 @@ function validateAgentCollection(collection) {
     throw invalidInput3(message, "collection", collection);
   }
 }
-function registerAgentCommands(program2, getClient2) {
+function registerAgentCommands(program, getClient) {
   const agent = configureAgentParser2(
-    program2.command("agent").description("Machine-stable CLI namespace for coding agents").option("--pretty", "Print 2-space indented success JSON").option(
+    program.command("agent").description("Machine-stable CLI namespace for coding agents").option("--pretty", "Print 2-space indented success JSON").option(
       "--output-file <path>",
       "Write success JSON to a secure file and print a receipt"
     ).addHelpText(
@@ -4972,7 +5592,7 @@ function registerAgentCommands(program2, getClient2) {
       const outputOptions = resolveAgentPrintOptions(command);
       try {
         validateAgentOutputTarget(outputOptions);
-        const client = getClient2();
+        const client = getClient();
         const result = opts.counts ? await client.tenant.context({ includeCounts: true }) : await client.tenant.context();
         printAgentSuccess(result, outputOptions);
       } catch (error) {
@@ -4989,7 +5609,7 @@ function registerAgentCommands(program2, getClient2) {
       try {
         validateAgentOutputTarget(outputOptions);
         const col = validateAgentCollection(collection);
-        const client = getClient2();
+        const client = getClient();
         const result = await client.tenant.collectionSchema(col);
         printAgentSuccess(result, outputOptions);
       } catch (error) {
@@ -5016,7 +5636,7 @@ function registerAgentCommands(program2, getClient2) {
           if (page != null) options.page = page;
           if (opts.sort) options.sort = opts.sort;
           if (opts.select) options.select = parseSelect(opts.select);
-          const client = getClient2();
+          const client = getClient();
           const result = await client.collections.from(col).find(options);
           printAgentSuccess(result, outputOptions);
         } catch (error) {
@@ -5040,7 +5660,7 @@ function registerAgentCommands(program2, getClient2) {
           }
           const options = {};
           if (opts.select) options.select = parseSelect(opts.select);
-          const client = getClient2();
+          const client = getClient();
           const result = await client.collections.from(col).findById(id, options);
           printAgentSuccess(result, outputOptions);
         } catch (error) {
@@ -5062,7 +5682,7 @@ function registerAgentCommands(program2, getClient2) {
         try {
           validateAgentOutputTarget(outputOptions);
           const params = productDetailParamsFromOptions(opts);
-          const client = getClient2();
+          const client = getClient();
           const result = await client.commerce.product.detail(params);
           printAgentSuccess(result, outputOptions);
         } catch (error) {
@@ -5071,37 +5691,542 @@ function registerAgentCommands(program2, getClient2) {
       }
     )
   );
-  registerAgentPlanCommands(agent, getClient2);
+  registerAgentPlanCommands(agent, getClient);
+  return agent;
+}
+
+// src/commands/embedded-app.ts
+function registerEmbeddedAppCommands(program, getClient, getFormat) {
+  const embeddedApp = program.command("embedded-app").description("Manage the active tenant embedded admin app binding");
+  embeddedApp.command("show").description("Show the active tenant embedded app binding").action(async () => {
+    try {
+      const result = await getClient().embeddedAdmin.show();
+      printResult(result, getFormat());
+    } catch (error) {
+      exitWithError(error);
+    }
+  });
+  embeddedApp.command("configure").description("Configure and enable the active tenant embedded app").requiredOption("--label <label>", "Display label shown in Console").requiredOption("--origin <origin>", "Exact HTTPS app origin").option("--path <path>", "Relative app path", "/").option("--dry-run", "Validate inputs without executing").action(
+    async (options) => {
+      try {
+        const client = getClient();
+        const input = {
+          label: options.label,
+          origin: options.origin,
+          path: options.path
+        };
+        const binding = client.embeddedAdmin.validateConfiguration(input);
+        if (options.dryRun) {
+          printResult(
+            {
+              action: "embedded app configure",
+              binding,
+              dryRun: true,
+              valid: true
+            },
+            getFormat()
+          );
+          return;
+        }
+        const result = await client.embeddedAdmin.configure(input);
+        printResult(result, getFormat());
+      } catch (error) {
+        exitWithError(error);
+      }
+    }
+  );
+  embeddedApp.command("disable").description("Disable the active tenant embedded app binding").option("--dry-run", "Validate without executing").action(async (options) => {
+    try {
+      const client = getClient();
+      client.embeddedAdmin.validateManagementAccess();
+      if (options.dryRun) {
+        printResult(
+          {
+            action: "embedded app disable",
+            dryRun: true,
+            valid: true
+          },
+          getFormat()
+        );
+        return;
+      }
+      const result = await client.embeddedAdmin.disable();
+      printResult(result, getFormat());
+    } catch (error) {
+      exitWithError(error);
+    }
+  });
+}
+
+// src/lib/doctor.ts
+import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync4 } from "fs";
+import { createRequire } from "module";
+import { join as join3, resolve as resolve2 } from "path";
+import { satisfies, validRange } from "semver";
+import {
+  TenantIntrospectionApi as TenantIntrospectionApi2,
+  TENANT_CONTEXT_PATH
+} from "@01.software/sdk/server";
+var PUBLIC_ENV_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "VITE_",
+  "REACT_APP_",
+  "PUBLIC_"
+];
+var APP_ENV_PREFIXES = ["", ...PUBLIC_ENV_PREFIXES];
+var envKey = (prefix, suffix) => `${prefix}${suffix}`;
+var PUBLISHABLE_KEYS = APP_ENV_PREFIXES.map(
+  (prefix) => envKey(prefix, "SOFTWARE_PUBLISHABLE_KEY")
+);
+var SECRET_KEYS = APP_ENV_PREFIXES.map(
+  (prefix) => envKey(prefix, "SOFTWARE_SECRET_KEY")
+);
+var SDK_API_URL_KEYS = [
+  "SOFTWARE_API_URL",
+  "NEXT_PUBLIC_SOFTWARE_API_URL"
+];
+var DoctorInputError = class extends Error {
+  constructor(field = "envFile") {
+    const message = field === "origin" ? "--origin must be an absolute http(s) URL." : "--app-env-file must name a readable regular environment file.";
+    super(message);
+    Object.assign(this, {
+      type: "validation",
+      code: "invalid_argument",
+      field,
+      detail: {
+        message,
+        field
+      }
+    });
+    this.field = field;
+  }
+};
+function doctorInputMessageKey(error) {
+  if (!(error instanceof DoctorInputError)) return void 0;
+  return error.field === "origin" ? "DoctorOriginInputInvalid" : "DoctorEnvFileInvalid";
+}
+function statusFromChecks(checks) {
+  if (checks.some((check2) => check2.status === "blocked")) return "blocked";
+  if (checks.some((check2) => check2.status === "attention")) return "attention";
+  return "ready";
+}
+function compositeExitCode(checks) {
+  const codes = checks.map((check2) => check2.exitCode).filter((code) => typeof code === "number");
+  for (const preferred of [3, 2, 6, 4, 5, 1]) {
+    if (codes.includes(preferred)) return preferred;
+  }
+  return 0;
+}
+function check(id, status, action, exitCode) {
+  return { id, status, action, ...exitCode !== void 0 && { exitCode } };
+}
+function readPackage(cwd) {
+  const path2 = join3(cwd, "package.json");
+  if (!existsSync2(path2)) return null;
+  try {
+    const value = JSON.parse(readFileSync4(path2, "utf8"));
+    return value && typeof value === "object" ? value : null;
+  } catch {
+    return null;
+  }
+}
+function nodeEngineCheck(engine, nodeVersion = process.versions.node) {
+  if (engine === void 0)
+    return check("node.engine", "attention", "DoctorNodeEngineNotDeclared");
+  if (typeof engine !== "string")
+    return check("node.engine", "attention", "DoctorNodeEngineAttention");
+  const range = validRange(engine);
+  if (!range)
+    return check("node.engine", "attention", "DoctorNodeEngineAttention");
+  return satisfies(nodeVersion, range) ? check("node.engine", "ready", "DoctorNodeEngineReady") : check("node.engine", "attention", "DoctorNodeEngineAttention");
+}
+function parseEnv(content, file) {
+  const declarations = [];
+  for (const line of content.split(/\r?\n/)) {
+    const match = line.match(
+      /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/
+    );
+    if (!match) continue;
+    let value = match[2] ?? "";
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    } else {
+      value = value.replace(/\s+#.*$/, "");
+    }
+    declarations.push({ key: match[1], value: value.trim(), file });
+  }
+  return declarations;
+}
+function readEnvFile(file) {
+  try {
+    if (!lstatSync2(file).isFile()) return null;
+    return parseEnv(readFileSync4(file, "utf8"), file);
+  } catch {
+    return null;
+  }
+}
+function existsIncludingSymlink(file) {
+  try {
+    lstatSync2(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveEnv(declarations) {
+  const values = /* @__PURE__ */ new Map();
+  const ambiguousKeys = /* @__PURE__ */ new Set();
+  const declaredInFile = /* @__PURE__ */ new Set();
+  for (const declaration of declarations) {
+    const identity = `${declaration.file}\0${declaration.key}`;
+    if (declaredInFile.has(identity)) ambiguousKeys.add(declaration.key);
+    declaredInFile.add(identity);
+    values.set(declaration.key, declaration);
+  }
+  return { values, ambiguousKeys, invalid: false };
+}
+function envFilesForPackage(pkg) {
+  const deps = {
+    ...pkg?.dependencies ?? {},
+    ...pkg?.devDependencies ?? {}
+  };
+  if ("next" in deps || "react-scripts" in deps) {
+    return [".env", ".env.development", ".env.local", ".env.development.local"];
+  }
+  if ("vite" in deps) {
+    return [".env", ".env.local", ".env.development", ".env.development.local"];
+  }
+  return [".env", ".env.local"];
+}
+function readDoctorEnv(cwd, pkg, explicit) {
+  if (explicit !== void 0) {
+    const file = resolve2(cwd, explicit);
+    const declarations2 = readEnvFile(file);
+    if (!declarations2) throw new DoctorInputError();
+    return resolveEnv(declarations2);
+  }
+  const declarations = [];
+  let found = false;
+  for (const name of envFilesForPackage(pkg)) {
+    const file = join3(cwd, name);
+    if (!existsIncludingSymlink(file)) continue;
+    found = true;
+    const parsed = readEnvFile(file);
+    if (!parsed)
+      return { values: /* @__PURE__ */ new Map(), ambiguousKeys: /* @__PURE__ */ new Set(), invalid: true };
+    declarations.push(...parsed);
+  }
+  return found ? resolveEnv(declarations) : null;
+}
+function normalizeOrigin(origin) {
+  try {
+    const value = new URL(origin);
+    if (value.protocol !== "http:" && value.protocol !== "https:" || value.username || value.password || value.origin === "null") {
+      throw new TypeError("invalid origin");
+    }
+    return value.origin;
+  } catch {
+    throw new DoctorInputError("origin");
+  }
+}
+function resolveDoctorApiUrl(env) {
+  const buildDefault = true ? "https://api.01.software" : "https://api.01.software";
+  const configured = SDK_API_URL_KEYS.map(
+    (key) => env.values.get(key)?.value
+  ).find((value2) => Boolean(value2));
+  const value = configured ?? buildDefault;
+  try {
+    return new URL(value).toString().replace(/\/$/, "");
+  } catch {
+    return null;
+  }
+}
+function inspectAppCredentials(declarations) {
+  if (!declarations || declarations.invalid) {
+    return {
+      credential: { ok: false },
+      check: check(
+        "env.app-credentials",
+        "blocked",
+        declarations?.invalid ? "DoctorEnvFileInvalid" : "DoctorEnvCredentialsBlocked",
+        3
+      )
+    };
+  }
+  const publicSecret = SECRET_KEYS.slice(1).some(
+    (key) => declarations.values.has(key)
+  );
+  const publishable = PUBLISHABLE_KEYS.map(
+    (key) => declarations.values.get(key)
+  ).filter((value) => value !== void 0);
+  const secret = declarations.values.get("SOFTWARE_SECRET_KEY");
+  const ambiguous = [
+    ...PUBLISHABLE_KEYS,
+    ...SECRET_KEYS,
+    ...SDK_API_URL_KEYS
+  ].some((key) => declarations.ambiguousKeys.has(key));
+  const publishableKey = publishable[0]?.value ?? "";
+  const secretKey = secret?.value ?? "";
+  const apiUrl = resolveDoctorApiUrl(declarations);
+  if (publicSecret || ambiguous || publishable.length !== 1 || !secret || !publishableKey || !secretKey || !publishableKey.startsWith("pk01_") || !/^sk01_[a-f0-9]{40}$/.test(secretKey) || !apiUrl) {
+    return {
+      credential: { ok: false },
+      check: check(
+        "env.app-credentials",
+        "blocked",
+        "DoctorEnvCredentialsBlocked",
+        3
+      )
+    };
+  }
+  return {
+    credential: { ok: true, publishableKey, secretKey, apiUrl },
+    check: check("env.app-credentials", "ready", "DoctorEnvCredentialsReady")
+  };
+}
+async function defaultOriginProbe(input) {
+  try {
+    const response = await fetch(new URL(TENANT_CONTEXT_PATH, input.apiUrl), {
+      method: "OPTIONS",
+      signal: AbortSignal.timeout(1e4),
+      credentials: "omit",
+      headers: {
+        Origin: input.origin,
+        "X-Publishable-Key": input.publishableKey,
+        "Access-Control-Request-Method": "GET",
+        "Access-Control-Request-Headers": "x-publishable-key"
+      }
+    });
+    if (response.status === 403) return "denied";
+    if (!response.ok || response.status === 408 || response.status === 429 || response.status === 404 || response.status >= 500) {
+      return "indeterminate";
+    }
+    const allowedOrigin = response.headers.get("access-control-allow-origin");
+    const allowsCredentials = response.headers.get("access-control-allow-credentials")?.toLowerCase() === "true";
+    if (allowedOrigin === input.origin) return "allowed";
+    if (allowedOrigin === "*" && !allowsCredentials) return "allowed";
+    return "denied";
+  } catch {
+    return "indeterminate";
+  }
+}
+async function runDoctor(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const origin = options.origin === void 0 ? void 0 : normalizeOrigin(options.origin);
+  const checks = [];
+  const pkg = readPackage(cwd);
+  checks.push(
+    pkg ? check("project.package-json", "ready", "DoctorProjectPackageJsonReady") : check(
+      "project.package-json",
+      "blocked",
+      "DoctorProjectPackageJsonBlocked",
+      3
+    )
+  );
+  const engine = pkg?.engines?.node;
+  checks.push(nodeEngineCheck(engine));
+  const deps = {
+    ...pkg?.dependencies ?? {},
+    ...pkg?.devDependencies ?? {}
+  };
+  checks.push(
+    "@01.software/sdk" in deps ? check("sdk.declaration", "ready", "DoctorSdkDeclarationReady") : check("sdk.declaration", "blocked", "DoctorSdkDeclarationBlocked", 3)
+  );
+  let sdkInstalled = false;
+  try {
+    createRequire(join3(cwd, "package.json")).resolve("@01.software/sdk/server");
+    sdkInstalled = true;
+  } catch {
+  }
+  checks.push(
+    sdkInstalled ? check("sdk.installation", "ready", "DoctorSdkInstallationReady") : check(
+      "sdk.installation",
+      "attention",
+      "DoctorSdkInstallationAttention"
+    )
+  );
+  const inspected = inspectAppCredentials(
+    readDoctorEnv(cwd, pkg, options.envFile)
+  );
+  checks.push(inspected.check);
+  if (inspected.credential.ok) {
+    const { publishableKey, secretKey, apiUrl } = inspected.credential;
+    try {
+      if (options.tenantContext) {
+        await options.tenantContext({ publishableKey, secretKey, apiUrl });
+      } else {
+        await new TenantIntrospectionApi2({
+          publishableKey,
+          secretKey,
+          apiUrl
+        }).context();
+      }
+      checks.push(check("tenant.context", "ready", "DoctorTenantContextReady"));
+    } catch (error) {
+      checks.push(
+        check(
+          "tenant.context",
+          "blocked",
+          "DoctorTenantContextBlocked",
+          getExitCode(error)
+        )
+      );
+    }
+    if (origin) {
+      const outcome = await (options.originProbe ?? defaultOriginProbe)({
+        origin,
+        apiUrl,
+        publishableKey
+      });
+      checks.push(
+        outcome === "allowed" ? check("origin.cors", "ready", "DoctorOriginCorsReady") : outcome === "denied" ? check("origin.cors", "blocked", "DoctorOriginCorsBlocked", 2) : check("origin.cors", "attention", "DoctorOriginCorsAttention")
+      );
+    }
+  } else {
+    checks.push(
+      check("tenant.context", "blocked", "DoctorTenantContextBlocked", 3)
+    );
+    if (origin)
+      checks.push(
+        check("origin.cors", "attention", "DoctorOriginCorsAttention")
+      );
+  }
+  return {
+    version: 1,
+    status: statusFromChecks(checks),
+    exitCode: compositeExitCode(checks),
+    checks
+  };
+}
+function actionText(key, locale) {
+  const table = locale === "ko" ? CLI_I18N_KO : CLI_I18N_EN;
+  return table[key];
+}
+function doctorHumanLines(result, locale) {
+  const copy = locale === "ko" ? {
+    status: "\uC0C1\uD0DC",
+    ready: "\uC900\uBE44\uB428",
+    attention: "\uD655\uC778 \uD544\uC694",
+    blocked: "\uCC28\uB2E8\uB428"
+  } : {
+    status: "Status",
+    ready: "ready",
+    attention: "attention",
+    blocked: "blocked"
+  };
+  return [
+    `${copy.status}: ${copy[result.status]}`,
+    ...result.checks.map(
+      (item) => `[${copy[item.status]}] ${item.id}: ${actionText(item.action, locale)}`
+    )
+  ];
+}
+
+// src/commands/doctor.ts
+function selectedHumanFormat(command) {
+  const options = command.optsWithGlobals();
+  return options.format ?? process.env.OUTPUT_FORMAT;
+}
+function registerDoctorCommands(program, agent) {
+  program.command("doctor").description("Check local app integration without exposing credentials").option("--app-env-file <path>", "Read one explicit app environment file").option("--origin <origin>", "Optionally probe one browser origin for CORS").action(async (options, command) => {
+    const format = selectedHumanFormat(command);
+    try {
+      const result = await runDoctor({
+        envFile: options.appEnvFile,
+        origin: options.origin
+      });
+      if (format === "json") {
+        printJson(result);
+      } else if (format === "ndjson") {
+        printResult(result, "ndjson");
+      } else {
+        for (const line of doctorHumanLines(result, detectLocale()))
+          console.log(line);
+      }
+      process.exitCode = result.exitCode;
+    } catch (error) {
+      printError(error, {
+        format: format ?? "table",
+        headlineKey: doctorInputMessageKey(error)
+      });
+      process.exitCode = getExitCode(error);
+    }
+  });
+  configureAgentParser2(
+    agent.command("doctor").description("Check local app integration with stable JSON output").option("--app-env-file <path>", "Read one explicit app environment file").option(
+      "--origin <origin>",
+      "Optionally probe one browser origin for CORS"
+    ).option("--pretty", "Print 2-space indented success JSON").option(
+      "--output-file <path>",
+      "Write success JSON to a secure file and print a receipt"
+    ).action(async (options, command) => {
+      const output = resolveAgentPrintOptions(command);
+      try {
+        validateAgentOutputTarget(output);
+        const result = await runDoctor({
+          envFile: options.appEnvFile,
+          origin: options.origin
+        });
+        printAgentSuccess(result, output);
+        process.exitCode = 0;
+      } catch (error) {
+        const envelope = printAgentError(error, output);
+        process.exitCode = agentErrorExitCode(envelope.error.code);
+      }
+    })
+  );
 }
 
 // src/index.ts
-var require2 = createRequire(import.meta.url);
+var require2 = createRequire2(import.meta.url);
 var { version } = require2("../package.json");
-var program = new Command();
-program.name("01").description("CLI for the 01.software platform").version(version).option("--api-key <key>", "API key (sk01_... or pat01_... token)").option("--format <format>", "Output format: json, table, or ndjson").option("--lang <locale>", "Force locale (ko or en)");
-var getFormat = () => program.opts().format ?? process.env.OUTPUT_FORMAT ?? "json";
-program.hook("preAction", () => {
-  const lang = program.opts().lang;
-  if (lang === "ko" || lang === "en") setLocale(lang);
-  process.env.OUTPUT_FORMAT = getFormat();
-});
-process.on("unhandledRejection", (err) => {
-  exitWithError(err, { format: getFormat() });
-});
-var getClient = () => resolveClient(program.opts().apiKey);
-var getAgentClient = () => resolveClientOrThrow(program.opts().apiKey);
-registerAgentCommands(program, getAgentClient);
-registerCrudCommands(program, getClient, getFormat);
-registerOrderCommands(program, getClient, getFormat);
-registerReturnCommands(program, getClient, getFormat);
-registerCartCommands(program, getClient, getFormat);
-registerStockCommands(program, getClient, getFormat);
-registerCommerceSessionCommands(program, getClient, getFormat);
-registerProductCommands(program, getClient, getFormat);
-registerDiscountCommands(program, getClient, getFormat);
-registerShippingCommands(program, getClient, getFormat);
-registerSchemaCommands(program, getClient, getFormat);
-registerFeatureCommands(program, getClient, getFormat);
-registerAuthCommands(program);
-program.parse();
+function createCliProgram() {
+  const program = new Command();
+  program.name("01").description("CLI for the 01.software platform").version(version).option("--api-key <key>", "API key (sk01_... or pat01_... token)").option("--format <format>", "Output format: json, table, or ndjson").option("--lang <locale>", "Force locale (ko or en)");
+  const getFormat = () => program.opts().format ?? process.env.OUTPUT_FORMAT ?? "json";
+  program.hook("preAction", () => {
+    const lang = program.opts().lang;
+    if (lang === "ko" || lang === "en") setLocale(lang);
+    const format = program.opts().format;
+    if (format) process.env.OUTPUT_FORMAT = format;
+  });
+  const getClient = () => resolveClient(program.opts().apiKey);
+  const getAgentClient = () => resolveClientOrThrow(program.opts().apiKey);
+  const agent = registerAgentCommands(program, getAgentClient);
+  registerDoctorCommands(program, agent);
+  registerCrudCommands(program, getClient, getFormat);
+  registerOrderCommands(program, getClient, getFormat);
+  registerReturnCommands(program, getClient, getFormat);
+  registerCartCommands(program, getClient, getFormat);
+  registerStockCommands(program, getClient, getFormat);
+  registerCommerceSessionCommands(program, getClient, getFormat);
+  registerProductCommands(program, getClient, getFormat);
+  registerDiscountCommands(program, getClient, getFormat);
+  registerShippingCommands(program, getClient, getFormat);
+  registerSchemaCommands(program, getClient, getFormat);
+  registerFeatureCommands(program, getClient, getFormat);
+  registerEmbeddedAppCommands(program, getClient, getFormat);
+  registerAuthCommands(program);
+  return program;
+}
+function isDirectExecution() {
+  if (process.argv[1] === void 0) return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isDirectExecution()) {
+  const program = createCliProgram();
+  process.on("unhandledRejection", (err) => {
+    exitWithError(err, {
+      format: program.opts().format ?? process.env.OUTPUT_FORMAT ?? "json"
+    });
+  });
+  program.parse();
+}
+export {
+  createCliProgram
+};
 //# sourceMappingURL=index.js.map