@agentcentral/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,1801 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { cac } from "cac";
+
+// src/types.ts
+var CliError = class extends Error {
+  code;
+  /** Optional machine-stable detail (echoed to stderr). */
+  detail;
+  constructor(code, message, detail) {
+    super(message);
+    this.name = "CliError";
+    this.code = code;
+    this.detail = detail;
+  }
+};
+
+// src/constants.ts
+var CLI_VERSION = "0.1.0";
+var DEFAULT_MCP_ENDPOINT = "https://mcp.agentcentral.to/mcp";
+var ENV_API_KEY = "AGENT_CENTRAL_API_KEY";
+var ENV_API_KEY_LEGACY = "AGENTCENTRAL_API_KEY";
+var ENV_ENDPOINT = "AGENT_CENTRAL_ENDPOINT";
+var DEFAULT_TIMEOUT_MS = 6e4;
+var USER_AGENT = "agentcentral-cli";
+var DEFAULT_RETRY = {
+  maxAttempts: 4,
+  baseBackoffMs: 500,
+  honorRetryAfter: true
+};
+var API_KEY_PREFIX = "ac_live_";
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { z } from "zod";
+var ProfileLabelSchema = z.object({
+  tenant: z.string().optional(),
+  marketplace: z.string().optional(),
+  domains: z.array(z.string()).optional()
+}).strict();
+var ProfileSchema = z.object({
+  name: z.string().min(1),
+  apiKey: z.string().min(1),
+  endpoint: z.string().optional(),
+  label: ProfileLabelSchema.optional()
+}).strict();
+var CliConfigSchema = z.object({
+  activeProfile: z.string().optional(),
+  profiles: z.array(ProfileSchema)
+}).strict();
+function configPath(env = process.env) {
+  const base = env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+  return join(base, "agentcentral", "config.json");
+}
+function loadConfig(env = process.env) {
+  const path = configPath(env);
+  if (!existsSync(path)) {
+    return { profiles: [] };
+  }
+  const stat = statSync(path);
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0) {
+    throw new CliError(
+      1 /* GeneralFailure */,
+      `config ${path} is group/world-accessible; run: chmod 600 ${path}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new CliError(
+      1 /* GeneralFailure */,
+      `config ${path} is not valid JSON`,
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  const result = CliConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new CliError(
+      1 /* GeneralFailure */,
+      `config ${path} is invalid`,
+      result.error.message
+    );
+  }
+  return result.data;
+}
+function saveConfig(config, env = process.env) {
+  const path = configPath(env);
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(config, null, 2), { mode: 384 });
+  chmodSync(path, 384);
+}
+function upsertProfile(config, profile) {
+  const exists = config.profiles.some((p) => p.name === profile.name);
+  const profiles = exists ? config.profiles.map((p) => p.name === profile.name ? profile : p) : [...config.profiles, profile];
+  return { ...config, profiles };
+}
+function removeProfile(config, name) {
+  const profiles = config.profiles.filter((p) => p.name !== name);
+  const activeProfile = config.activeProfile === name ? void 0 : config.activeProfile;
+  return { ...config, activeProfile, profiles };
+}
+function getProfile(config, name) {
+  return config.profiles.find((p) => p.name === name);
+}
+function setActiveProfile(config, name) {
+  if (!config.profiles.some((p) => p.name === name)) {
+    throw new CliError(2 /* UsageError */, `unknown profile: ${name}`);
+  }
+  return { ...config, activeProfile: name };
+}
+
+// src/auth.ts
+function redactKey(key) {
+  const last4 = key.slice(-4);
+  if (key.startsWith(API_KEY_PREFIX)) {
+    return `${API_KEY_PREFIX}***${last4}`;
+  }
+  return `***${last4}`;
+}
+function looksLikeApiKey(key) {
+  return key.startsWith(API_KEY_PREFIX);
+}
+async function resolveKey(input) {
+  const { flags, env, config, readKeyFromStdin: readKeyFromStdin2 } = input;
+  if (flags.apiKeyStdin === true) {
+    if (!readKeyFromStdin2) {
+      throw new CliError(2 /* UsageError */, "no stdin reader available for --api-key-stdin");
+    }
+    const apiKey = (await readKeyFromStdin2()).trim();
+    return { apiKey, source: "flag" };
+  }
+  if (flags.profile) {
+    const profile = getProfile(config, flags.profile);
+    if (!profile) {
+      throw new CliError(2 /* UsageError */, `unknown profile: ${flags.profile}`);
+    }
+    return { apiKey: profile.apiKey, source: "profile", profile };
+  }
+  const envKey = env[ENV_API_KEY];
+  if (envKey) {
+    return { apiKey: envKey, source: "env" };
+  }
+  const legacyKey = env[ENV_API_KEY_LEGACY];
+  if (legacyKey) {
+    return { apiKey: legacyKey, source: "env_legacy" };
+  }
+  if (config.activeProfile) {
+    const profile = getProfile(config, config.activeProfile);
+    if (profile) {
+      return { apiKey: profile.apiKey, source: "active_profile", profile };
+    }
+  }
+  if (input.keychainGet) {
+    const keychainKey = input.keychainGet();
+    if (keychainKey) {
+      return { apiKey: keychainKey, source: "keychain" };
+    }
+  }
+  if (config.profiles.length === 1) {
+    const profile = config.profiles[0];
+    return { apiKey: profile.apiKey, source: "default", profile };
+  }
+  throw new CliError(
+    3 /* AuthError */,
+    "No API key. Set AGENT_CENTRAL_API_KEY, run: agentcentral auth login, or pass --profile <name>."
+  );
+}
+async function resolveAuth(input) {
+  const { flags, env } = input;
+  const warn = input.warn ?? (() => {
+  });
+  const resolution = await resolveKey(input);
+  if (resolution.source === "env_legacy") {
+    warn("AGENTCENTRAL_API_KEY is deprecated; use AGENT_CENTRAL_API_KEY");
+  }
+  if (env[ENV_API_KEY] && flags.profile) {
+    warn(
+      `Both AGENT_CENTRAL_API_KEY and --profile are set; using profile ${flags.profile}. Keys are single-marketplace bound \u2014 verify the target account.`
+    );
+  }
+  const apiKey = resolution.apiKey.trim();
+  if (!looksLikeApiKey(apiKey)) {
+    warn("API key does not start with ac_live_; continuing.");
+  }
+  const endpoint = resolution.profile?.endpoint ?? env[ENV_ENDPOINT] ?? DEFAULT_MCP_ENDPOINT;
+  return {
+    apiKey,
+    endpoint,
+    source: resolution.source,
+    ...resolution.profile ? { profileName: resolution.profile.name } : {}
+  };
+}
+
+// src/transport.ts
+function parseSseJsonRpc(text) {
+  const dataLines = text.trim().split(/\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim());
+  return JSON.parse(dataLines.length ? dataLines.join("\n") : text);
+}
+var RetryableError = class extends Error {
+  status;
+  retryAfterMs;
+  constructor(message, opts) {
+    super(message);
+    this.name = "RetryableError";
+    this.status = opts?.status;
+    this.retryAfterMs = opts?.retryAfterMs;
+  }
+};
+function isAbortError(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function parseRetryAfterMs(value, now) {
+  if (value == null) return void 0;
+  const trimmed = value.trim();
+  if (trimmed === "") return void 0;
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1e3;
+  }
+  const dateMs = Date.parse(trimmed);
+  if (Number.isNaN(dateMs)) return void 0;
+  return Math.max(0, dateMs - now);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function buildHeaders(auth, requestId) {
+  return {
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream",
+    "User-Agent": USER_AGENT,
+    "Authorization": `Bearer ${auth.apiKey}`,
+    ...requestId ? { "X-Request-Id": requestId } : {}
+  };
+}
+function createClient(auth, opts = {}) {
+  const retry = opts.retry ?? DEFAULT_RETRY;
+  const defaultTimeoutMs = opts.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const headers = buildHeaders(auth, opts.requestId);
+  let counter = 0;
+  const nextId = () => {
+    counter += 1;
+    return counter;
+  };
+  async function attempt(method, params, id, timeoutMs) {
+    let res;
+    try {
+      res = await fetch(auth.endpoint, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ jsonrpc: "2.0", id, method, params }),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (error) {
+      if (isAbortError(error)) {
+        throw new CliError(
+          8 /* Timeout */,
+          `Request timed out after ${timeoutMs}ms`,
+          method
+        );
+      }
+      throw new RetryableError(
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+    if (res.status === 401) {
+      throw new CliError(
+        3 /* AuthError */,
+        "Authentication failed (HTTP 401): the API key was rejected by the hosted server.",
+        method
+      );
+    }
+    if (res.status === 429 || res.status >= 500) {
+      const retryAfterMs = retry.honorRetryAfter ? parseRetryAfterMs(res.headers.get("retry-after"), Date.now()) : void 0;
+      throw new RetryableError(`HTTP ${res.status}`, {
+        status: res.status,
+        retryAfterMs
+      });
+    }
+    const text = await res.text();
+    if (!res.ok) {
+      throw new CliError(
+        6 /* TransportFailure */,
+        `HTTP ${res.status}: ${text.slice(0, 200)}`,
+        method
+      );
+    }
+    return parseSseJsonRpc(text);
+  }
+  async function rpc(method, params, rpcOpts) {
+    const timeoutMs = rpcOpts?.timeoutMs ?? defaultTimeoutMs;
+    const id = rpcOpts?.id ?? nextId();
+    const maxAttempts = Math.max(1, retry.maxAttempts);
+    let lastReason = "transport failure";
+    for (let n = 1; n <= maxAttempts; n += 1) {
+      try {
+        return await attempt(method, params ?? {}, id, timeoutMs);
+      } catch (error) {
+        if (error instanceof CliError) {
+          throw error;
+        }
+        if (!(error instanceof RetryableError)) {
+          throw error;
+        }
+        lastReason = error.message;
+        if (n >= maxAttempts) break;
+        const backoffMs = retry.baseBackoffMs * 2 ** (n - 1);
+        const delayMs = error.retryAfterMs ?? backoffMs;
+        opts.onRetry?.({ attempt: n, delayMs, reason: lastReason });
+        await sleep(delayMs);
+      }
+    }
+    throw new CliError(
+      6 /* TransportFailure */,
+      `Transport failure after ${maxAttempts} attempt(s): ${lastReason}`,
+      method
+    );
+  }
+  async function listTools(listOpts) {
+    const response = await rpc("tools/list", {}, { timeoutMs: listOpts?.timeoutMs });
+    if (response.error) {
+      throw new CliError(7 /* ToolExecutionFailed */, response.error.message, "tools/list");
+    }
+    const result = response.result ?? {};
+    return result.tools ?? [];
+  }
+  async function callTool(name, args, callOpts) {
+    const response = await rpc(
+      "tools/call",
+      { name, arguments: args },
+      { timeoutMs: callOpts?.timeoutMs }
+    );
+    if (response.error) {
+      throw new CliError(7 /* ToolExecutionFailed */, response.error.message, name);
+    }
+    return response.result ?? {};
+  }
+  return { rpc, listTools, callTool };
+}
+
+// src/commands/tools.ts
+import { readFile, writeFile } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { TOOL_DOMAINS } from "@agent-central/shared";
+
+// src/format.ts
+function isTabular(value) {
+  if (!Array.isArray(value) || value.length === 0) {
+    return false;
+  }
+  return value.every(isPlainObject);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function cellString(value) {
+  if (value === null || value === void 0) {
+    return "";
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+function columns(rows) {
+  const seen = /* @__PURE__ */ new Set();
+  const keys = [];
+  for (const row of rows) {
+    for (const key of Object.keys(row)) {
+      if (!seen.has(key)) {
+        seen.add(key);
+        keys.push(key);
+      }
+    }
+  }
+  return keys;
+}
+function padCell(cell, width) {
+  return cell + " ".repeat(width - cell.length);
+}
+function formatTable(rows) {
+  const cols = columns(rows);
+  const cells = rows.map((row) => cols.map((col) => cellString(row[col])));
+  const widths = cols.map(
+    (col, i) => cells.reduce((max, rowCells) => Math.max(max, rowCells[i].length), col.length)
+  );
+  const header = cols.map((col, i) => padCell(col, widths[i])).join("  ");
+  const separator = widths.map((width) => "-".repeat(width)).join("  ");
+  const body = cells.map(
+    (rowCells) => rowCells.map((cell, i) => padCell(cell, widths[i])).join("  ")
+  );
+  return [header, separator, ...body].join("\n");
+}
+function csvField(cell) {
+  if (/[",\r\n]/.test(cell)) {
+    return '"' + cell.replace(/"/g, '""') + '"';
+  }
+  return cell;
+}
+function formatCsv(rows) {
+  const cols = columns(rows);
+  const header = cols.map(csvField).join(",");
+  const body = rows.map((row) => cols.map((col) => csvField(cellString(row[col]))).join(","));
+  return [header, ...body].join("\n");
+}
+function mdCell(cell) {
+  return cell.replace(/\|/g, "\\|").replace(/[\r\n]+/g, " ");
+}
+function formatMarkdown(rows) {
+  const cols = columns(rows);
+  const header = "| " + cols.map(mdCell).join(" | ") + " |";
+  const separator = "| " + cols.map(() => "---").join(" | ") + " |";
+  const body = rows.map(
+    (row) => "| " + cols.map((col) => mdCell(cellString(row[col]))).join(" | ") + " |"
+  );
+  return [header, separator, ...body].join("\n");
+}
+function formatOutput(value, format) {
+  switch (format) {
+    case "json":
+      return JSON.stringify(value, null, 2);
+    case "ndjson":
+      return Array.isArray(value) ? value.map((v) => JSON.stringify(v)).join("\n") : JSON.stringify(value);
+    case "table":
+      if (!isTabular(value)) {
+        throw new CliError(2 /* UsageError */, "result is not tabular; use --format json");
+      }
+      return formatTable(value);
+    case "csv":
+      if (!isTabular(value)) {
+        throw new CliError(2 /* UsageError */, "result is not tabular; use --format json");
+      }
+      return formatCsv(value);
+    case "markdown":
+      if (!isTabular(value)) {
+        throw new CliError(2 /* UsageError */, "result is not tabular; use --format json");
+      }
+      return formatMarkdown(value);
+  }
+}
+
+// src/exit-codes.ts
+var RPC_INVALID_PARAMS = -32602;
+var DETAIL_MAX_LENGTH = 180;
+var PERMISSION_PATTERN = /no_amazon|not connected|expired|suspended|revoked|past_due|trial expired|permission|not authorized|scope/i;
+var VALIDATION_PATTERN = /invalid|validation|must be|required/i;
+function writeEnvelopeFrom(result) {
+  const structured = result.structuredContent;
+  if (!structured) {
+    return void 0;
+  }
+  const hasWriteShape = "mode" in structured || "status" in structured || "requested_count" in structured;
+  if (!hasWriteShape) {
+    return void 0;
+  }
+  return structured;
+}
+function toolClassification(def) {
+  const properties = def.inputSchema.properties;
+  const props = properties && typeof properties === "object" ? properties : {};
+  const isWrite = "confirm" in props && "idempotency_key" in props;
+  return {
+    isWrite,
+    supportsPreview: isWrite
+  };
+}
+function classifyToolText(text) {
+  if (PERMISSION_PATTERN.test(text)) {
+    return 4 /* PermissionDenied */;
+  }
+  if (VALIDATION_PATTERN.test(text)) {
+    return 5 /* ValidationFailed */;
+  }
+  return void 0;
+}
+function joinContentText(result) {
+  return result.content.map((block) => typeof block.text === "string" ? block.text : "").filter((text) => text.length > 0).join(" ").trim();
+}
+function truncateDetail(text) {
+  if (text.length <= DETAIL_MAX_LENGTH) {
+    return text;
+  }
+  return `${text.slice(0, DETAIL_MAX_LENGTH)}\u2026`;
+}
+function classifyWriteStatus(status) {
+  switch (status) {
+    case "validation_error":
+      return 5 /* ValidationFailed */;
+    case "partial":
+      return 9 /* PartialWrite */;
+    case "blocked":
+    case "failed":
+      return 7 /* ToolExecutionFailed */;
+    case "duplicate_blocked":
+    case "accepted":
+    case "preview":
+    default:
+      return 0 /* Success */;
+  }
+}
+function summarizeWriteEnvelope(env) {
+  const parts = [];
+  if (typeof env.requested_count === "number") {
+    parts.push(`requested=${env.requested_count}`);
+  }
+  if (typeof env.accepted_count === "number") {
+    parts.push(`accepted=${env.accepted_count}`);
+  }
+  if (typeof env.failed_count === "number") {
+    parts.push(`failed=${env.failed_count}`);
+  }
+  if (typeof env.previewed_count === "number") {
+    parts.push(`previewed=${env.previewed_count}`);
+  }
+  const status = env.status ?? "unknown";
+  return parts.length > 0 ? `${status} (${parts.join(", ")})` : status;
+}
+function classifyResponse(response) {
+  if (response.error) {
+    const message = response.error.message;
+    const code = response.error.code === RPC_INVALID_PARAMS ? 5 /* ValidationFailed */ : classifyToolText(message) ?? 7 /* ToolExecutionFailed */;
+    return {
+      code,
+      status: "rpc_error",
+      detail: message
+    };
+  }
+  const result = response.result;
+  const env = writeEnvelopeFrom(result);
+  if (env?.status) {
+    return {
+      code: classifyWriteStatus(env.status),
+      status: env.status,
+      detail: summarizeWriteEnvelope(env),
+      result
+    };
+  }
+  if (result.isError) {
+    const text = joinContentText(result);
+    const code = classifyToolText(text) ?? 7 /* ToolExecutionFailed */;
+    return {
+      code,
+      status: "tool_error",
+      detail: truncateDetail(text),
+      result
+    };
+  }
+  return {
+    code: 0 /* Success */,
+    status: "ok",
+    detail: truncateDetail(joinContentText(result)),
+    result
+  };
+}
+
+// src/commands/tools.ts
+function parseJsonArgs(text, origin) {
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new CliError(2 /* UsageError */, `invalid JSON in ${origin}: ${reason}`);
+  }
+}
+async function resolveInput(spec, readStdin) {
+  if (spec === void 0) {
+    return {};
+  }
+  if (spec === "-") {
+    return parseJsonArgs(await readStdin(), "stdin");
+  }
+  if (spec.startsWith("@")) {
+    const path = spec.slice(1);
+    let contents;
+    try {
+      contents = await readFile(path, "utf8");
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new CliError(2 /* UsageError */, `could not read --input file: ${path} (${reason})`);
+    }
+    return parseJsonArgs(contents, `file ${path}`);
+  }
+  const trimmed = spec.trim();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    return parseJsonArgs(spec, "--input");
+  }
+  if (existsSync2(spec)) {
+    let contents;
+    try {
+      contents = await readFile(spec, "utf8");
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new CliError(2 /* UsageError */, `could not read --input file: ${spec} (${reason})`);
+    }
+    return parseJsonArgs(contents, `file ${spec}`);
+  }
+  throw new CliError(
+    2 /* UsageError */,
+    `could not interpret --input: ${spec} (expected JSON, @file, "-", or an existing file path)`
+  );
+}
+var TOOL_DOMAIN_BY_NAME = TOOL_DOMAINS.reduce(
+  (acc, domain) => {
+    const entries = domain.tools.reduce(
+      (inner, tool) => ({ ...inner, [tool.name]: domain.serverDomain }),
+      {}
+    );
+    return { ...acc, ...entries };
+  },
+  {}
+);
+function requireTool(tools, name) {
+  const def = tools.find((tool) => tool.name === name);
+  if (!def) {
+    throw new CliError(2 /* UsageError */, `unknown tool: ${name}`);
+  }
+  return def;
+}
+function schemaProperties(def) {
+  const properties = def.inputSchema.properties;
+  return properties && typeof properties === "object" ? properties : {};
+}
+function schemaRequired(def) {
+  const required = def.inputSchema.required;
+  return Array.isArray(required) ? new Set(required.map(String)) : /* @__PURE__ */ new Set();
+}
+async function toolsList(ctx) {
+  const client = await ctx.getClient();
+  const tools = await client.listTools({ timeoutMs: ctx.flags.timeoutMs });
+  const domainFilter = ctx.flags.domain;
+  const filtered = domainFilter ? tools.filter((def) => TOOL_DOMAIN_BY_NAME[def.name] === domainFilter) : tools;
+  const rows = filtered.map((def) => ({
+    name: def.name,
+    write: toolClassification(def).isWrite,
+    description: def.description ?? ""
+  }));
+  const format = ctx.flags.format === "table" ? "table" : ctx.flags.format;
+  ctx.out(formatOutput(rows, format));
+  return 0 /* Success */;
+}
+async function toolsDescribe(ctx, name) {
+  const client = await ctx.getClient();
+  const tools = await client.listTools({ timeoutMs: ctx.flags.timeoutMs });
+  const def = requireTool(tools, name);
+  if (ctx.flags.format !== "table") {
+    ctx.out(formatOutput(def, ctx.flags.format));
+    return 0 /* Success */;
+  }
+  const properties = schemaProperties(def);
+  const required = schemaRequired(def);
+  const rows = Object.keys(properties).map((param) => {
+    const schema = properties[param];
+    const schemaObj = schema && typeof schema === "object" ? schema : {};
+    return {
+      parameter: param,
+      type: typeof schemaObj.type === "string" ? schemaObj.type : "",
+      required: required.has(param),
+      description: typeof schemaObj.description === "string" ? schemaObj.description : ""
+    };
+  });
+  if (rows.length === 0) {
+    ctx.out(`${def.name}: no parameters`);
+    return 0 /* Success */;
+  }
+  ctx.out(formatOutput(rows, "table"));
+  return 0 /* Success */;
+}
+async function toolsSchema(ctx, name) {
+  const client = await ctx.getClient();
+  const tools = await client.listTools({ timeoutMs: ctx.flags.timeoutMs });
+  const def = requireTool(tools, name);
+  ctx.out(JSON.stringify(def.inputSchema, null, 2));
+  return 0 /* Success */;
+}
+function buildCallArgs(ctx, def, input) {
+  const isWrite = toolClassification(def).isWrite;
+  const properties = schemaProperties(def);
+  const limitOverride = ctx.flags.limit != null && "limit" in properties ? { limit: ctx.flags.limit } : {};
+  if (!isWrite) {
+    return { ...input, ...limitOverride };
+  }
+  if (!ctx.flags.yes) {
+    return { ...input, ...limitOverride };
+  }
+  if (!ctx.flags.idempotencyKey) {
+    throw new CliError(5 /* ValidationFailed */, "submit requires --idempotency-key");
+  }
+  return {
+    ...input,
+    ...limitOverride,
+    confirm: true,
+    idempotency_key: ctx.flags.idempotencyKey
+  };
+}
+function selectOutputValue(result) {
+  if (result.structuredContent !== void 0) {
+    return result.structuredContent;
+  }
+  const first = result.content.find((block) => typeof block.text === "string");
+  const text = first?.text;
+  if (text === void 0) {
+    return result.content;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function echoWriteSummary(ctx, result) {
+  const env = writeEnvelopeFrom(result);
+  if (!env) {
+    return;
+  }
+  const parts = [];
+  if (env.mode) parts.push(`mode=${env.mode}`);
+  if (env.status) parts.push(`status=${env.status}`);
+  if (typeof env.accepted_count === "number") parts.push(`accepted=${env.accepted_count}`);
+  if (typeof env.failed_count === "number") parts.push(`failed=${env.failed_count}`);
+  if (env.idempotency_key) parts.push(`idempotency_key=${env.idempotency_key}`);
+  ctx.err(parts.join(" "));
+  if (env.status === "duplicate_blocked") {
+    ctx.err("note: a prior submission with this idempotency key stands; no new write was made.");
+  }
+}
+async function toolsCall(ctx, name, inputSpec) {
+  const input = await resolveInput(inputSpec, readStdinOnce);
+  const client = await ctx.getClient();
+  const tools = await client.listTools({ timeoutMs: ctx.flags.timeoutMs });
+  const def = requireTool(tools, name);
+  const args = buildCallArgs(ctx, def, input);
+  const response = await client.rpc(
+    "tools/call",
+    { name, arguments: args },
+    { timeoutMs: ctx.flags.timeoutMs }
+  );
+  const classified = classifyResponse(response);
+  const result = classified.result;
+  if (!result) {
+    if (classified.detail) {
+      ctx.err(classified.detail);
+    }
+    return classified.code;
+  }
+  echoWriteSummary(ctx, result);
+  const value = selectOutputValue(result);
+  const rendered = formatOutput(value, ctx.flags.format);
+  if (ctx.flags.output) {
+    await writeFile(ctx.flags.output, rendered, "utf8");
+    ctx.err(`wrote result to ${ctx.flags.output}`);
+  } else {
+    ctx.out(rendered);
+  }
+  return classified.code;
+}
+async function readStdinOnce() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/commands/mcp.ts
+import { TOOL_DOMAINS as TOOL_DOMAINS2 } from "@agent-central/shared";
+var DOMAIN_BY_TOOL = new Map(
+  TOOL_DOMAINS2.flatMap(
+    (domain) => domain.tools.map((tool) => [tool.name, domain.serverDomain])
+  )
+);
+function filterToolsList(tools, opts) {
+  const domainSet = opts.domains && opts.domains.length > 0 ? new Set(opts.domains) : void 0;
+  return tools.filter((def) => {
+    if (opts.readOnly && toolClassification(def).isWrite) {
+      return false;
+    }
+    if (domainSet) {
+      const domain = DOMAIN_BY_TOOL.get(def.name);
+      if (domain !== void 0 && !domainSet.has(domain)) {
+        return false;
+      }
+    }
+    return true;
+  });
+}
+var PARSE_ERROR_RESPONSE = JSON.stringify({
+  jsonrpc: "2.0",
+  id: null,
+  error: { code: -32700, message: "Parse error" }
+});
+async function handleMessage(line, client, opts) {
+  const trimmed = line.trim();
+  if (trimmed === "") {
+    return null;
+  }
+  let message;
+  try {
+    message = JSON.parse(trimmed);
+  } catch {
+    return PARSE_ERROR_RESPONSE;
+  }
+  const method = typeof message.method === "string" ? message.method : "";
+  if (message.id === void 0) {
+    try {
+      await client.rpc(method, message.params);
+    } catch {
+    }
+    return null;
+  }
+  const id = message.id;
+  try {
+    const response = await client.rpc(method, message.params, {
+      id
+    });
+    const withId = { ...response, id };
+    const shouldFilter = opts.readOnly || (opts.domains?.length ?? 0) > 0;
+    const result = withId.result;
+    if (method === "tools/list" && shouldFilter && Array.isArray(result?.tools)) {
+      const filtered = {
+        ...withId,
+        result: { ...result, tools: filterToolsList(result.tools, opts) }
+      };
+      return JSON.stringify(filtered);
+    }
+    return JSON.stringify(withId);
+  } catch (error) {
+    const message_ = error instanceof CliError ? error.message : "internal bridge error";
+    return JSON.stringify({
+      jsonrpc: "2.0",
+      id,
+      error: { code: -32001, message: message_ }
+    });
+  }
+}
+function keylessClient() {
+  const fail = (method) => {
+    throw new CliError(
+      3 /* AuthError */,
+      "no API key: set AGENT_CENTRAL_API_KEY before starting the bridge",
+      method
+    );
+  };
+  return {
+    rpc: async (method) => fail(method),
+    listTools: async () => fail("tools/list"),
+    callTool: async (name) => fail(name)
+  };
+}
+function readServeFlags(ctx) {
+  const flags = ctx.flags;
+  const readOnly = flags.readOnly === true;
+  const rawDomains = flags.domains;
+  const domains = Array.isArray(rawDomains) ? rawDomains.filter((entry) => typeof entry === "string") : typeof rawDomains === "string" && rawDomains.length > 0 ? rawDomains.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : void 0;
+  return { readOnly, domains: domains && domains.length > 0 ? domains : void 0 };
+}
+async function mcpServe(ctx) {
+  const opts = readServeFlags(ctx);
+  let client;
+  try {
+    client = await ctx.getClient();
+  } catch (error) {
+    if (error instanceof CliError && error.code === 3 /* AuthError */) {
+      ctx.err("warning: no API key resolved; bridge will reject every request (set AGENT_CENTRAL_API_KEY)");
+      client = keylessClient();
+    } else {
+      throw error;
+    }
+  }
+  ctx.err(
+    `bridge started${opts.readOnly ? " (read-only)" : ""}${opts.domains ? ` (domains: ${opts.domains.join(", ")})` : ""}`
+  );
+  return await pump(ctx, client, opts);
+}
+function pump(ctx, client, opts, input = process.stdin) {
+  return new Promise((resolve, reject) => {
+    input.setEncoding("utf8");
+    let buffer = "";
+    let chain = Promise.resolve();
+    const dispatch = (line) => {
+      chain = chain.then(async () => {
+        try {
+          const out = await handleMessage(line, client, opts);
+          if (out !== null) {
+            ctx.out(out);
+          }
+        } catch (error) {
+          ctx.err(`bridge error: ${error instanceof Error ? error.message : String(error)}`);
+        }
+      });
+    };
+    input.on("data", (data) => {
+      buffer += typeof data === "string" ? data : data.toString("utf8");
+      let newlineIndex = buffer.indexOf("\n");
+      while (newlineIndex !== -1) {
+        const line = buffer.slice(0, newlineIndex);
+        buffer = buffer.slice(newlineIndex + 1);
+        dispatch(line);
+        newlineIndex = buffer.indexOf("\n");
+      }
+    });
+    input.on("error", (error) => {
+      reject(new CliError(6 /* TransportFailure */, `stdin error: ${error.message}`));
+    });
+    input.on("end", () => {
+      const tail = buffer;
+      buffer = "";
+      if (tail.trim() !== "") {
+        dispatch(tail);
+      }
+      chain.then(() => {
+        ctx.err("bridge stopped (stdin closed)");
+        resolve(0 /* Success */);
+      }).catch(reject);
+    });
+  });
+}
+var API_KEY_NOTE = "Set AGENT_CENTRAL_API_KEY in the environment the client launches the CLI in.";
+var STDIO_SERVER = {
+  command: "agentcentral",
+  args: ["mcp", "serve"]
+};
+async function mcpConfig(ctx, client = "claude") {
+  const normalized = client.trim().toLowerCase();
+  switch (normalized) {
+    case "claude":
+    case "cursor": {
+      const config = { mcpServers: { agentcentral: { ...STDIO_SERVER } } };
+      ctx.out(JSON.stringify(config, null, 2));
+      ctx.err(API_KEY_NOTE);
+      return 0 /* Success */;
+    }
+    case "openclaw":
+    case "hermes": {
+      const config = { agentcentral: { ...STDIO_SERVER } };
+      ctx.out(JSON.stringify(config, null, 2));
+      ctx.err(API_KEY_NOTE);
+      return 0 /* Success */;
+    }
+    default:
+      throw new CliError(
+        2 /* UsageError */,
+        `unknown client "${client}" (expected one of: claude, cursor, openclaw, hermes)`
+      );
+  }
+}
+async function mcpTest(ctx) {
+  try {
+    const client = await ctx.getClient();
+    const tools = await client.listTools({ timeoutMs: 1e4 });
+    ctx.err(`bridge ok: ${tools.length} tools reachable`);
+    return 0 /* Success */;
+  } catch (error) {
+    if (error instanceof CliError) {
+      ctx.err(`bridge test failed: ${error.message}`);
+      return error.code;
+    }
+    throw error;
+  }
+}
+
+// src/commands/diagnostics.ts
+import { statSync as statSync2 } from "fs";
+function payloadFromResult(result) {
+  if (result.structuredContent) {
+    return result.structuredContent;
+  }
+  const text = result.content.find((block) => typeof block.text === "string")?.text;
+  if (typeof text !== "string") {
+    throw new CliError(7 /* ToolExecutionFailed */, "get_account_info returned no content");
+  }
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    throw new CliError(
+      7 /* ToolExecutionFailed */,
+      "get_account_info returned unparseable content",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+}
+function summarizeAccountInfo(payload) {
+  const info = payload;
+  const lines = [];
+  const mp = info.marketplace;
+  if (mp) {
+    const where = [mp.country_name ?? mp.country_code, mp.currency_code].filter(Boolean).join(" \xB7 ");
+    lines.push(`marketplace      ${where || mp.marketplace_id || "unknown"}`);
+  } else {
+    lines.push("marketplace      (none \u2014 no resolved marketplace scope)");
+  }
+  const sc = info.connections?.seller_central?.status ?? "unknown";
+  const ads = info.connections?.amazon_ads?.status ?? "unknown";
+  lines.push(`seller central   ${sc}`);
+  lines.push(`amazon ads       ${ads}`);
+  const domains = info.enabled_domains ?? [];
+  lines.push(`enabled domains  ${domains.length > 0 ? domains.join(", ") : "(none)"}`);
+  const tools = info.tools;
+  if (tools) {
+    lines.push(
+      `read tools       ${tools.read_enabled ?? 0} enabled, ${tools.read_disabled ?? 0} disabled`
+    );
+    lines.push(
+      `write tools      ${tools.write_enabled ?? 0} enabled, ${tools.write_disabled ?? 0} disabled`
+    );
+  }
+  return lines.join("\n");
+}
+async function accountInfo(ctx) {
+  const client = await ctx.getClient();
+  const result = await client.callTool("get_account_info", {});
+  const payload = payloadFromResult(result);
+  if (ctx.flags.format === "table") {
+    ctx.out(summarizeAccountInfo(payload));
+  } else {
+    ctx.out(formatOutput(payload, ctx.flags.format));
+  }
+  return 0 /* Success */;
+}
+var STATUS_GLYPH = {
+  ok: "ok  ",
+  warn: "warn",
+  fail: "fail",
+  info: "info"
+};
+var STATUS_MARK = {
+  ok: "[x]",
+  warn: "[!]",
+  fail: "[ ]",
+  info: "[i]"
+};
+function originFromEndpoint(endpoint) {
+  try {
+    return new URL(endpoint).origin;
+  } catch {
+    return void 0;
+  }
+}
+function renderTextReport(checks) {
+  const width = checks.reduce((max, c) => Math.max(max, c.name.length), 0);
+  const lines = checks.map((c) => {
+    const padded = c.name + " ".repeat(width - c.name.length);
+    return `${STATUS_GLYPH[c.status]}  ${padded}  ${c.detail}`;
+  });
+  return ["agentcentral doctor", "", ...lines].join("\n");
+}
+function renderMarkdownReport(checks) {
+  const lines = checks.map((c) => `- ${STATUS_MARK[c.status]} **${c.name}** \u2014 ${c.detail}`);
+  return ["# agentcentral doctor", "", ...lines].join("\n");
+}
+function checkConfigPerms(env) {
+  const path = configPath(env);
+  try {
+    const stat = statSync2(path);
+    if (process.platform === "win32") {
+      return { name: "config perms", status: "ok", detail: `${path} (POSIX perms not enforced on Windows)` };
+    }
+    const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+    if ((stat.mode & 63) !== 0) {
+      return {
+        name: "config perms",
+        status: "warn",
+        detail: `${path} is mode ${mode}; group/world accessible \u2014 run: chmod 600 ${path}`
+      };
+    }
+    return { name: "config perms", status: "ok", detail: `${path} (mode ${mode})` };
+  } catch {
+    return { name: "config perms", status: "info", detail: `no config file (${path})` };
+  }
+}
+async function checkHealth(origin, timeoutMs) {
+  if (!origin) {
+    return {
+      reachable: false,
+      check: { name: "hosted /health", status: "fail", detail: "endpoint URL did not parse" }
+    };
+  }
+  const url = `${origin}/health`;
+  try {
+    const res = await fetch(url, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) {
+      return {
+        reachable: false,
+        check: { name: "hosted /health", status: "fail", detail: `${url} -> HTTP ${res.status}` }
+      };
+    }
+    let status;
+    try {
+      const body = await res.json();
+      status = body.status;
+    } catch {
+      status = void 0;
+    }
+    if (status === "ok") {
+      return { reachable: true, check: { name: "hosted /health", status: "ok", detail: url } };
+    }
+    return {
+      reachable: false,
+      check: {
+        name: "hosted /health",
+        status: "warn",
+        detail: `${url} reachable but status=${String(status)}`
+      }
+    };
+  } catch (error) {
+    return {
+      reachable: false,
+      check: {
+        name: "hosted /health",
+        status: "fail",
+        detail: `${url} unreachable: ${error instanceof Error ? error.message : String(error)}`
+      }
+    };
+  }
+}
+async function checkAuth(ctx) {
+  try {
+    const auth = await ctx.resolveAuth();
+    const profile = auth.profileName ? ` profile=${auth.profileName}` : "";
+    return {
+      auth,
+      check: {
+        name: "auth",
+        status: "ok",
+        detail: `${redactKey(auth.apiKey)} (source=${auth.source}${profile}) endpoint=${auth.endpoint}`
+      }
+    };
+  } catch {
+    return { auth: void 0, check: { name: "auth", status: "fail", detail: "no API key" } };
+  }
+}
+function accountCheckFromPayload(payload) {
+  const info = payload;
+  const mp = info.marketplace;
+  const where = mp ? mp.country_name ?? mp.country_code ?? mp.marketplace_id ?? "unknown" : "(none)";
+  const sc = info.connections?.seller_central?.status ?? "unknown";
+  const ads = info.connections?.amazon_ads?.status ?? "unknown";
+  const domains = info.enabled_domains ?? [];
+  const reads = info.tools?.read_enabled ?? 0;
+  const writes = info.tools?.write_enabled ?? 0;
+  return {
+    name: "account",
+    status: "ok",
+    detail: `${where} \xB7 seller_central=${sc}, amazon_ads=${ads} \xB7 domains=${domains.length} \xB7 ${reads} read / ${writes} write tools`
+  };
+}
+async function doctor(ctx) {
+  const checks = [];
+  checks.push({ name: "cli version", status: "info", detail: CLI_VERSION });
+  checks.push({ name: "node version", status: "info", detail: process.version });
+  checks.push({ name: "platform", status: "info", detail: process.platform });
+  checks.push({ name: "install path", status: "info", detail: process.argv[1] ?? "(unknown)" });
+  const { auth, check: authCheck } = await checkAuth(ctx);
+  const authed = auth !== void 0;
+  const checksWithAuth = [...checks, authCheck, checkConfigPerms(ctx.env)];
+  const origin = auth ? originFromEndpoint(auth.endpoint) : void 0;
+  const { reachable, check: healthCheck } = await checkHealth(origin, ctx.flags.timeoutMs);
+  const checksWithHealth = auth ? [...checksWithAuth, healthCheck] : checksWithAuth;
+  const finalChecks = await (async () => {
+    if (!authed) {
+      return checksWithHealth;
+    }
+    try {
+      const client = await ctx.getClient();
+      const result = await client.callTool("get_account_info", {});
+      const payload = payloadFromResult(result);
+      return [...checksWithHealth, accountCheckFromPayload(payload)];
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      return [
+        ...checksWithHealth,
+        { name: "account", status: "fail", detail: `get_account_info failed: ${detail}` }
+      ];
+    }
+  })();
+  void ctx.flags.redact;
+  const markdown = ctx.flags.format === "markdown";
+  const report = markdown ? renderMarkdownReport(finalChecks) : renderTextReport(finalChecks);
+  ctx.out(report);
+  if (!authed) {
+    return 3 /* AuthError */;
+  }
+  if (!reachable) {
+    return 6 /* TransportFailure */;
+  }
+  return 0 /* Success */;
+}
+
+// src/commands/profiles.ts
+import { createInterface } from "readline";
+async function readSecret(promptLabel, ctx) {
+  if (process.stdin.isTTY) {
+    ctx.err(promptLabel);
+    return readOneLine();
+  }
+  return readAllStdin();
+}
+function readOneLine() {
+  return new Promise((resolve, reject) => {
+    const rl = createInterface({ input: process.stdin });
+    rl.once("line", (line) => {
+      rl.close();
+      resolve(line.trim());
+    });
+    rl.once("error", (error) => {
+      rl.close();
+      reject(error);
+    });
+  });
+}
+function readAllStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8").trim()));
+    process.stdin.on("error", (error) => reject(error));
+  });
+}
+async function profilesList(ctx) {
+  const config = loadConfig(ctx.env);
+  const rows = config.profiles.map((profile) => ({
+    name: profile.name,
+    marketplace: profile.label?.marketplace ?? "",
+    active: profile.name === config.activeProfile,
+    key: redactKey(profile.apiKey)
+  }));
+  if (ctx.flags.format === "json") {
+    ctx.out(JSON.stringify(rows, null, 2));
+    return 0 /* Success */;
+  }
+  if (rows.length === 0) {
+    ctx.err("no profiles; run: agentcentral auth login");
+    return 0 /* Success */;
+  }
+  for (const line of formatProfileTable(rows)) {
+    ctx.out(line);
+  }
+  return 0 /* Success */;
+}
+function formatProfileTable(rows) {
+  const header = ["", "NAME", "MARKETPLACE", "KEY"];
+  const matrix = rows.map((row) => [
+    row.active ? "*" : "",
+    row.name,
+    row.marketplace,
+    row.key
+  ]);
+  const widths = header.map(
+    (label, i) => matrix.reduce((max, cells) => Math.max(max, cells[i].length), label.length)
+  );
+  const pad = (cell, i) => cell + " ".repeat(widths[i] - cell.length);
+  const render = (cells) => cells.map((cell, i) => pad(cell, i)).join("  ").trimEnd();
+  return [render(header), ...matrix.map(render)];
+}
+async function profilesAdd(ctx, name) {
+  if (!name) {
+    throw new CliError(2 /* UsageError */, "profile name is required");
+  }
+  const key = await readSecret(`Paste API key for profile ${name}: `, ctx);
+  if (!key) {
+    throw new CliError(5 /* ValidationFailed */, "no API key provided");
+  }
+  if (!looksLikeApiKey(key)) {
+    ctx.err("API key does not start with ac_live_; continuing.");
+  }
+  const profile = { name, apiKey: key };
+  const withProfile = upsertProfile(loadConfig(ctx.env), profile);
+  saveConfig(withProfile, ctx.env);
+  const marketplace = await tryFetchMarketplace(ctx, name);
+  if (marketplace) {
+    const labeled = { ...profile, label: { marketplace } };
+    saveConfig(upsertProfile(loadConfig(ctx.env), labeled), ctx.env);
+  }
+  ctx.err(`saved profile ${name}`);
+  return 0 /* Success */;
+}
+async function tryFetchMarketplace(ctx, name) {
+  try {
+    const probeCtx = { ...ctx, flags: { ...ctx.flags, profile: name } };
+    const client = await probeCtx.getClient();
+    const result = await client.callTool("get_account_info", {});
+    return readMarketplaceFromAccountInfo(result.structuredContent);
+  } catch {
+    return void 0;
+  }
+}
+function readMarketplaceFromAccountInfo(structured) {
+  if (typeof structured !== "object" || structured === null) {
+    return void 0;
+  }
+  const marketplace = structured.marketplace;
+  if (typeof marketplace !== "object" || marketplace === null) {
+    return void 0;
+  }
+  const id = marketplace.marketplace_id;
+  return typeof id === "string" ? id : void 0;
+}
+async function profilesUse(ctx, name) {
+  if (!name) {
+    throw new CliError(2 /* UsageError */, "profile name is required");
+  }
+  const next = setActiveProfile(loadConfig(ctx.env), name);
+  saveConfig(next, ctx.env);
+  ctx.err(
+    `active profile set to ${name} (note: this is global state \u2014 for cron/concurrent use pass --profile or AGENT_CENTRAL_API_KEY instead).`
+  );
+  return 0 /* Success */;
+}
+
+// src/keychain.ts
+import { Entry } from "@napi-rs/keyring";
+var SERVICE = "agentcentral-cli";
+var DEFAULT_ACCOUNT = "default";
+var DISABLE_ENV = "AGENT_CENTRAL_DISABLE_KEYCHAIN";
+function disabled() {
+  return process.env[DISABLE_ENV] === "1";
+}
+function keychainAvailable() {
+  if (disabled()) {
+    return false;
+  }
+  try {
+    const entry = new Entry(SERVICE, DEFAULT_ACCOUNT);
+    try {
+      entry.getPassword();
+    } catch {
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function keychainGet(account) {
+  if (disabled()) {
+    return null;
+  }
+  try {
+    const entry = new Entry(SERVICE, account ?? DEFAULT_ACCOUNT);
+    const secret = entry.getPassword();
+    const trimmed = secret?.trim() ?? "";
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+function keychainSet(account, secret) {
+  if (disabled()) {
+    return false;
+  }
+  try {
+    const entry = new Entry(SERVICE, account ?? DEFAULT_ACCOUNT);
+    entry.setPassword(secret);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function keychainDelete(account) {
+  if (disabled()) {
+    return false;
+  }
+  try {
+    const entry = new Entry(SERVICE, account ?? DEFAULT_ACCOUNT);
+    return entry.deletePassword();
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/auth.ts
+var DEFAULT_PROFILE = "default";
+async function authLogin(ctx) {
+  const key = await readSecret("Paste your agentcentral API key: ", ctx);
+  if (!key) {
+    throw new CliError(5 /* ValidationFailed */, "no API key provided");
+  }
+  if (keychainAvailable() && keychainSet(void 0, key)) {
+    ctx.err("logged in (stored in OS keychain)");
+    return 0 /* Success */;
+  }
+  const withProfile = upsertProfile(loadConfig(ctx.env), {
+    name: DEFAULT_PROFILE,
+    apiKey: key
+  });
+  const active = setActiveProfile(withProfile, DEFAULT_PROFILE);
+  saveConfig(active, ctx.env);
+  ctx.err("logged in (OS keychain unavailable; stored in 0600 config file)");
+  return 0 /* Success */;
+}
+async function authStatus(ctx) {
+  let auth;
+  try {
+    auth = await ctx.resolveAuth();
+  } catch (error) {
+    if (error instanceof CliError && error.code === 3 /* AuthError */) {
+      ctx.err(error.message);
+      return 3 /* AuthError */;
+    }
+    throw error;
+  }
+  const payload = {
+    source: auth.source,
+    key: redactKey(auth.apiKey),
+    endpoint: auth.endpoint,
+    profile: auth.profileName ?? null
+  };
+  ctx.out(JSON.stringify(payload, null, 2));
+  return 0 /* Success */;
+}
+async function authLogout(ctx) {
+  if (keychainAvailable()) {
+    keychainDelete();
+  }
+  const next = removeProfile(loadConfig(ctx.env), DEFAULT_PROFILE);
+  saveConfig(next, ctx.env);
+  ctx.err("logged out");
+  return 0 /* Success */;
+}
+
+// src/commands/convenience.ts
+import { writeFile as writeFile2 } from "fs/promises";
+var RELATIVE_SINCE_RE = /^(\d+)d$/;
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function toIsoDate(date) {
+  return date.toISOString().slice(0, 10);
+}
+function parseSince(since, now = /* @__PURE__ */ new Date()) {
+  if (since === void 0) {
+    return {};
+  }
+  const trimmed = since.trim();
+  const relative = RELATIVE_SINCE_RE.exec(trimmed);
+  if (relative) {
+    const days = Number(relative[1]);
+    const start = new Date(now.getTime() - days * 24 * 60 * 60 * 1e3);
+    return { start_date: toIsoDate(start), end_date: toIsoDate(now) };
+  }
+  if (ISO_DATE_RE.test(trimmed)) {
+    return { start_date: trimmed, end_date: toIsoDate(now) };
+  }
+  throw new CliError(
+    2 /* UsageError */,
+    `invalid --since: ${since} (expected a lookback like "30d" or a YYYY-MM-DD date)`
+  );
+}
+function extraFlags(ctx) {
+  const flags = ctx.flags;
+  return {
+    since: flags.since,
+    groupBy: flags.groupBy,
+    asin: flags.asin
+  };
+}
+function selectOutputValue2(result) {
+  if (result.structuredContent !== void 0) {
+    return result.structuredContent;
+  }
+  const first = result.content.find((block) => typeof block.text === "string");
+  const text = first?.text;
+  if (text === void 0) {
+    return result.content;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+async function emit(ctx, name, args) {
+  const client = await ctx.getClient();
+  const response = await client.rpc(
+    "tools/call",
+    { name, arguments: args },
+    { timeoutMs: ctx.flags.timeoutMs }
+  );
+  const classified = classifyResponse(response);
+  const result = classified.result;
+  if (!result) {
+    if (classified.detail) {
+      ctx.err(classified.detail);
+    }
+    return classified.code;
+  }
+  const value = selectOutputValue2(result);
+  const rendered = formatOutput(value, ctx.flags.format);
+  if (ctx.flags.output) {
+    await writeFile2(ctx.flags.output, rendered, "utf8");
+    ctx.err(`wrote result to ${ctx.flags.output}`);
+  } else {
+    ctx.out(rendered);
+  }
+  return classified.code;
+}
+function limitArg(ctx) {
+  return ctx.flags.limit != null ? { limit: ctx.flags.limit } : {};
+}
+async function inventoryHealth(ctx) {
+  return emit(ctx, "get_inventory_health", { ...limitArg(ctx) });
+}
+async function adsPerformance(ctx) {
+  const { since } = extraFlags(ctx);
+  const dates = parseSince(since);
+  return emit(ctx, "get_campaign_performance", { ...dates, ...limitArg(ctx) });
+}
+async function catalogQuality(ctx) {
+  const { asin } = extraFlags(ctx);
+  const asinArg = asin ? { asin } : {};
+  return emit(ctx, "get_listing_quality", { ...asinArg, ...limitArg(ctx) });
+}
+async function actionsHistory(ctx) {
+  const { since } = extraFlags(ctx);
+  const dates = parseSince(since);
+  return emit(ctx, "get_action_history", { ...dates, ...limitArg(ctx) });
+}
+
+// src/cli.ts
+var FORMATS = ["json", "ndjson", "table", "csv", "markdown"];
+var COMMAND_NAMES = [
+  "tools list",
+  "tools describe",
+  "tools schema",
+  "tools call",
+  "mcp serve",
+  "mcp config",
+  "mcp test",
+  "account info",
+  "profiles list",
+  "profiles add",
+  "profiles use",
+  "auth login",
+  "auth status",
+  "auth logout",
+  "inventory health",
+  "ads performance",
+  "catalog quality",
+  "actions history",
+  "doctor"
+];
+function normalizeArgv(argv) {
+  const head = argv.slice(0, 2);
+  const rest = argv.slice(2);
+  const leading = [];
+  for (const token of rest) {
+    if (token.startsWith("-")) break;
+    leading.push(token);
+  }
+  let matchWords = 0;
+  for (const name of COMMAND_NAMES) {
+    const words = name.split(" ");
+    if (words.length <= leading.length && words.every((w, i) => leading[i] === w)) {
+      if (words.length > matchWords) {
+        matchWords = words.length;
+      }
+    }
+  }
+  if (matchWords <= 1) {
+    return argv;
+  }
+  const joined = leading.slice(0, matchWords).join(" ");
+  const tail = rest.slice(matchWords);
+  return [...head, joined, ...tail];
+}
+function asString(value) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed === "" ? void 0 : trimmed;
+  }
+  if (typeof value === "number") {
+    return String(value);
+  }
+  return void 0;
+}
+function asPositiveInt(value, label) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const n = typeof value === "number" ? value : Number(asString(value));
+  if (!Number.isFinite(n) || n <= 0 || !Number.isInteger(n)) {
+    throw new CliError(2 /* UsageError */, `--${label} must be a positive integer`);
+  }
+  return n;
+}
+function parseGlobalFlags(options) {
+  const rawFormat = asString(options.format);
+  if (rawFormat !== void 0 && !FORMATS.includes(rawFormat)) {
+    throw new CliError(
+      2 /* UsageError */,
+      `--format must be one of: ${FORMATS.join(", ")} (got "${rawFormat}")`
+    );
+  }
+  const format = rawFormat ?? "json";
+  const timeoutMs = asPositiveInt(options.timeout, "timeout") ?? DEFAULT_TIMEOUT_MS;
+  const limit = asPositiveInt(options.limit, "limit");
+  return {
+    format,
+    output: asString(options.output),
+    profile: asString(options.profile),
+    apiKeyStdin: options.apiKeyStdin === true,
+    timeoutMs,
+    ...limit !== void 0 ? { limit } : {},
+    quiet: options.quiet === true,
+    // cac maps --no-color to { color: false }; default (color absent) means colour allowed.
+    noColor: options.color === false,
+    verbose: options.verbose === true,
+    requestId: asString(options.requestId),
+    yes: options.yes === true,
+    idempotencyKey: asString(options.idempotencyKey)
+  };
+}
+async function readKeyFromStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8").trim();
+}
+function buildContext(flags, opts = {}) {
+  const env = process.env;
+  const out = (line) => {
+    process.stdout.write(line + "\n");
+  };
+  const err = (line) => {
+    if (!flags.quiet) {
+      process.stderr.write(line + "\n");
+    }
+  };
+  const mergedFlags = opts.extra ? { ...flags, ...opts.extra } : flags;
+  let authPromise;
+  let echoed = false;
+  const resolveAuth2 = () => {
+    if (!authPromise) {
+      authPromise = (async () => {
+        const config = loadConfig(env);
+        const auth = await resolveAuth({
+          flags: mergedFlags,
+          env,
+          config,
+          readKeyFromStdin,
+          keychainGet,
+          warn: err
+        });
+        if (!echoed && !opts.silentAuthEcho) {
+          echoed = true;
+          const profile = auth.profileName ? ` profile=${auth.profileName}` : "";
+          err(
+            `using ${redactKey(auth.apiKey)} (source=${auth.source}${profile}) endpoint=${auth.endpoint}`
+          );
+        }
+        return auth;
+      })();
+    }
+    return authPromise;
+  };
+  let clientPromise;
+  const getClient = () => {
+    if (!clientPromise) {
+      clientPromise = (async () => {
+        const auth = await resolveAuth2();
+        return createClient(auth, {
+          retry: DEFAULT_RETRY,
+          defaultTimeoutMs: flags.timeoutMs,
+          requestId: flags.requestId,
+          onRetry: (info) => err(`retry ${info.attempt} in ${info.delayMs}ms: ${info.reason}`)
+        });
+      })();
+    }
+    return clientPromise;
+  };
+  return {
+    flags: mergedFlags,
+    env,
+    resolveAuth: resolveAuth2,
+    getClient,
+    out,
+    err
+  };
+}
+function withGlobalOptions(cmd) {
+  return cmd.option("-f, --format <format>", "output format: json | ndjson | table | csv | markdown", {
+    default: "json"
+  }).option("-o, --output <path>", "write the result to a file instead of stdout").option("-p, --profile <name>", "use a stored profile").option("--timeout <ms>", "per-request timeout in milliseconds", { default: DEFAULT_TIMEOUT_MS }).option("--limit <n>", "row limit (capped server-side)").option("-q, --quiet", "suppress stderr diagnostics").option("--no-color", "disable coloured output").option("--verbose", "verbose diagnostics").option("--request-id <id>", "client correlation id").option("-y, --yes", "promote a write to submit (requires --idempotency-key)").option("--idempotency-key <key>", "idempotency key for submit-mode writes").option("--api-key-stdin", "read the API key from stdin");
+}
+async function run(argv) {
+  const cli = cac("agentcentral");
+  let pending;
+  let lastQuiet = false;
+  const dispatch = (handler, options, ctxOpts = {}) => {
+    const flags = parseGlobalFlags(options);
+    lastQuiet = flags.quiet;
+    const ctx = buildContext(flags, ctxOpts);
+    pending = handler(ctx);
+  };
+  withGlobalOptions(cli.command("tools list", "list key-scoped tools")).option("--domain <domain>", "filter by server domain").action(
+    (options) => dispatch((ctx) => toolsList(ctx), options, { extra: { domain: asString(options.domain) } })
+  );
+  withGlobalOptions(cli.command("tools describe <tool>", "describe one tool")).action(
+    (tool, options) => dispatch((ctx) => toolsDescribe(ctx, tool), options)
+  );
+  withGlobalOptions(cli.command("tools schema <tool>", "print a tool's JSON Schema")).action(
+    (tool, options) => dispatch((ctx) => toolsSchema(ctx, tool), options)
+  );
+  withGlobalOptions(cli.command("tools call <tool> [input]", "invoke a tool")).option("-i, --input <spec>", "tool input as JSON, @file, a file path, or - for stdin").action(
+    (tool, input, options) => dispatch((ctx) => toolsCall(ctx, tool, asString(options.input) ?? input), options)
+  );
+  withGlobalOptions(cli.command("mcp serve", "run the transparent stdio MCP bridge")).option("--domain <domain>", "advisory domain scope (repeatable / comma-separated)").option("--read-only", "advisory: hide write tools from tools/list").action(
+    (options) => dispatch((ctx) => mcpServe(ctx), options, {
+      silentAuthEcho: true,
+      extra: { domains: options.domain, readOnly: options.readOnly === true }
+    })
+  );
+  withGlobalOptions(cli.command("mcp config [client]", "print MCP client config")).option("--client <name>", "target client: claude | cursor | openclaw | hermes").action(
+    (client, options) => dispatch((ctx) => mcpConfig(ctx, asString(options.client) ?? client), options)
+  );
+  withGlobalOptions(cli.command("mcp test", "check hosted-server reachability")).action(
+    (options) => dispatch((ctx) => mcpTest(ctx), options)
+  );
+  withGlobalOptions(cli.command("doctor", "run a health sweep")).option("--redact", "redact account identifiers in the report").action(
+    (options) => dispatch((ctx) => doctor(ctx), options, { extra: { redact: options.redact === true } })
+  );
+  withGlobalOptions(cli.command("account info", "show resolved account info")).action(
+    (options) => dispatch((ctx) => accountInfo(ctx), options)
+  );
+  withGlobalOptions(cli.command("profiles list", "list stored profiles")).action(
+    (options) => dispatch((ctx) => profilesList(ctx), options)
+  );
+  withGlobalOptions(cli.command("profiles add <name>", "add a stored profile")).action(
+    (name, options) => dispatch((ctx) => profilesAdd(ctx, name), options)
+  );
+  withGlobalOptions(cli.command("profiles use <name>", "set the active profile")).action(
+    (name, options) => dispatch((ctx) => profilesUse(ctx, name), options)
+  );
+  withGlobalOptions(cli.command("auth login", "store and activate an API key")).action(
+    (options) => dispatch((ctx) => authLogin(ctx), options)
+  );
+  withGlobalOptions(cli.command("auth status", "show resolved auth")).action(
+    (options) => dispatch((ctx) => authStatus(ctx), options)
+  );
+  withGlobalOptions(cli.command("auth logout", "remove the default profile")).action(
+    (options) => dispatch((ctx) => authLogout(ctx), options)
+  );
+  withGlobalOptions(cli.command("inventory health", "summarize inventory health")).action(
+    (options) => dispatch((ctx) => inventoryHealth(ctx), options)
+  );
+  withGlobalOptions(cli.command("ads performance", "summarize campaign performance")).option("--since <dur>", "lookback window: a relative duration like 30d or a YYYY-MM-DD date").option("--group-by <field>", "advisory grain hint (documented; not wired server-side)").action(
+    (options) => dispatch((ctx) => adsPerformance(ctx), options, {
+      extra: { since: asString(options.since), groupBy: asString(options["group-by"]) }
+    })
+  );
+  withGlobalOptions(cli.command("catalog quality", "summarize listing quality")).option("--asin <asin>", "scope to a single ASIN").action(
+    (options) => dispatch((ctx) => catalogQuality(ctx), options, { extra: { asin: asString(options.asin) } })
+  );
+  withGlobalOptions(cli.command("actions history", "list write-action history")).option("--since <dur>", "lookback window: a relative duration like 30d or a YYYY-MM-DD date").action(
+    (options) => dispatch((ctx) => actionsHistory(ctx), options, { extra: { since: asString(options.since) } })
+  );
+  cli.help();
+  cli.version(CLI_VERSION);
+  try {
+    const normalized = normalizeArgv(argv);
+    cli.parse(normalized, { run: false });
+    const wantsHelp = argv.includes("--help") || argv.includes("-h");
+    const wantsVersion = argv.includes("--version") || argv.includes("-v");
+    if (wantsHelp || wantsVersion && !cli.matchedCommand) {
+      return 0 /* Success */;
+    }
+    cli.runMatchedCommand();
+    if (pending === void 0) {
+      cli.outputHelp();
+      return 2 /* UsageError */;
+    }
+    return await pending;
+  } catch (error) {
+    if (error instanceof CliError) {
+      if (!lastQuiet) {
+        process.stderr.write(error.message + "\n");
+        if (error.detail) {
+          process.stderr.write(error.detail + "\n");
+        }
+      }
+      return error.code;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    const isUsage = error instanceof Error && error.name === "CACError";
+    if (!lastQuiet) {
+      process.stderr.write(message + "\n");
+    }
+    return isUsage ? 2 /* UsageError */ : 1 /* GeneralFailure */;
+  }
+}
+
+// src/index.ts
+run(process.argv).then((code) => process.exit(code)).catch((e) => {
+  process.stderr.write(String(e?.message ?? e) + "\n");
+  process.exit(1);
+});