@antasphere/slideless 0.13.7 → 0.13.9

package/dist/bin.js

@@ -3032,7 +3032,7 @@ var require_commander = __commonJS({
 // src/bin.ts
 import { createInterface } from "node:readline/promises";
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/config.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 var HUB_TOOL = "hub";
@@ -3099,8 +3099,13 @@ function redactKey(key) {
     return "****";
   return `${key.slice(0, 13)}\u2026${key.slice(-4)}`;
 }
-function lookupConnectKey(profile, hubProfileName) {
-  return profile?.connectKeys?.[hubProfileName]?.apiKey;
+function cachedConnectKey(profile, hubProfileName, hubEmail) {
+  const entry = profile?.connectKeys?.[hubProfileName];
+  const hub = hubEmail?.trim().toLowerCase();
+  const minted = entry?.email?.trim().toLowerCase();
+  if (!hub || !minted || hub !== minted)
+    return void 0;
+  return entry?.apiKey;
 }
 function storeConnectKey(env, tool, profileName, hubProfileName, entry, opts = {}) {
   const config2 = loadConfig(env, tool);
@@ -3131,7 +3136,7 @@ function removeConnectKey(env, tool, profileName, hubProfileName) {
   return true;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/io.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/io.js
 async function ask(io, question) {
   if (!io.prompt) {
     throw new Error("This command is interactive \u2014 no prompt available (pass the value as a flag).");
@@ -3146,7 +3151,7 @@ function printJson(io, value) {
 `);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/resolve.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/resolve.js
 var CliUsageError = class extends Error {
   exitCode;
   constructor(message, opts = {}) {
@@ -3251,7 +3256,7 @@ function resolveApiKey(opts) {
   return firstSet(opts.flag, opts.env[opts.envVar], opts.profile?.apiKey);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/auth.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/auth.js
 var CliAuthError = class extends Error {
   status;
   code;
@@ -3306,7 +3311,7 @@ var CliAuthClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/connect.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/connect.js
 var CliConnectError = class extends CliAuthError {
   stage;
   constructor(stage, status, code, message, details) {
@@ -3393,7 +3398,7 @@ var CliConnectClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/connect-on-demand.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/connect-on-demand.js
 async function probeToolInstance(toolBaseUrl, fetchImpl) {
   const f = fetchImpl ?? globalThis.fetch.bind(globalThis);
   try {
@@ -3416,8 +3421,15 @@ async function probeToolInstance(toolBaseUrl, fetchImpl) {
     return null;
   }
 }
-function activeHubProfile(env) {
-  return resolveProfile(loadConfig(env, HUB_TOOL), void 0);
+var HUB_URL_ENV = "ANTASPHERE_URL";
+function selectHubProfile(env, opts = {}) {
+  const config2 = loadConfig(env, HUB_TOOL);
+  const apiUrl = firstSet(env[HUB_URL_ENV]);
+  if (apiUrl) {
+    const { name, profile } = selectProfile({ config: config2, apiUrl, cloudUrl: opts.cloudUrl });
+    return { name, profile };
+  }
+  return resolveProfile(config2, void 0);
 }
 function defaultMissingHubLogin(tool) {
   const envVar = `${tool.replace(/-/g, "_").toUpperCase()}_API_KEY`;
@@ -3438,11 +3450,11 @@ async function connectOnDemand(opts) {
   const toolBaseUrl = normalizeUrl(opts.toolBaseUrl);
   const messages = opts.messages ?? {};
   const { profileName } = opts;
-  const hub = activeHubProfile(opts.env);
+  const hub = selectHubProfile(opts.env, { cloudUrl: opts.hubCloudUrl });
   const existing = loadConfig(opts.env, opts.tool).profiles[profileName];
   const { place, at } = placeOf(existing, toolBaseUrl, opts.cloudUrl);
   if (opts.cached !== false && place === "here" && hub.name) {
-    const cachedKey = lookupConnectKey(existing, hub.name);
+    const cachedKey = cachedConnectKey(existing, hub.name, hub.profile?.email);
     if (cachedKey)
       return { outcome: "connected", key: cachedKey, cached: true };
   }
@@ -3450,7 +3462,7 @@ async function connectOnDemand(opts) {
   if (!probe?.cloud)
     return { outcome: "not_cloud" };
   const hubKey = firstSet(hub.profile?.apiKey);
-  const hubBaseUrl = firstSet(hub.profile?.baseUrl);
+  const hubBaseUrl = firstSet(hub.profile?.baseUrl, opts.hubCloudUrl);
   if (!hubKey || !hubBaseUrl || !hub.name) {
     throw new CliUsageError(messages.missingHubLogin ?? defaultMissingHubLogin(opts.tool));
   }
@@ -3496,7 +3508,7 @@ async function connectOnDemand(opts) {
 }
 async function refreshConnectKey(opts) {
   assertToolNamespace(opts.tool);
-  const hub = activeHubProfile(opts.env);
+  const hub = selectHubProfile(opts.env, { cloudUrl: opts.hubCloudUrl });
   const existing = loadConfig(opts.env, opts.tool).profiles[opts.profileName];
   const { place } = placeOf(existing, normalizeUrl(opts.toolBaseUrl), opts.cloudUrl);
   if (hub.name && place === "here")
@@ -3504,7 +3516,7 @@ async function refreshConnectKey(opts) {
   return connectOnDemand({ ...opts, cached: false });
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/migrate.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/migrate.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 function migrateLegacyConfig(env, spec) {
@@ -3535,33 +3547,33 @@ function migrateLegacyConfig(env, spec) {
   return { migrated: true, from, to };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/config.js
 function createConfig(identity) {
   const TOOL = identity.tool;
   const LEGACY = { tool: TOOL, legacyDir: identity.legacyConfigDir };
-  function configPath2(env) {
+  function configPath3(env) {
     return configPath(env, TOOL);
   }
-  function loadConfig3(env) {
+  function loadConfig4(env) {
     try {
       migrateLegacyConfig(env, LEGACY);
     } catch {
     }
     return loadConfig(env, TOOL);
   }
-  function saveConfig3(env, config2) {
+  function saveConfig4(env, config2) {
     return saveConfig(env, TOOL, config2);
   }
-  function clearConfig2(env) {
+  function clearConfig3(env) {
     clearConfig(env, TOOL);
   }
-  function removeConnectKey2(env, profileName, hubProfileName) {
+  function removeConnectKey3(env, profileName, hubProfileName) {
     return removeConnectKey(env, TOOL, profileName, hubProfileName);
   }
-  return { configPath: configPath2, loadConfig: loadConfig3, saveConfig: saveConfig3, clearConfig: clearConfig2, removeConnectKey: removeConnectKey2 };
+  return { configPath: configPath3, loadConfig: loadConfig4, saveConfig: saveConfig4, clearConfig: clearConfig3, removeConnectKey: removeConnectKey3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-sdk@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-sdk/dist/index.js
+// ../../node_modules/.pnpm/@antasphere+chassis-sdk@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-sdk/dist/index.js
 var PlatformApiError = class extends Error {
   status;
   code;
@@ -3752,6 +3764,32 @@ var ChassisClient = class {
   ssoCliConnect(req) {
     return this.request("POST", "/sso/cli-connect", req);
   }
+  /**
+   * Public, CLOUD EDITION only (404 on oss): download the tool's own CLI
+   * package (a gzipped tarball, `instance().cli` names it) on a hub-minted
+   * exchange token, the same token and the same one-time rule as
+   * ssoCliConnect. The token rides in the body and the client's API key is
+   * NEVER sent: the route refuses a machine credential (403
+   * `endpoint_not_allowed`). Raw Response so the caller can stream it; a
+   * non-2xx answer throws PlatformApiError (401 `invalid_token`, 404
+   * `cli_not_packaged`, 404 `not_found` on an instance without the route).
+   */
+  async downloadCliPackage(req) {
+    const { authorization: _credential, ...headers } = this.baseHeaders();
+    const res = await this.fetchImpl(`${this.baseUrl}/api/v1/cli/package`, {
+      method: "POST",
+      headers: { ...headers, "content-type": "application/json" },
+      credentials: "same-origin",
+      signal: this.signal("download"),
+      // Browser-only field; cast keeps this isomorphic under a Node lib.
+      cache: "no-store",
+      body: JSON.stringify(req)
+    });
+    if (!res.ok) {
+      await this.parse(res);
+    }
+    return res;
+  }
   /**
    * CLOUD EDITION only (404 on oss); sessions only (machines 403 — the
    * path is unlisted in the scope allowlist): single logout. The server
@@ -3767,16 +3805,16 @@ var ChassisClient = class {
   members(params = {}) {
     return this.request("GET", this.pathWithQuery("/members", params));
   }
-  updateMember(id, patch) {
-    return this.request("PATCH", `/members/${encodeURIComponent(id)}`, patch);
+  updateMember(id2, patch) {
+    return this.request("PATCH", `/members/${encodeURIComponent(id2)}`, patch);
   }
   /**
    * Admin: delete a member's account (GDPR erasure). Sessions only — the
    * endpoint is unlisted in the machine scope allowlist, so API keys 403.
    * Files the member uploaded stay with the workspace.
    */
-  deleteMember(id) {
-    return this.request("DELETE", `/members/${encodeURIComponent(id)}`);
+  deleteMember(id2) {
+    return this.request("DELETE", `/members/${encodeURIComponent(id2)}`);
   }
   /**
    * Remove a member from the workspace (admin+, sessions only): the
@@ -3784,16 +3822,16 @@ var ChassisClient = class {
    * deleted; the account stays. Invited back, the person starts with none.
    * Refused `hub_managed` on a hub-origin workspace (removal is the hub's).
    */
-  removeMember(id) {
-    return this.request("POST", `/members/${encodeURIComponent(id)}/remove`);
+  removeMember(id2) {
+    return this.request("POST", `/members/${encodeURIComponent(id2)}/remove`);
   }
   /**
    * Owner: mint a one-time password reset link for a member (SMTP-free
    * recovery). Refused for a per-resource guest and for anyone who also belongs
    * to another workspace — the minted credential is global (PRDCT-1354).
    */
-  createMemberResetLink(id, opts = {}) {
-    return this.request("POST", `/members/${encodeURIComponent(id)}/reset-link`, void 0, idempotencyHeader(opts));
+  createMemberResetLink(id2, opts = {}) {
+    return this.request("POST", `/members/${encodeURIComponent(id2)}/reset-link`, void 0, idempotencyHeader(opts));
   }
   /**
    * Owner: mint a one-time email change link for a member (SMTP-free email
@@ -3801,8 +3839,8 @@ var ChassisClient = class {
    * it with the target member only. Same refusals as the reset link (guest
    * targets, cross-workspace targets), plus the cloud edition closure.
    */
-  createMemberChangeEmailLink(id, req, opts = {}) {
-    return this.request("POST", `/members/${encodeURIComponent(id)}/change-email-link`, req, idempotencyHeader(opts));
+  createMemberChangeEmailLink(id2, req, opts = {}) {
+    return this.request("POST", `/members/${encodeURIComponent(id2)}/change-email-link`, req, idempotencyHeader(opts));
   }
   // ── Projects ──────────────────────────────────────────────────────────────
   // A project is a subgroup of the workspace with its own members and three
@@ -3817,35 +3855,35 @@ var ChassisClient = class {
   createProject(req, opts = {}) {
     return this.request("POST", "/projects", req, idempotencyHeader(opts));
   }
-  project(id) {
-    return this.request("GET", `/projects/${encodeURIComponent(id)}`);
+  project(id2) {
+    return this.request("GET", `/projects/${encodeURIComponent(id2)}`);
   }
-  updateProject(id, patch) {
-    return this.request("PATCH", `/projects/${encodeURIComponent(id)}`, patch);
+  updateProject(id2, patch) {
+    return this.request("PATCH", `/projects/${encodeURIComponent(id2)}`, patch);
   }
-  archiveProject(id) {
-    return this.request("POST", `/projects/${encodeURIComponent(id)}/archive`);
+  archiveProject(id2) {
+    return this.request("POST", `/projects/${encodeURIComponent(id2)}/archive`);
   }
-  unarchiveProject(id) {
-    return this.request("POST", `/projects/${encodeURIComponent(id)}/unarchive`);
+  unarchiveProject(id2) {
+    return this.request("POST", `/projects/${encodeURIComponent(id2)}/unarchive`);
   }
-  projectMembers(id, params = {}) {
-    return this.request("GET", this.pathWithQuery(`/projects/${encodeURIComponent(id)}/members`, params));
+  projectMembers(id2, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/projects/${encodeURIComponent(id2)}/members`, params));
   }
   /**
    * Adds one of the workspace's own active members, by user id or by email,
    * or one of its teams by `teamId`: exactly one of the three. A team entry
    * gives every member of the team the role.
    */
-  addProjectMember(id, req, opts = {}) {
-    return this.request("POST", `/projects/${encodeURIComponent(id)}/members`, req, idempotencyHeader(opts));
+  addProjectMember(id2, req, opts = {}) {
+    return this.request("POST", `/projects/${encodeURIComponent(id2)}/members`, req, idempotencyHeader(opts));
   }
-  setProjectMemberRole(id, userId, role) {
-    return this.request("PATCH", `/projects/${encodeURIComponent(id)}/members/${encodeURIComponent(userId)}`, { role });
+  setProjectMemberRole(id2, userId, role) {
+    return this.request("PATCH", `/projects/${encodeURIComponent(id2)}/members/${encodeURIComponent(userId)}`, { role });
   }
   /** A manager removes anyone; any member removes themselves. */
-  removeProjectMember(id, userId) {
-    return this.request("DELETE", `/projects/${encodeURIComponent(id)}/members/${encodeURIComponent(userId)}`);
+  removeProjectMember(id2, userId) {
+    return this.request("DELETE", `/projects/${encodeURIComponent(id2)}/members/${encodeURIComponent(userId)}`);
   }
   /** Changes the role a team holds on a project (manager). */
   setProjectTeamRole(projectId, teamId, role) {
@@ -3864,30 +3902,79 @@ var ChassisClient = class {
   teams(params = {}) {
     return this.request("GET", this.pathWithQuery("/teams", params));
   }
-  team(id) {
-    return this.request("GET", `/teams/${encodeURIComponent(id)}`);
+  team(id2) {
+    return this.request("GET", `/teams/${encodeURIComponent(id2)}`);
   }
   /** Owner or admin. The slug is derived from the name when absent. */
   createTeam(req, opts = {}) {
     return this.request("POST", "/teams", req, idempotencyHeader(opts));
   }
-  updateTeam(id, patch) {
-    return this.request("PATCH", `/teams/${encodeURIComponent(id)}`, patch);
+  updateTeam(id2, patch) {
+    return this.request("PATCH", `/teams/${encodeURIComponent(id2)}`, patch);
   }
   /** The memberships stay; answers the team's final snapshot. */
-  deleteTeam(id) {
-    return this.request("DELETE", `/teams/${encodeURIComponent(id)}`);
+  deleteTeam(id2) {
+    return this.request("DELETE", `/teams/${encodeURIComponent(id2)}`);
   }
-  teamMembers(id, params = {}) {
-    return this.request("GET", this.pathWithQuery(`/teams/${encodeURIComponent(id)}/members`, params));
+  teamMembers(id2, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/teams/${encodeURIComponent(id2)}/members`, params));
   }
   /** Seats one of the workspace's own active members, by user id or by email. */
-  addTeamMember(id, req, opts = {}) {
-    return this.request("POST", `/teams/${encodeURIComponent(id)}/members`, req, idempotencyHeader(opts));
+  addTeamMember(id2, req, opts = {}) {
+    return this.request("POST", `/teams/${encodeURIComponent(id2)}/members`, req, idempotencyHeader(opts));
   }
   /** Unseats a member; the workspace membership stays. */
-  removeTeamMember(id, userId) {
-    return this.request("DELETE", `/teams/${encodeURIComponent(id)}/members/${encodeURIComponent(userId)}`);
+  removeTeamMember(id2, userId) {
+    return this.request("DELETE", `/teams/${encodeURIComponent(id2)}/members/${encodeURIComponent(userId)}`);
+  }
+  // ── Webhooks ──────────────────────────────────────────────────────────────
+  // URLs the workspace registers to be told, by a signed POST, when one of the
+  // tool's events happens. Owners and admins manage them (a guest gets 403
+  // `guest_forbidden`, a member 403 `forbidden`); every non-guest member reads
+  // the catalog. A machine credential needs the tool's webhooks scope (the
+  // catalog: its read scope). The signing secret is in two answers only, the
+  // create and the rotation, and never again.
+  /** The workspace's endpoints, newest first. */
+  webhooks(params = {}) {
+    return this.request("GET", this.pathWithQuery("/webhooks", params));
+  }
+  /** The event catalog: every event type, its subjects and the JSON Schema of its data. */
+  webhookEvents() {
+    return this.request("GET", "/webhooks/events");
+  }
+  /** Owner or admin. The answer carries the signing secret (`whsec_…`), shown once. */
+  createWebhook(req, opts = {}) {
+    return this.request("POST", "/webhooks", req, idempotencyHeader(opts));
+  }
+  webhook(id2) {
+    return this.request("GET", `/webhooks/${encodeURIComponent(id2)}`);
+  }
+  /** Only the fields named change; at least one is required. */
+  updateWebhook(id2, req) {
+    return this.request("PATCH", `/webhooks/${encodeURIComponent(id2)}`, req);
+  }
+  /** Deletes the endpoint and its delivery history; answers its final snapshot. */
+  deleteWebhook(id2) {
+    return this.request("DELETE", `/webhooks/${encodeURIComponent(id2)}`);
+  }
+  /** A new signing secret, shown once; the previous one signs until `previousSecretExpiresAt`. */
+  rotateWebhookSecret(id2) {
+    return this.request("POST", `/webhooks/${encodeURIComponent(id2)}/rotate-secret`);
+  }
+  /** Sends a signed `webhook.ping` now; the outcome is on the answered delivery. */
+  testWebhook(id2) {
+    return this.request("POST", `/webhooks/${encodeURIComponent(id2)}/test`);
+  }
+  /** An endpoint's deliveries, newest first, optionally by status. */
+  webhookDeliveries(id2, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/webhooks/${encodeURIComponent(id2)}/deliveries`, params, { status: params.status }));
+  }
+  webhookDelivery(id2, deliveryId) {
+    return this.request("GET", `/webhooks/${encodeURIComponent(id2)}/deliveries/${encodeURIComponent(deliveryId)}`);
+  }
+  /** Queues the same event again (same `eventId`, same payload) as a new delivery. */
+  redeliverWebhook(id2, deliveryId) {
+    return this.request("POST", `/webhooks/${encodeURIComponent(id2)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`);
   }
   // ── Demo passes ───────────────────────────────────────────────────────────
   // A link that signs one member in without a password, for a demonstration.
@@ -3911,8 +3998,8 @@ var ChassisClient = class {
     return this.request("POST", "/demo/passes", req);
   }
   /** Owner: revoke a pass; revoking a revoked pass answers it again. */
-  revokeDemoPass(id) {
-    return this.request("DELETE", `/demo/passes/${encodeURIComponent(id)}`);
+  revokeDemoPass(id2) {
+    return this.request("DELETE", `/demo/passes/${encodeURIComponent(id2)}`);
   }
   /**
    * Anyone holding a pass's secret: sign in as its person. Served by the
@@ -3947,8 +4034,8 @@ var ChassisClient = class {
   createApiKey(req, opts = {}) {
     return this.request("POST", "/api-keys", req, idempotencyHeader(opts));
   }
-  revokeApiKey(id) {
-    return this.request("DELETE", `/api-keys/${encodeURIComponent(id)}`);
+  revokeApiKey(id2) {
+    return this.request("DELETE", `/api-keys/${encodeURIComponent(id2)}`);
   }
   // ── Invitations ───────────────────────────────────────────────────────────
   invitations(params = {}) {
@@ -3958,8 +4045,8 @@ var ChassisClient = class {
   createInvitation(req, opts = {}) {
     return this.request("POST", "/invitations", req, idempotencyHeader(opts));
   }
-  revokeInvitation(id) {
-    return this.request("DELETE", `/invitations/${encodeURIComponent(id)}`);
+  revokeInvitation(id2) {
+    return this.request("DELETE", `/invitations/${encodeURIComponent(id2)}`);
   }
   /** Public: resolves an invitation token for the acceptance page. */
   lookupInvitation(token) {
@@ -4012,15 +4099,15 @@ var ChassisClient = class {
     });
     return this.parse(res);
   }
-  deleteFile(id) {
-    return this.request("DELETE", `/files/${encodeURIComponent(id)}`);
+  deleteFile(id2) {
+    return this.request("DELETE", `/files/${encodeURIComponent(id2)}`);
   }
-  file(id) {
-    return this.request("GET", `/files/${encodeURIComponent(id)}`);
+  file(id2) {
+    return this.request("GET", `/files/${encodeURIComponent(id2)}`);
   }
   /** URL of the streamed (Range-capable) content endpoint for a file. */
-  fileContentUrl(id) {
-    return `${this.baseUrl}/api/v1/files/${encodeURIComponent(id)}/content`;
+  fileContentUrl(id2) {
+    return `${this.baseUrl}/api/v1/files/${encodeURIComponent(id2)}/content`;
   }
   /**
    * Downloads a file's bytes with the client's own headers (credential and
@@ -4028,8 +4115,8 @@ var ChassisClient = class {
    * answer throws PlatformApiError like every other method. A browser anchor
    * on `fileContentUrl` cannot carry `X-Workspace-Id` (PRDCT-2426).
    */
-  async downloadFileContent(id) {
-    return this.rawDownload(this.fileContentUrl(id));
+  async downloadFileContent(id2) {
+    return this.rawDownload(this.fileContentUrl(id2));
   }
   /** The shared body of the streamed-download methods (the asset download's shape). */
   async rawDownload(url2) {
@@ -4074,14 +4161,30 @@ var ChassisClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/workspace.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/identity.js
+var DEFAULT_HUB_URL = "https://account.antasphere.com";
+function cliIdentity(identity) {
+  return {
+    bin: identity.cli.bin,
+    tool: identity.slug,
+    legacyConfigDir: identity.cli.legacyConfigDir,
+    displayName: identity.displayName,
+    envPrefix: identity.cli.envPrefix,
+    keyPrefix: identity.apiKeyPrefix,
+    exportScope: identity.scopes.dataExport,
+    webhooksScope: identity.scopes.webhooks,
+    cloudUrl: identity.cloud.url
+  };
+}
+
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/workspace.js
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isWorkspaceId(value) {
   return UUID_RE.test(value);
 }
 function orgIdOf(w) {
-  const id = w.centralAccountId;
-  return typeof id === "string" && id ? id : null;
+  const id2 = w.centralAccountId;
+  return typeof id2 === "string" && id2 ? id2 : null;
 }
 function workspaceLines(workspaces) {
   if (workspaces.length === 0)
@@ -4181,7 +4284,7 @@ ${workspaceLines(me.workspaces)}`;
   };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/context.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/context.js
 var CliApiRefusal = class extends CliUsageError {
   status;
   constructor(message, status) {
@@ -4220,19 +4323,19 @@ function printJson2(io, value) {
 var appliedContexts = /* @__PURE__ */ new WeakMap();
 function createContext(input) {
   const { identity, createClient } = input;
-  const { loadConfig: loadConfig3, removeConnectKey: removeConnectKey2 } = input.config;
+  const { loadConfig: loadConfig4, removeConnectKey: removeConnectKey3 } = input.config;
   const { describeSelection, explainRefusal, pickWorkspaceSelection } = input.workspace;
   const unknownHint = `run \`${identity.bin} profiles\` to list them.`;
-  function resolveProfile2(config2, requested) {
+  function resolveProfile3(config2, requested) {
     const { name, profile } = selectProfile({ config: config2, requested, cloudUrl: identity.cloudUrl, unknownHint });
     return { name, profile };
   }
-  function profileUrl2(profile) {
+  function profileUrl3(profile) {
     return profile?.baseUrl ?? identity.cloudUrl;
   }
   function resolveContext2(cmd, io) {
     const opts = cmd.optsWithGlobals();
-    const config2 = loadConfig3(io.env);
+    const config2 = loadConfig4(io.env);
     const apiUrl = opts.apiUrl ?? opts.url ?? io.env[`${identity.envPrefix}_URL`];
     const selected = selectProfile({
       config: config2,
@@ -4249,7 +4352,7 @@ function createContext(input) {
       profile,
       cloudUrl: identity.cloudUrl
     });
-    const sameProfileInstance = sameInstance(profileUrl2(profile), baseUrl);
+    const sameProfileInstance = sameInstance(profileUrl3(profile), baseUrl);
     let apiKey = resolveApiKey({
       flag: opts.apiKey ?? stdinApiKeys.get(io),
       env: io.env,
@@ -4258,10 +4361,9 @@ function createContext(input) {
     });
     let credentialSource = opts.apiKey !== void 0 || stdinApiKeys.get(io) !== void 0 ? "flag" : io.env[`${identity.envPrefix}_API_KEY`] ? "env" : apiKey ? "profile" : "none";
     if (!apiKey && sameProfileInstance) {
-      const hub = activeHubProfile(io.env);
-      if (hub.name && !cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
-        apiKey = lookupConnectKey(profile, hub.name);
-      }
+      const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      if (hub.name)
+        apiKey = cachedConnectKey(profile, hub.name, hub.profile?.email);
       if (apiKey)
         credentialSource = "hub-cache";
     }
@@ -4289,12 +4391,6 @@ function createContext(input) {
     }
     return ctx;
   }
-  function cachedForAnotherAccount(profile, slot, hubEmail) {
-    const cached2 = profile?.connectKeys?.[slot]?.email;
-    if (!cached2 || !hubEmail)
-      return false;
-    return cached2.toLowerCase() !== hubEmail.toLowerCase();
-  }
   const NO_KEY_MESSAGE = `An API key is required. Sign in (\`${identity.bin} login\`), pass --api-key, or set ${identity.envPrefix}_API_KEY.`;
   const MISSING_HUB_LOGIN_MESSAGE = `This ${identity.displayName} instance signs in through Antasphere. Run \`${identity.bin} login\` once (or \`antasphere login\`), then retry \u2014 or pass --api-key <${identity.keyPrefix}_\u2026> / set ${identity.envPrefix}_API_KEY.`;
   function connectOptions(ctx) {
@@ -4304,6 +4400,10 @@ function createContext(input) {
       toolBaseUrl: ctx.baseUrl,
       // A profile with no baseUrl of its own is at the cloud URL (cli-core 0.5.0).
       cloudUrl: identity.cloudUrl,
+      // The same for a hub profile (cli-core 0.6.0, verifier round 1, F4):
+      // one with no baseUrl is at the default hub, so ANTASPHERE_URL naming
+      // that hub finds it, and the slot it names is the one this kit reads.
+      hubCloudUrl: DEFAULT_HUB_URL,
       profileName: ctx.profileName ?? CLOUD_PROFILE,
       env: io.env,
       // Thread the injected fetch so the probe + exchange stay on the test
@@ -4330,9 +4430,10 @@ function createContext(input) {
       const outcome = await refreshConnectKey(connectOptions(ctx));
       if (outcome.outcome === "not_cloud")
         return res;
+      ctx.io.err.write("The cached key was refused; signed in again through Antasphere.\n");
+      healHubAddress(ctx, outcome);
       ctx.apiKey = outcome.key;
       ctx.credentialSource = "hub-exchange";
-      ctx.io.err.write("The cached key was refused; signed in again through Antasphere.\n");
       const headers = new Headers(init?.headers);
       headers.set("authorization", `Bearer ${outcome.key}`);
       return base(input2, { ...init, headers });
@@ -4348,9 +4449,9 @@ function createContext(input) {
     const selection = ctx.workspaceSelection;
     if (!selection || ctx.workspaceId !== void 0)
       return;
-    const id = isWorkspaceId(selection.value) ? selection.value : matchWorkspace((await ctx.client.me()).workspaces, selection.value).id;
-    ctx.client.setWorkspace(id);
-    ctx.workspaceId = id;
+    const id2 = isWorkspaceId(selection.value) ? selection.value : matchWorkspace((await ctx.client.me()).workspaces, selection.value).id;
+    ctx.client.setWorkspace(id2);
+    ctx.workspaceId = id2;
     appliedContexts.set(ctx.io, ctx);
   }
   function workspaceSource(ctx) {
@@ -4387,26 +4488,49 @@ function createContext(input) {
     const noun = selection.kind === "org" ? "organization" : "workspace";
     return ` (looked in the ${noun} "${selection.value}", selected by ${describeSelection(selection)})`;
   }
+  async function connect(ctx, overrides = {}) {
+    const outcome = await connectOnDemand({ ...connectOptions(ctx), ...overrides });
+    healHubAddress(ctx, outcome);
+    return outcome;
+  }
+  function healHubAddress(ctx, outcome) {
+    if (outcome.outcome !== "connected" || outcome.cached || !outcome.result)
+      return;
+    const answered = firstSet(outcome.result.user.email);
+    if (!answered)
+      return;
+    const hub = selectHubProfile(ctx.io.env, { cloudUrl: DEFAULT_HUB_URL });
+    const hubConfig = loadConfig(ctx.io.env, HUB_TOOL);
+    const stored = hub.name ? hubConfig.profiles[hub.name] : void 0;
+    const had = firstSet(stored?.email);
+    if (!hub.name || !stored || had?.toLowerCase() === answered.toLowerCase())
+      return;
+    hubConfig.profiles[hub.name] = { ...stored, email: answered };
+    saveConfig(ctx.io.env, HUB_TOOL, hubConfig);
+    if (had) {
+      ctx.io.err.write(`The Antasphere login's address is now ${answered}, replaced from ${had} (the hub's own answer).
+`);
+    }
+  }
   async function connectForKey(ctx) {
     const { io } = ctx;
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     if (ctx.profileName && hub.name) {
-      const profile = loadConfig3(io.env).profiles[ctx.profileName];
-      if (cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
-        const stale = profile?.connectKeys?.[hub.name];
-        if (stale) {
-          io.err.write(`The ${identity.displayName} key cached for ${stale.email ?? "another Antasphere login"} is retired: the Antasphere login is now ${hub.profile?.email ?? "another account"}.
-`);
-          const auth = new CliAuthClient({
-            baseUrl: profileUrl2(profile),
-            ...io.fetch ? { fetch: io.fetch } : {}
-          });
-          await auth.revoke(stale.apiKey).catch(() => void 0);
-          removeConnectKey2(io.env, ctx.profileName, hub.name);
-        }
+      const profile = loadConfig4(io.env).profiles[ctx.profileName];
+      const stale = profile?.connectKeys?.[hub.name];
+      if (stale && !cachedConnectKey(profile, hub.name, hub.profile?.email)) {
+        const hubEmail = firstSet(hub.profile?.email);
+        io.err.write(`The ${identity.displayName} key cached for ${firstSet(stale.email) ?? "an unknown login"} is retired: ` + (hubEmail ? `the Antasphere login is now ${hubEmail}.
+` : "the Antasphere login carries no address to match it with.\n"));
+        const auth = new CliAuthClient({
+          baseUrl: profileUrl3(profile),
+          ...io.fetch ? { fetch: io.fetch } : {}
+        });
+        await auth.revoke(stale.apiKey).catch(() => void 0);
+        removeConnectKey3(io.env, ctx.profileName, hub.name);
       }
     }
-    const outcome = await connectOnDemand(connectOptions(ctx));
+    const outcome = await connect(ctx);
     if (outcome.outcome === "not_cloud") {
       throw new CliUsageError(NO_KEY_MESSAGE);
     }
@@ -4421,14 +4545,15 @@ function createContext(input) {
     return outcome.key;
   }
   return {
-    resolveProfile: resolveProfile2,
+    resolveProfile: resolveProfile3,
     resolveContext: resolveContext2,
     requireApiKey: requireApiKey2,
     workspaceSource,
     explainWorkspaceRefusal,
     workspaceNotFoundHint,
-    profileUrl: profileUrl2,
-    connectOptions
+    profileUrl: profileUrl3,
+    connectOptions,
+    connect
   };
 }
 async function drainPages(first, fetchPage) {
@@ -4475,7 +4600,7 @@ var {
   Help
 } = import_index.default;
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/stdin.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/stdin.js
 var claims = /* @__PURE__ */ new WeakMap();
 async function readAllStdin() {
   const chunks = [];
@@ -4496,9 +4621,8 @@ async function readSecretFromStdin(io, claimant) {
   return value;
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/auth.js
-var HUB_URL_ENV = "ANTASPHERE_URL";
-var DEFAULT_HUB_URL = "https://account.antasphere.com";
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/auth.js
+var HUB_URL_ENV2 = "ANTASPHERE_URL";
 function describeCredential(source, profileName) {
   switch (source) {
     case "flag":
@@ -4530,10 +4654,10 @@ function organizationsLine(me) {
 `;
 }
 function registerAuthCommands(kit, program2, io) {
-  const { identity, createClient, clearConfig: clearConfig2, configPath: configPath2, connectOptions, loadConfig: loadConfig3, profileUrl: profileUrl2, removeConnectKey: removeConnectKey2, requireApiKey: requireApiKey2, resolveContext: resolveContext2, saveConfig: saveConfig3, workspaceSource } = kit;
+  const { identity, createClient, clearConfig: clearConfig3, configPath: configPath3, connect, loadConfig: loadConfig4, profileUrl: profileUrl3, removeConnectKey: removeConnectKey3, requireApiKey: requireApiKey2, resolveContext: resolveContext2, saveConfig: saveConfig4, workspaceSource } = kit;
   const { describeSource } = kit.workspace;
   function saveProfileKey(profileName, baseUrl, apiKey, email3) {
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     const previous = config3.profiles[profileName];
     config3.profiles[profileName] = {
       ...previous,
@@ -4542,25 +4666,25 @@ function registerAuthCommands(kit, program2, io) {
       ...email3 ? { email: email3 } : {}
     };
     config3.activeProfile = profileName;
-    return saveConfig3(io.env, config3);
+    return saveConfig4(io.env, config3);
   }
   function activate(profileName, baseUrl) {
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     config3.profiles[profileName] = { ...config3.profiles[profileName], baseUrl: normalizeUrl(baseUrl) };
     config3.activeProfile = profileName;
-    return saveConfig3(io.env, config3);
+    return saveConfig4(io.env, config3);
   }
   async function hubLogin(opts) {
     const hubConfig = loadConfig(io.env, HUB_TOOL);
     const selected = selectProfile({
       config: hubConfig,
-      apiUrl: io.env[HUB_URL_ENV],
+      apiUrl: io.env[HUB_URL_ENV2],
       cloudUrl: DEFAULT_HUB_URL
     });
     const profile = selected.name ?? CLOUD_PROFILE;
     const hubUrl = resolveBaseUrl({
       env: io.env,
-      envVar: HUB_URL_ENV,
+      envVar: HUB_URL_ENV2,
       profile: selected.profile,
       cloudUrl: DEFAULT_HUB_URL
     });
@@ -4609,8 +4733,8 @@ function registerAuthCommands(kit, program2, io) {
     const profileName = ctx.profileName ?? CLOUD_PROFILE;
     const { baseUrl } = ctx;
     const saved = ctx.config.profiles[profileName];
-    if (saved && !sameInstance(profileUrl2(saved), baseUrl)) {
-      throw new CliUsageError(`Profile "${profileName}" is the instance ${profileUrl2(saved)}, and this login targets ${baseUrl}. Drop --profile to sign in on the profile of ${baseUrl}, or drop --api-url to sign in on "${profileName}".`);
+    if (saved && !sameInstance(profileUrl3(saved), baseUrl)) {
+      throw new CliUsageError(`Profile "${profileName}" is the instance ${profileUrl3(saved)}, and this login targets ${baseUrl}. Drop --profile to sign in on the profile of ${baseUrl}, or drop --api-url to sign in on "${profileName}".`);
     }
     const pasted = globals.apiKey ?? stdinApiKey(io);
     if (pasted !== void 0) {
@@ -4637,35 +4761,37 @@ ${organizationsLine(me2)}`);
     }
     const probe = await probeToolInstance(baseUrl, io.fetch);
     if (probe?.cloud) {
-      let hub = activeHubProfile(io.env);
-      const stored = hub.profile?.apiKey ? hub.profile.email : void 0;
-      const switching = Boolean(stored) && opts.email !== void 0 && opts.email.toLowerCase() !== stored.toLowerCase();
+      let hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      const hasKey = Boolean(hub.profile?.apiKey);
+      const stored = hasKey ? firstSet(hub.profile?.email) : void 0;
+      const switching = hasKey && opts.email !== void 0 && (stored === void 0 || opts.email.toLowerCase() !== stored.toLowerCase());
       if (switching) {
-        io.err.write(`Replacing the Antasphere login ${stored} with ${opts.email}.
+        io.err.write(stored ? `Replacing the Antasphere login ${stored} with ${opts.email}.
+` : `Signing in as ${opts.email}: the stored Antasphere login carries no address.
 `);
       }
       if (!hub.profile?.apiKey || switching)
         await hubLogin(opts);
-      hub = activeHubProfile(io.env);
-      const stale = hub.name ? loadConfig3(io.env).profiles[profileName]?.connectKeys?.[hub.name] : void 0;
+      hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      const stale = hub.name ? loadConfig4(io.env).profiles[profileName]?.connectKeys?.[hub.name] : void 0;
       if (stale && hub.name) {
         const auth = new CliAuthClient({
-          baseUrl: profileUrl2(loadConfig3(io.env).profiles[profileName]),
+          baseUrl: profileUrl3(loadConfig4(io.env).profiles[profileName]),
           ...io.fetch ? { fetch: io.fetch } : {}
         });
         await auth.revoke(stale.apiKey).catch(() => void 0);
-        removeConnectKey2(io.env, profileName, hub.name);
+        removeConnectKey3(io.env, profileName, hub.name);
       }
       let outcome;
       try {
-        outcome = await connectOnDemand({ ...connectOptions(ctx), profileName, cached: false });
+        outcome = await connect(ctx, { profileName, cached: false });
       } catch (e) {
         if (!(e instanceof CliUsageError) || !/rejected/.test(e.message))
           throw e;
         io.err.write("The stored Antasphere login was rejected: signing in again.\n");
         await hubLogin(opts);
-        hub = activeHubProfile(io.env);
-        outcome = await connectOnDemand({ ...connectOptions(ctx), profileName, cached: false });
+        hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+        outcome = await connect(ctx, { profileName, cached: false });
       }
       if (outcome.outcome === "not_cloud") {
         throw new CliUsageError(`${baseUrl} stopped answering as an Antasphere-cloud instance; try again.`);
@@ -4709,11 +4835,11 @@ API key "${minted.keyName}" (${redactKey(minted.key)}) saved to profile "${profi
 ${organizationsLine(me)}`);
   });
   async function hubLogout() {
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     if (!hub.name || !hub.profile?.apiKey)
       return null;
     const auth = new CliAuthClient({
-      baseUrl: profileUrl2(hub.profile),
+      baseUrl: hub.profile.baseUrl?.trim() || DEFAULT_HUB_URL,
       ...io.fetch ? { fetch: io.fetch } : {}
     });
     let revoked = false;
@@ -4737,7 +4863,7 @@ ${organizationsLine(me)}`);
     const ctx = resolveContext2(cmd, io);
     const profileName = ctx.profileName;
     const profile = profileName ? ctx.config.profiles[profileName] : void 0;
-    const hubLogin2 = activeHubProfile(io.env).profile;
+    const hubLogin2 = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL }).profile;
     if (!profileName || !profile) {
       if (hubLogin2?.apiKey) {
         if (opts.all) {
@@ -4752,7 +4878,7 @@ ${organizationsLine(me)}`);
       }
       throw new CliUsageError("No profile to log out of.");
     }
-    const baseUrl = profileUrl2(profile);
+    const baseUrl = profileUrl3(profile);
     const auth = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
     let revoked = 0;
     let refused = 0;
@@ -4776,16 +4902,16 @@ ${organizationsLine(me)}`);
     const slots = Object.entries(profile.connectKeys ?? {});
     for (const [slot, entry] of slots) {
       await revoke(entry.apiKey, `the key of the Antasphere login "${slot}"`);
-      removeConnectKey2(io.env, profileName, slot);
+      removeConnectKey3(io.env, profileName, slot);
     }
     if (profile.apiKey)
       await revoke(profile.apiKey, "the profile key");
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     const current = config3.profiles[profileName];
     if (current) {
       delete current.apiKey;
       delete current.email;
-      saveConfig3(io.env, config3);
+      saveConfig4(io.env, config3);
     }
     const ended = opts.all ? await hubLogout() : null;
     if (globals.json) {
@@ -4813,7 +4939,7 @@ ${organizationsLine(me)}`);
     await requireApiKey2(ctx);
     const me = await ctx.client.me();
     const source = workspaceSource(ctx);
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     const hubLine = hubLoginLine(ctx, hub.profile);
     if (ctx.json) {
       return printJson2(io, {
@@ -4861,7 +4987,7 @@ ${organizationsLine(me)}`);
   });
   program2.command("use <profile>").description("Switch the active profile (the instance the commands run against)").action(async (name, _opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     if (!config3.profiles[name]) {
       if (name !== CLOUD_PROFILE) {
         throw new CliUsageError(`Unknown profile "${name}" \u2014 run \`${identity.bin} profiles\`.`);
@@ -4869,16 +4995,16 @@ ${organizationsLine(me)}`);
       config3.profiles[name] = { baseUrl: normalizeUrl(identity.cloudUrl) };
     }
     config3.activeProfile = name;
-    saveConfig3(io.env, config3);
+    saveConfig4(io.env, config3);
     if (globals.json)
       return printJson2(io, { activeProfile: name });
-    io.out.write(`Active profile: ${name} (${profileUrl2(config3.profiles[name])})
+    io.out.write(`Active profile: ${name} (${profileUrl3(config3.profiles[name])})
 `);
   });
   program2.command("profiles").description("List the profiles (one per instance) and how each signs in").action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    const config3 = loadConfig3(io.env);
-    const hub = activeHubProfile(io.env);
+    const config3 = loadConfig4(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     const rows = Object.entries(config3.profiles);
     if (!config3.profiles[CLOUD_PROFILE])
       rows.unshift([CLOUD_PROFILE, { baseUrl: normalizeUrl(identity.cloudUrl) }]);
@@ -4890,8 +5016,9 @@ ${organizationsLine(me)}`);
       if (entry)
         return { kind: "hub", text: `via Antasphere${entry.email ? ` (${entry.email})` : ""}` };
       const others = Object.keys(p.connectKeys ?? {});
+      const chosen = firstSet(io.env[HUB_URL_ENV2]) ? "not the one ANTASPHERE_URL names" : "not the active one";
       if (others.length > 0)
-        return { kind: "hub", text: `via Antasphere (login "${others.join('", "')}", not the active one)` };
+        return { kind: "hub", text: `via Antasphere (login "${others.join('", "')}", ${chosen})` };
       return { kind: "none", text: "(not signed in)" };
     };
     if (globals.json) {
@@ -4903,7 +5030,7 @@ ${organizationsLine(me)}`);
           return [
             n,
             {
-              baseUrl: profileUrl2(p),
+              baseUrl: profileUrl3(p),
               saved: Boolean(config3.profiles[n]),
               credential: cred.kind,
               apiKey: p.apiKey ? redactKey(p.apiKey) : null,
@@ -4914,20 +5041,20 @@ ${organizationsLine(me)}`);
         }))
       });
     }
-    io.out.write(table(rows.map(([n, p]) => [activeName === n ? "*" : " ", n, profileUrl2(p), credentialOf(p).text])));
+    io.out.write(table(rows.map(([n, p]) => [activeName === n ? "*" : " ", n, profileUrl3(p), credentialOf(p).text])));
   });
   const config2 = program2.command("config").description("Inspect or reset the CLI config file");
   config2.command("show").description("Show the config path, active profile, and redacted keys").action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    const cfg = loadConfig3(io.env);
-    const path = configPath2(io.env);
+    const cfg = loadConfig4(io.env);
+    const path = configPath3(io.env);
     const redacted = {
       path,
       activeProfile: cfg.activeProfile ?? null,
       profiles: Object.fromEntries(Object.entries(cfg.profiles).map(([n, p]) => [
         n,
         {
-          baseUrl: profileUrl2(p),
+          baseUrl: profileUrl3(p),
           apiKey: p.apiKey ? redactKey(p.apiKey) : null,
           email: p.email ?? null,
           // Hub-connected keys (one per hub profile), redacted like the rest.
@@ -4944,14 +5071,14 @@ ${organizationsLine(me)}`);
   });
   config2.command("clear").description("Delete the config file (all profiles and stored keys)").action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    clearConfig2(io.env);
+    clearConfig3(io.env);
     if (globals.json)
       return printJson2(io, { cleared: true });
     io.out.write("Config cleared.\n");
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/workspaces.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/workspaces.js
 function registerWorkspaceCommands(kit, program2, io) {
   const { requireApiKey: requireApiKey2, resolveContext: resolveContext2, workspaceSource } = kit;
   const { describeSelection } = kit.workspace;
@@ -5023,7 +5150,7 @@ function registerWorkspaceCommands(kit, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/teams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/teams.js
 function explainTeamRefusal(e, ctx) {
   switch (e.code) {
     case "forbidden":
@@ -5227,7 +5354,7 @@ ${teamLines(team)}`);
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/projects.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/projects.js
 var ROLES = ["viewer", "editor", "manager"];
 function parseRole(value) {
   if (ROLES.includes(value))
@@ -5350,10 +5477,10 @@ function registerProjectCommands(kit, program2, io) {
 `);
     }
   });
-  projects.command("get <id>").description("Show one project, with your own role on it").action(async (id, _opts, cmd) => {
+  projects.command("get <id>").description("Show one project, with your own role on it").action(async (id2, _opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
     await requireApiKey2(ctx);
-    const project = await explained("project", () => ctx.client.project(id));
+    const project = await explained("project", () => ctx.client.project(id2));
     if (ctx.json)
       return printJson2(io, project);
     io.out.write(projectLines(project));
@@ -5372,7 +5499,7 @@ function registerProjectCommands(kit, program2, io) {
     io.out.write(`Created project "${project.name}".
 ${projectLines(project)}`);
   });
-  projects.command("update <id>").description("Change a project's name, description or metadata (manager)").option("--name <name>", "rename the project").option("--description <text>", "replace the description").option("--clear-description", "remove the description", false).option("--metadata <json>", "replace the whole metadata object (a JSON object)").action(async (id, opts, cmd) => {
+  projects.command("update <id>").description("Change a project's name, description or metadata (manager)").option("--name <name>", "rename the project").option("--description <text>", "replace the description").option("--clear-description", "remove the description", false).option("--metadata <json>", "replace the whole metadata object (a JSON object)").action(async (id2, opts, cmd) => {
     if (opts.description !== void 0 && opts.clearDescription) {
       throw new CliUsageError("Pass either --description <text> or --clear-description, not both.");
     }
@@ -5386,25 +5513,25 @@ ${projectLines(project)}`);
     }
     const ctx = resolveContext2(cmd, io);
     await requireApiKey2(ctx);
-    const project = await explained("project", () => ctx.client.updateProject(id, patch));
+    const project = await explained("project", () => ctx.client.updateProject(id2, patch));
     if (ctx.json)
       return printJson2(io, project);
     io.out.write(`Updated project "${project.name}".
 ${projectLines(project)}`);
   });
-  projects.command("archive <id>").description("Archive a project: out of the default list and read-only (manager). Never deleted").action(async (id, _opts, cmd) => {
+  projects.command("archive <id>").description("Archive a project: out of the default list and read-only (manager). Never deleted").action(async (id2, _opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
     await requireApiKey2(ctx);
-    const project = await explained("project", () => ctx.client.archiveProject(id));
+    const project = await explained("project", () => ctx.client.archiveProject(id2));
     if (ctx.json)
       return printJson2(io, project);
     io.out.write(`Archived "${project.name}". It is read-only and out of \`projects list\` until you unarchive it.
 `);
   });
-  projects.command("unarchive <id>").description("Bring an archived project back (manager)").action(async (id, _opts, cmd) => {
+  projects.command("unarchive <id>").description("Bring an archived project back (manager)").action(async (id2, _opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
     await requireApiKey2(ctx);
-    const project = await explained("project", () => ctx.client.unarchiveProject(id));
+    const project = await explained("project", () => ctx.client.unarchiveProject(id2));
     if (ctx.json)
       return printJson2(io, project);
     io.out.write(`Unarchived "${project.name}". It is writable again.
@@ -5502,6 +5629,308 @@ ${projectLines(project)}`);
   });
 }
 
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/webhooks.js
+function explainWebhookRefusal(e, lookup, identity) {
+  switch (e.code) {
+    case "forbidden":
+      return e.status === 403 ? "Only an owner or an admin manages webhooks." : null;
+    case "guest_forbidden":
+      return "You are a guest of this workspace, and guests do not manage its webhooks.";
+    case "not_found":
+      if (lookup === "catalog")
+        return null;
+      return lookup === "delivery" ? "No such delivery." : "No such webhook in this workspace.";
+    case "url_refused":
+    case "demo_session":
+      return e.message;
+    case "unknown_event":
+      return `${e.message}. The exact types are in \`webhooks events\`; a family is its first word plus \`.*\`.`;
+    case "unknown_subject":
+      return `${e.message}. The subject keys are in \`webhooks events\`.`;
+    case "plan_required": {
+      const url2 = e.details?.upgradeUrl;
+      return typeof url2 === "string" && url2 ? `${e.message} \u2014 upgrade the plan at ${url2}` : e.message;
+    }
+    case "insufficient_scope":
+    case "endpoint_not_allowed":
+      if (lookup === "catalog")
+        return null;
+      return identity.webhooksScope ? `This key cannot manage webhooks: create one with the ${identity.webhooksScope} scope on the API keys page.` : `${identity.displayName} opens webhooks to no API key: manage them signed in, in the dashboard.`;
+    default:
+      return null;
+  }
+}
+async function explained2(identity, lookup, run2) {
+  try {
+    return await run2();
+  } catch (e) {
+    if (e instanceof PlatformApiError) {
+      const line = explainWebhookRefusal(e, lookup, identity);
+      if (line)
+        throw new CliApiRefusal(line, e.status);
+    }
+    throw e;
+  }
+}
+async function allWebhooks(client) {
+  const first = await client.webhooks();
+  return drainPages({ rows: first.webhooks, nextCursor: first.nextCursor }, async (cursor) => {
+    const page = await client.webhooks({ cursor });
+    return { rows: page.webhooks, nextCursor: page.nextCursor };
+  });
+}
+var collect = (value, previous) => [...previous, value];
+function parseWebhookFilters(values) {
+  const filters = {};
+  for (const value of values) {
+    const at = value.indexOf("=");
+    const subject = at > 0 ? value.slice(0, at).trim() : "";
+    const id2 = at > 0 ? value.slice(at + 1).trim() : "";
+    if (!subject || !id2) {
+      throw new CliUsageError(`--filter takes <subject>=<id> (e.g. thing=<id>), not "${value}".`);
+    }
+    const ids = filters[subject] ??= [];
+    if (!ids.includes(id2))
+      ids.push(id2);
+  }
+  return filters;
+}
+var DELIVERY_STATUSES = ["pending", "delivered", "failed", "held"];
+function parseLimit(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1 || n > 100) {
+    throw new CliUsageError(`--limit takes a whole number from 1 to 100, not "${value}".`);
+  }
+  return n;
+}
+function fmtWhen(iso) {
+  return `${iso.slice(0, 10)} ${iso.slice(11, 16)}`;
+}
+function fmtFilters(filters) {
+  const keys = Object.keys(filters);
+  return keys.length === 0 ? "none" : keys.map((k) => `${k}=${(filters[k] ?? []).join("|")}`).join(" ");
+}
+function lastDelivery(w) {
+  return w.lastDeliveryStatus && w.lastDeliveryAt ? `${w.lastDeliveryStatus} ${fmtWhen(w.lastDeliveryAt)}` : "-";
+}
+function endpointLines(w) {
+  return `${w.url}
+  id:           ${w.id}
+` + (w.description ? `  description:  ${w.description}
+` : "") + `  events:       ${w.events.join(", ")}
+  filters:      ${fmtFilters(w.filters)}
+  enabled:      ${w.enabled ? "yes" : "no"}
+` + (w.disabledAt ? `  disabled:     ${w.disabledAt}${w.disabledReason ? ` (${w.disabledReason})` : ""}
+` : "") + `  failures:     ${w.consecutiveFailures} in a row
+  last:         ${lastDelivery(w)}
+` + (w.previousSecretExpiresAt ? `  old secret:   signs until ${w.previousSecretExpiresAt}
+` : "") + `  created:      ${w.createdAt}
+`;
+}
+function deliveryLines(d) {
+  return `Delivery ${d.id}
+  event:     ${d.eventType} (${d.eventId})
+  status:    ${d.status}
+  attempt:   ${d.attempt}
+  HTTP code: ${d.lastStatusCode ?? "-"}
+` + (d.lastError ? `  error:     ${d.lastError}
+` : "") + (d.nextAttemptAt ? `  next try:  ${d.nextAttemptAt}
+` : "") + (d.deliveredAt ? `  delivered: ${d.deliveredAt}
+` : "") + `  created:   ${d.createdAt}
+`;
+}
+function catalogLines(catalog) {
+  if (catalog.events.length === 0)
+    return "No event types.\n";
+  let out = table([
+    ["TYPE", "SUBJECTS", "DESCRIPTION"],
+    ...catalog.events.map((e) => [e.type, e.subjects.join(",") || "-", e.description])
+  ]);
+  if (catalog.subjects.length > 0) {
+    out += "\nSubjects (what --filter <subject>=<id> matches on):\n" + table(catalog.subjects.map((s) => [`  ${s.key}`, `subjects.${s.field}`, s.description]));
+  }
+  return out;
+}
+function registerWebhookCommands(kit, program2, io) {
+  const { requireApiKey: requireApiKey2, resolveContext: resolveContext2, identity } = kit;
+  const scopeLine = identity.webhooksScope ? `A key needs the ${identity.webhooksScope} scope.` : `${identity.displayName} opens webhooks to no API key.`;
+  const webhooks = program2.command("webhooks").description("The workspace's webhooks (signed POSTs to your URLs when an event happens)").addHelpText("after", `
+An owner or an admin manages the webhooks; every member reads the event catalog
+(\`webhooks events\`). ${scopeLine}
+The signing secret is printed once, at \`create\` and at \`rotate-secret\`: store it then.
+`);
+  webhooks.command("list").description("List the workspace's webhook endpoints (every page)").action(async (_opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const rows = await explained2(identity, "webhook", () => allWebhooks(ctx.client));
+    if (ctx.json)
+      return printJson2(io, { webhooks: rows, nextCursor: null });
+    if (rows.length === 0) {
+      io.out.write("No webhooks.\n");
+      return;
+    }
+    io.out.write(table([
+      ["ID", "URL", "EVENTS", "ENABLED", "LAST DELIVERY", "FAILURES"],
+      ...rows.map((w) => [
+        w.id,
+        w.url,
+        w.events.join(","),
+        w.enabled ? "yes" : "no",
+        lastDelivery(w),
+        String(w.consecutiveFailures)
+      ])
+    ]));
+  });
+  webhooks.command("events").description("The event catalog: every event type, the subjects it carries, what it means").action(async (_opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const catalog = await explained2(identity, "catalog", () => ctx.client.webhookEvents());
+    if (ctx.json)
+      return printJson2(io, catalog);
+    io.out.write(catalogLines(catalog));
+  });
+  webhooks.command("create <url>").description("Register an endpoint (owner or admin); its signing secret is printed once").option("--event <type>", "an event type (thing.created), a family (thing.*) or everything (*); repeatable, at least one", collect, []).option("--description <text>", "what the endpoint is for").option("--filter <subject>=<id>", "only events about this subject id; repeatable (same subject: OR, different subjects: AND)", collect, []).option("--disabled", "register it switched off", false).action(async (url2, opts, cmd) => {
+    if (opts.event.length === 0) {
+      throw new CliUsageError("Name at least one event: --event <type> (e.g. --event thing.created), repeatable.");
+    }
+    const filters = parseWebhookFilters(opts.filter);
+    const req = {
+      url: url2,
+      events: opts.event,
+      ...opts.description !== void 0 ? { description: opts.description } : {},
+      ...Object.keys(filters).length > 0 ? { filters } : {},
+      ...opts.disabled ? { enabled: false } : {}
+    };
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const created = await explained2(identity, "webhook", () => ctx.client.createWebhook(req));
+    if (ctx.json)
+      return printJson2(io, created);
+    io.out.write(`Created webhook ${created.id}.
+Its signing secret is shown this once, never again: store it now.
+${created.secret}
+`);
+  });
+  webhooks.command("get <id>").description("Show one endpoint").action(async (id2, _opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const endpoint = await explained2(identity, "webhook", () => ctx.client.webhook(id2));
+    if (ctx.json)
+      return printJson2(io, endpoint);
+    io.out.write(endpointLines(endpoint));
+  });
+  webhooks.command("update <id>").description("Change an endpoint (owner or admin); only what is passed changes").option("--endpoint-url <url>", "the new address the deliveries go to").option("--description <text>", "the new description").option("--event <type>", "replace the events with these; repeatable", collect, []).option("--filter <subject>=<id>", "replace the filters with these; repeatable", collect, []).option("--clear-filters", "remove every filter", false).option("--enable", "switch the endpoint on", false).option("--disable", "switch the endpoint off", false).action(async (id2, opts, cmd) => {
+    if (opts.enable && opts.disable) {
+      throw new CliUsageError("Pass --enable or --disable, not both.");
+    }
+    if (opts.clearFilters && opts.filter.length > 0) {
+      throw new CliUsageError("Pass --filter or --clear-filters, not both.");
+    }
+    const req = {
+      ...opts.endpointUrl !== void 0 ? { url: opts.endpointUrl } : {},
+      ...opts.description !== void 0 ? { description: opts.description } : {},
+      ...opts.event.length > 0 ? { events: opts.event } : {},
+      ...opts.filter.length > 0 ? { filters: parseWebhookFilters(opts.filter) } : {},
+      ...opts.clearFilters ? { filters: {} } : {},
+      ...opts.enable ? { enabled: true } : {},
+      ...opts.disable ? { enabled: false } : {}
+    };
+    if (Object.keys(req).length === 0) {
+      throw new CliUsageError("Nothing to change \u2014 pass --endpoint-url, --description, --event, --filter, --clear-filters, --enable or --disable.");
+    }
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const updated = await explained2(identity, "webhook", () => ctx.client.updateWebhook(id2, req));
+    if (ctx.json)
+      return printJson2(io, updated);
+    io.out.write(`Updated webhook ${updated.id}.
+${endpointLines(updated)}`);
+  });
+  webhooks.command("delete <id>").description("Delete an endpoint and its delivery history (owner or admin)").action(async (id2, _opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const deleted = await explained2(identity, "webhook", () => ctx.client.deleteWebhook(id2));
+    if (ctx.json)
+      return printJson2(io, deleted);
+    io.out.write(`Deleted webhook ${deleted.id} (${deleted.url}) and its delivery history.
+`);
+  });
+  webhooks.command("rotate-secret <id>").description("Replace an endpoint's signing secret (owner or admin); the new one is printed once").action(async (id2, _opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const rotated = await explained2(identity, "webhook", () => ctx.client.rotateWebhookSecret(id2));
+    if (ctx.json)
+      return printJson2(io, rotated);
+    io.out.write(`New signing secret for webhook ${rotated.id}, shown this once, never again: store it now.
+${rotated.secret}
+The previous secret keeps signing until ${rotated.previousSecretExpiresAt}.
+`);
+  });
+  webhooks.command("test <id>").description("Send a signed webhook.ping now and print its outcome (exit 1 when not delivered)").action(async (id2, _opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const { delivery } = await explained2(identity, "webhook", () => ctx.client.testWebhook(id2));
+    if (ctx.json)
+      printJson2(io, { delivery });
+    else
+      io.out.write(`Ping ${delivery.status}` + (delivery.lastStatusCode !== null ? `, HTTP ${delivery.lastStatusCode}` : "") + (delivery.lastError ? `: ${delivery.lastError}` : "") + ` (delivery ${delivery.id}).
+`);
+    if (delivery.status !== "delivered") {
+      throw new CliUsageError(`The ping was not delivered (${delivery.status}).`);
+    }
+  });
+  webhooks.command("deliveries <id>").description("List one page of an endpoint's deliveries, newest first").option("--status <status>", `only these: ${DELIVERY_STATUSES.join(", ")}`).option("--limit <n>", "page size, 1 to 100 (server default 50)").option("--cursor <cursor>", "the next page, as the previous one printed it").action(async (id2, opts, cmd) => {
+    if (opts.status !== void 0 && !DELIVERY_STATUSES.includes(opts.status)) {
+      throw new CliUsageError(`--status takes one of ${DELIVERY_STATUSES.join(", ")}, not "${opts.status}".`);
+    }
+    const params = {
+      ...opts.status !== void 0 ? { status: opts.status } : {},
+      ...opts.limit !== void 0 ? { limit: parseLimit(opts.limit) } : {},
+      ...opts.cursor !== void 0 ? { cursor: opts.cursor } : {}
+    };
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const page = await explained2(identity, "webhook", () => ctx.client.webhookDeliveries(id2, params));
+    if (ctx.json)
+      return printJson2(io, page);
+    if (page.deliveries.length === 0) {
+      io.out.write("No deliveries.\n");
+      return;
+    }
+    io.out.write(table([
+      ["ID", "EVENT", "STATUS", "ATTEMPT", "CODE", "CREATED"],
+      ...page.deliveries.map((d) => [
+        d.id,
+        d.eventType,
+        d.status,
+        String(d.attempt),
+        d.lastStatusCode !== null ? String(d.lastStatusCode) : "-",
+        fmtWhen(d.createdAt)
+      ])
+    ]));
+    if (page.nextCursor)
+      io.out.write(`More: --cursor ${page.nextCursor}
+`);
+  });
+  webhooks.command("delivery <id> <deliveryId>").description("Show one delivery: its status, its latest attempt (--json: the payload as sent)").action(async (id2, deliveryId, _opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const delivery = await explained2(identity, "delivery", () => ctx.client.webhookDelivery(id2, deliveryId));
+    if (ctx.json)
+      return printJson2(io, delivery);
+    io.out.write(deliveryLines(delivery));
+  });
+  webhooks.command("redeliver <id> <deliveryId>").description("Queue the same event again as a new delivery (same event id, same payload)").action(async (id2, deliveryId, _opts, cmd) => {
+    const ctx = resolveContext2(cmd, io);
+    await requireApiKey2(ctx);
+    const delivery = await explained2(identity, "delivery", () => ctx.client.redeliverWebhook(id2, deliveryId));
+    if (ctx.json)
+      return printJson2(io, delivery);
+    io.out.write(`Queued delivery ${delivery.id} of ${delivery.eventType} (event ${delivery.eventId}).
+`);
+  });
+}
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -8594,42 +9023,42 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     }
     doc.write(`const newResult = {};`);
     for (const key of normalized.keys) {
-      const id = ids[key];
+      const id2 = ids[key];
       const k = esc(key);
       const schema = shape[key];
       const isOptionalIn = schema?._zod?.optin === "optional";
       const isOptionalOut = schema?._zod?.optout === "optional";
-      doc.write(`const ${id} = ${parseStr(key)};`);
+      doc.write(`const ${id2} = ${parseStr(key)};`);
       if (isOptionalIn && isOptionalOut) {
         doc.write(`
-        if (${id}.issues.length) {
+        if (${id2}.issues.length) {
           if (${k} in input) {
-            payload.issues = payload.issues.concat(${id}.issues.map(iss => ({
+            payload.issues = payload.issues.concat(${id2}.issues.map(iss => ({
               ...iss,
               path: iss.path ? [${k}, ...iss.path] : [${k}]
             })));
           }
         }
         
-        if (${id}.value === undefined) {
+        if (${id2}.value === undefined) {
           if (${k} in input) {
             newResult[${k}] = undefined;
           }
         } else {
-          newResult[${k}] = ${id}.value;
+          newResult[${k}] = ${id2}.value;
         }
         
       `);
       } else if (!isOptionalIn) {
         doc.write(`
-        const ${id}_present = ${k} in input;
-        if (${id}.issues.length) {
-          payload.issues = payload.issues.concat(${id}.issues.map(iss => ({
+        const ${id2}_present = ${k} in input;
+        if (${id2}.issues.length) {
+          payload.issues = payload.issues.concat(${id2}.issues.map(iss => ({
             ...iss,
             path: iss.path ? [${k}, ...iss.path] : [${k}]
           })));
         }
-        if (!${id}_present && !${id}.issues.length) {
+        if (!${id2}_present && !${id2}.issues.length) {
           payload.issues.push({
             code: "invalid_type",
             expected: "nonoptional",
@@ -8638,30 +9067,30 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
           });
         }
 
-        if (${id}_present) {
-          if (${id}.value === undefined) {
+        if (${id2}_present) {
+          if (${id2}.value === undefined) {
             newResult[${k}] = undefined;
           } else {
-            newResult[${k}] = ${id}.value;
+            newResult[${k}] = ${id2}.value;
           }
         }
 
       `);
       } else {
         doc.write(`
-        if (${id}.issues.length) {
-          payload.issues = payload.issues.concat(${id}.issues.map(iss => ({
+        if (${id2}.issues.length) {
+          payload.issues = payload.issues.concat(${id2}.issues.map(iss => ({
             ...iss,
             path: iss.path ? [${k}, ...iss.path] : [${k}]
           })));
         }
         
-        if (${id}.value === undefined) {
+        if (${id2}.value === undefined) {
           if (${k} in input) {
             newResult[${k}] = undefined;
           }
         } else {
-          newResult[${k}] = ${id}.value;
+          newResult[${k}] = ${id2}.value;
         }
         
       `);
@@ -16993,26 +17422,26 @@ function extractDefs(ctx, schema) {
     throw new Error("Unprocessed schema. This is a bug in Zod.");
   const idToSchema = /* @__PURE__ */ new Map();
   for (const entry of ctx.seen.entries()) {
-    const id = ctx.metadataRegistry.get(entry[0])?.id;
-    if (id) {
-      const existing = idToSchema.get(id);
+    const id2 = ctx.metadataRegistry.get(entry[0])?.id;
+    if (id2) {
+      const existing = idToSchema.get(id2);
       if (existing && existing !== entry[0]) {
-        throw new Error(`Duplicate schema id "${id}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);
+        throw new Error(`Duplicate schema id "${id2}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);
       }
-      idToSchema.set(id, entry[0]);
+      idToSchema.set(id2, entry[0]);
     }
   }
   const makeURI = (entry) => {
     const defsSegment = ctx.target === "draft-2020-12" ? "$defs" : "definitions";
     if (ctx.external) {
       const externalId = ctx.external.registry.get(entry[0])?.id;
-      const uriGenerator = ctx.external.uri ?? ((id2) => id2);
+      const uriGenerator = ctx.external.uri ?? ((id3) => id3);
       if (externalId) {
         return { ref: uriGenerator(externalId) };
       }
-      const id = entry[1].defId ?? entry[1].schema.id ?? `schema${ctx.counter++}`;
-      entry[1].defId = id;
-      return { defId: id, ref: `${uriGenerator("__shared")}#/${defsSegment}/${id}` };
+      const id2 = entry[1].defId ?? entry[1].schema.id ?? `schema${ctx.counter++}`;
+      entry[1].defId = id2;
+      return { defId: id2, ref: `${uriGenerator("__shared")}#/${defsSegment}/${id2}` };
     }
     if (entry[1] === root) {
       return { ref: "#" };
@@ -17060,8 +17489,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         continue;
       }
     }
-    const id = ctx.metadataRegistry.get(entry[0])?.id;
-    if (id) {
+    const id2 = ctx.metadataRegistry.get(entry[0])?.id;
+    if (id2) {
       extractToDef(entry);
       continue;
     }
@@ -17157,10 +17586,10 @@ function finalize(ctx, schema) {
   } else {
   }
   if (ctx.external?.uri) {
-    const id = ctx.external.registry.get(schema)?.id;
-    if (!id)
+    const id2 = ctx.external.registry.get(schema)?.id;
+    if (!id2)
       throw new Error("Schema is missing an `id` property");
-    result.$id = ctx.external.uri(id);
+    result.$id = ctx.external.uri(id2);
   }
   Object.assign(result, root.def ?? root.schema);
   const rootMetaId = ctx.metadataRegistry.get(schema)?.id;
@@ -20016,7 +20445,7 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/common.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/common.js
 var apiErrorSchema = external_exports.object({
   error: external_exports.object({
     code: external_exports.string(),
@@ -20121,12 +20550,12 @@ function isValidMediaType(value) {
   return value.length >= 1 && value.length <= 255 && isLatin1(value) && MEDIA_TYPE_RE.test(value);
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/scope.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/scope.js
 function defineScopeSchema(scopes) {
   return external_exports.enum(scopes);
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/seams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/seams.js
 var KNOWN_AUTH_METHODS = [
   "password",
   "email-otp",
@@ -21710,7 +22139,7 @@ var HUB_TOOL_WIRE_INPUTS = {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/entitlements.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/entitlements.js
 var entitlementTierSchema = billingPlanSchema;
 var entitlementActionSchema = external_exports.object({
   key: external_exports.string().min(1),
@@ -21744,7 +22173,7 @@ var entitlementProfileSchema = external_exports.object({
   upgradeUrl: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/instance.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/instance.js
 var instanceInfoSchema2 = external_exports.object({
   name: external_exports.string(),
   instanceId: external_exports.string().nullable(),
@@ -21794,6 +22223,14 @@ var instanceInfoSchema2 = external_exports.object({
    * false, so the self-hosted discovery bytes are unchanged.
    */
   restricted: external_exports.boolean().optional(),
+  /**
+   * The tool's own CLI package (cloud edition, PRDCT-3312): present only when
+   * the instance was released with it (`CLI_PACKAGE_DIR`), naming the npm
+   * package `POST /cli/package` serves and its version. The `team` command
+   * reads it to know what it installs and whether to update. ABSENT
+   * otherwise, so older discovery bytes are unchanged.
+   */
+  cli: external_exports.object({ name: external_exports.string(), version: external_exports.string() }).optional(),
   /**
    * What this version of the tool declares for the billing rail (its priced
    * actions with their default credits, its limits and features per tier):
@@ -21805,7 +22242,7 @@ var instanceInfoSchema2 = external_exports.object({
   entitlements: toolEntitlementsSchema.optional()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/setup.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/setup.js
 var setupRequestSchema2 = external_exports.object({
   instanceName: plainText(1, 120),
   owner: external_exports.object({
@@ -21822,7 +22259,7 @@ var setupResponseSchema2 = external_exports.object({
   ownerUserId: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/workspaces.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/workspaces.js
 var lookKey2 = external_exports.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "a short lowercase key").nullable();
 var lookLevel2 = external_exports.number().min(0).max(1).nullable();
 var workspaceLookSchema2 = external_exports.object({
@@ -21862,7 +22299,7 @@ var workspaceUpdatedSchema2 = external_exports.object({
   })
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/me.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/me.js
 var onboardingDismissedSchema = external_exports.object({
   dismissed: external_exports.literal(true)
 });
@@ -22014,7 +22451,7 @@ function defineMeSchemas(scopeSchema3) {
   return { meResponseSchema: meResponseSchema3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/members.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/members.js
 var memberSchema2 = external_exports.object({
   id: external_exports.string(),
   userId: external_exports.string(),
@@ -22048,7 +22485,7 @@ var memberChangeEmailLinkSchema2 = external_exports.object({
   expiresAt: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-auth.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-auth.js
 var cliAuthRequestSchema2 = external_exports.object({
   email: external_exports.email()
 });
@@ -22090,7 +22527,7 @@ function defineCliAuthSchemas(apiKeySchema3) {
   return { cliAuthCompletedSchema: cliAuthCompletedSchema3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-connect.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-connect.js
 var ssoCliConnectSchema = external_exports.object({
   /** The hub-minted exchange JWT (compact JWS — three base64url segments). */
   token: external_exports.string().min(20).max(4096),
@@ -22105,12 +22542,18 @@ var ssoCliConnectSchema = external_exports.object({
   hubRefreshToken: external_exports.string().min(20).max(512).optional()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-logout.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-package.js
+var cliPackageRequestSchema = external_exports.object({
+  /** The hub-minted exchange JWT (compact JWS — three base64url segments). */
+  token: external_exports.string().min(1)
+});
+
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-logout.js
 var ssoLogoutResponseSchema = external_exports.object({
   url: external_exports.string().nullable()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/invitations.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/invitations.js
 var invitationSchema2 = external_exports.object({
   id: external_exports.string(),
   email: external_exports.string(),
@@ -22152,7 +22595,7 @@ var invitationAcceptedSchema2 = external_exports.object({
   role: workspaceRoleSchema
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/audit.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/audit.js
 var auditEntrySchema2 = external_exports.object({
   id: external_exports.number(),
   actorUserId: external_exports.string().nullable(),
@@ -22197,7 +22640,7 @@ var auditListSchema2 = external_exports.object({
   total: external_exports.number().int().nullable()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/break-glass.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/break-glass.js
 var breakGlassClaimOwnershipRequestSchema2 = external_exports.object({
   userId: external_exports.string().min(1).optional(),
   workspaceId: external_exports.uuid().optional()
@@ -22222,7 +22665,7 @@ var breakGlassResetTwoFactorSchema2 = external_exports.object({
   hadTwoFactor: external_exports.boolean()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/files.js
 var fileSchema2 = external_exports.object({
   id: external_exports.string(),
   sha256: external_exports.string(),
@@ -22247,7 +22690,7 @@ var fileUploadQuerySchema2 = external_exports.object({
   name: plainText(1, 255)
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/projects.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/projects.js
 var projectRoleSchema = external_exports.enum(["manager", "editor", "viewer"]);
 var PROJECT_METADATA_MAX_LENGTH = 16 * 1024;
 var projectMetadataSchema = opaqueJsonChecks(external_exports.record(external_exports.string(), external_exports.unknown())).refine((v) => JSON.stringify(v).length <= PROJECT_METADATA_MAX_LENGTH, `metadata must serialize to at most ${PROJECT_METADATA_MAX_LENGTH} characters`);
@@ -22335,7 +22778,7 @@ var projectMemberParamsSchema = external_exports.object({
 });
 var projectTeamParamsSchema = external_exports.object({ id: external_exports.uuid(), teamId: external_exports.uuid() });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/teams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/teams.js
 var teamSlugSchema2 = external_exports.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "lowercase letters and digits, joined by single dashes").min(1).max(60);
 var teamSchema2 = external_exports.object({
   id: external_exports.string(),
@@ -22389,7 +22832,119 @@ var teamMemberParamsSchema = external_exports.object({
   userId: noControlChars(external_exports.string().min(1).max(200))
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/demo-passes.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/webhooks.js
+var webhookEventPatternSchema = external_exports.string().max(80).regex(/^(\*|[a-z][a-z0-9_]*\.(\*|[a-z][a-z0-9_]*))$/, "an event type (thing.created), a family (thing.*) or everything (*)");
+var webhookSubjectKeySchema = external_exports.string().max(40).regex(/^[a-z][a-z0-9_]*$/, "lowercase letters, digits and underscores, starting with a letter");
+var webhookFiltersSchema = external_exports.record(webhookSubjectKeySchema, external_exports.array(plainText(1, 200)).min(1).max(100)).refine((v) => Object.keys(v).length <= 10, { error: "at most 10 subject keys" }).describe("Subject key \u2192 ids; AND across keys, OR within a key; an event that does not carry a filtered subject does not match");
+var UrlParser = globalThis.URL;
+function isHttpUrlWithoutCredentials(value) {
+  let parsed;
+  try {
+    parsed = new UrlParser(value);
+  } catch {
+    return false;
+  }
+  return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username === "" && parsed.password === "";
+}
+var webhookUrlSchema = external_exports.string().max(2048).refine((v) => !/\s/.test(v) && !hasControlChars(v), {
+  error: "must not contain whitespace or control characters",
+  abort: true
+}).refine(isHttpUrlWithoutCredentials, { error: "an http or https URL without credentials" });
+var webhookDeliveryStatusSchema = external_exports.enum(["pending", "delivered", "failed", "held"]);
+var webhookEndpointSchema = external_exports.object({
+  id: external_exports.string(),
+  url: external_exports.string(),
+  description: external_exports.string(),
+  events: external_exports.array(external_exports.string()),
+  filters: external_exports.record(external_exports.string(), external_exports.array(external_exports.string())),
+  enabled: external_exports.boolean(),
+  createdBy: external_exports.string().nullable(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string(),
+  /** Set with `disabledReason` when the endpoint was switched off after failing too long. */
+  disabledAt: external_exports.string().nullable(),
+  disabledReason: external_exports.string().nullable(),
+  consecutiveFailures: external_exports.number().int(),
+  lastDeliveryAt: external_exports.string().nullable(),
+  lastDeliveryStatus: external_exports.enum(["delivered", "failed"]).nullable(),
+  /** During a rotation, the previous secret keeps signing until this date. */
+  previousSecretExpiresAt: external_exports.string().nullable()
+});
+var webhookEndpointCreatedSchema = webhookEndpointSchema.extend({
+  secret: external_exports.string()
+});
+var webhookSecretRotatedSchema = webhookEndpointSchema.extend({
+  secret: external_exports.string(),
+  previousSecretExpiresAt: external_exports.string()
+});
+var webhookDescriptionSchema = plainText(0, 200);
+var webhookEventsSchema = external_exports.array(webhookEventPatternSchema).min(1).max(50);
+var webhookEndpointCreateSchema = external_exports.object({
+  url: webhookUrlSchema,
+  description: webhookDescriptionSchema.default(""),
+  events: webhookEventsSchema,
+  filters: webhookFiltersSchema.default({}),
+  enabled: external_exports.boolean().default(true)
+});
+var webhookEndpointUpdateSchema = external_exports.object({
+  url: webhookUrlSchema.optional(),
+  description: webhookDescriptionSchema.optional(),
+  events: webhookEventsSchema.optional(),
+  filters: webhookFiltersSchema.optional(),
+  enabled: external_exports.boolean().optional()
+}).refine((b) => Object.values(b).some((v) => v !== void 0), { error: "nothing to change" });
+var webhooksListSchema = external_exports.object({
+  webhooks: external_exports.array(webhookEndpointSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var webhookDeliverySchema = external_exports.object({
+  id: external_exports.string(),
+  endpointId: external_exports.string(),
+  eventId: external_exports.string(),
+  eventType: external_exports.string(),
+  status: webhookDeliveryStatusSchema,
+  attempt: external_exports.number().int(),
+  lastStatusCode: external_exports.number().int().nullable(),
+  lastError: external_exports.string().nullable(),
+  nextAttemptAt: external_exports.string().nullable(),
+  deliveredAt: external_exports.string().nullable(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string(),
+  payload: external_exports.record(external_exports.string(), external_exports.unknown())
+});
+var webhookDeliveriesListSchema = external_exports.object({
+  deliveries: external_exports.array(webhookDeliverySchema),
+  nextCursor: external_exports.string().nullable()
+});
+var webhookDeliveriesListQuerySchema = cursorPageQuerySchema.extend({
+  status: webhookDeliveryStatusSchema.optional()
+});
+var webhookTestResultSchema = external_exports.object({
+  delivery: webhookDeliverySchema
+});
+var webhookCatalogSubjectSchema = external_exports.object({
+  key: external_exports.string(),
+  field: external_exports.string(),
+  description: external_exports.string(),
+  /** The value under `field` is always a list of ids (`projectIds`); else always one id. */
+  list: external_exports.boolean()
+});
+var webhookCatalogEventSchema = external_exports.object({
+  type: external_exports.string(),
+  description: external_exports.string(),
+  /** The subject keys this event carries (what a filter can match it on). */
+  subjects: external_exports.array(external_exports.string()),
+  /** The JSON Schema of the event's `data`. */
+  schema: external_exports.record(external_exports.string(), external_exports.unknown())
+});
+var webhookCatalogSchema = external_exports.object({
+  subjects: external_exports.array(webhookCatalogSubjectSchema),
+  events: external_exports.array(webhookCatalogEventSchema)
+});
+var webhookParamsSchema = external_exports.object({ id: external_exports.uuid() });
+var webhookDeliveryParamsSchema = webhookParamsSchema.extend({ deliveryId: external_exports.uuid() });
+
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/demo-passes.js
 var DEMO_PASS_MAX_MINUTES2 = 10080;
 var demoPassSchema2 = external_exports.object({
   id: external_exports.string(),
@@ -22430,7 +22985,7 @@ var demoPassRedeemedSchema2 = external_exports.object({
   expiresAt: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/api-keys.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/api-keys.js
 function defineApiKeySchemas(scopeSchema3) {
   const apiKeySchema3 = external_exports.object({
     id: external_exports.string(),
@@ -22475,7 +23030,7 @@ function defineApiKeySchemas(scopeSchema3) {
   return { apiKeySchema: apiKeySchema3, apiKeysListSchema: apiKeysListSchema3, apiKeyCreateSchema: apiKeyCreateSchema3, apiKeyCreatedSchema: apiKeyCreatedSchema3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/define.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/define.js
 function defineChassisContract(tool) {
   return buildChassisContract(defineScopeSchema(tool.scopes));
 }
@@ -22489,7 +23044,7 @@ function buildChassisContract(scopeSchema3) {
   };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/owner-session.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/owner-session.js
 var SIGN_IN_WAITS_MS = [4e3, 8e3, 12e3];
 var SESSION_COOKIE = /session_token$/;
 function sessionCookie(res) {
@@ -22570,7 +23125,7 @@ async function withOwnerSession(ctx, options, run2) {
   }
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/demo.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/demo.js
 var SWITCH_OFF = "Demo sign-in is off on this instance (DEMO_SIGN_IN), or this is the cloud edition, where demo links are minted at the Antasphere hub.";
 var NOT_AN_OWNER = "Only an owner of this workspace manages demo links: the account that signed in is not one.";
 var REFUSALS = /* @__PURE__ */ new Set([
@@ -22592,7 +23147,7 @@ var MemberRefusal = class extends CliApiRefusal {
     this.code = code;
   }
 };
-async function explained2(run2) {
+async function explained3(run2) {
   try {
     return await run2();
   } catch (e) {
@@ -22637,7 +23192,7 @@ function lifetimeMinutes(opts) {
 function demoLink(baseUrl, secret, path) {
   return `${baseUrl.replace(/\/+$/, "")}/demo#pass=${secret}&to=${encodeURIComponent(path)}`;
 }
-var collect = (value, previous) => [...previous, value];
+var collect2 = (value, previous) => [...previous, value];
 function registerDemoCommands(kit, program2, io) {
   const { identity, resolveContext: resolveContext2 } = kit;
   const prefix = identity.envPrefix;
@@ -22648,7 +23203,7 @@ function registerDemoCommands(kit, program2, io) {
     ...opts.ownerEmail !== void 0 ? { ownerEmail: opts.ownerEmail } : {},
     ownerPasswordStdin: opts.ownerPasswordStdin
   });
-  ownerFlags(demo.command("link").description("Mint one demo pass per member and print one link per page").requiredOption("--email <address>", "a member the links sign in (repeatable: one sign-in, one pass per member)", collect, []).option("--path <p>", "a page the link lands on (repeatable; the first is the default, /)", collect, []).option("--hours <n>", "how long the link lives, in hours (default: a day; at most a week)").option("--minutes <n>", "how long the link lives, in minutes (instead of --hours)")).action(async (opts, cmd) => {
+  ownerFlags(demo.command("link").description("Mint one demo pass per member and print one link per page").requiredOption("--email <address>", "a member the links sign in (repeatable: one sign-in, one pass per member)", collect2, []).option("--path <p>", "a page the link lands on (repeatable; the first is the default, /)", collect2, []).option("--hours <n>", "how long the link lives, in hours (default: a day; at most a week)").option("--minutes <n>", "how long the link lives, in minutes (instead of --hours)")).action(async (opts, cmd) => {
     const paths = opts.path.length > 0 ? opts.path : ["/"];
     for (const path of paths) {
       if (!isSafeDemoPath(path)) {
@@ -22662,7 +23217,7 @@ function registerDemoCommands(kit, program2, io) {
       const refused2 = [];
       for (const email3 of opts.email) {
         try {
-          const minted = await explained2(() => client.mintDemoPass({
+          const minted = await explained3(() => client.mintDemoPass({
             email: email3,
             path: paths[0],
             ...expiresInMinutes !== void 0 ? { expiresInMinutes } : {}
@@ -22694,7 +23249,7 @@ function registerDemoCommands(kit, program2, io) {
   });
   ownerFlags(demo.command("list").description("List the demo passes of the workspace (newest first)")).action(async (opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
-    const { passes } = await withOwnerSession(ctx, session(opts), (client) => explained2(() => client.demoPasses()));
+    const { passes } = await withOwnerSession(ctx, session(opts), (client) => explained3(() => client.demoPasses()));
     if (ctx.json)
       return printJson2(io, { passes });
     if (passes.length === 0) {
@@ -22714,9 +23269,9 @@ function registerDemoCommands(kit, program2, io) {
       ])
     ]));
   });
-  ownerFlags(demo.command("revoke <id>").description("Revoke a demo pass; the sessions it opened end with it")).action(async (id, opts, cmd) => {
+  ownerFlags(demo.command("revoke <id>").description("Revoke a demo pass; the sessions it opened end with it")).action(async (id2, opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
-    const pass = await withOwnerSession(ctx, session(opts), (client) => explained2(() => client.revokeDemoPass(id)));
+    const pass = await withOwnerSession(ctx, session(opts), (client) => explained3(() => client.revokeDemoPass(id2)));
     if (ctx.json)
       return printJson2(io, pass);
     io.out.write(`Revoked the demo pass ${pass.id} for ${pass.email}. The sessions it opened are signed out.
@@ -22724,14 +23279,14 @@ function registerDemoCommands(kit, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
 import { createWriteStream } from "node:fs";
 import { mkdir as mkdir2, readFile, writeFile } from "node:fs/promises";
 import { basename, resolve as resolve2, win32 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/safe-write.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/safe-write.js
 import { constants as FS } from "node:fs";
 import { mkdir, open, realpath, unlink } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute, relative, resolve } from "node:path";
@@ -22812,7 +23367,7 @@ async function streamContained(root, relPath, source) {
   }
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
 function safeDownloadName(originalName) {
   const name = basename(win32.basename(originalName));
   if (name === "" || name === "." || name === ".." || name.startsWith(".")) {
@@ -22893,15 +23448,15 @@ function registerFileCommands(kit, program2, io) {
   id: ${result.file.id}
 `);
   });
-  files.command("download <id>").description("Download a file by id").option("--out <path>", "write to this exact path (your path, used verbatim)").option("--dir <path>", "directory to write the stored name into (default: .)").action(async (id, opts, cmd) => {
+  files.command("download <id>").description("Download a file by id").option("--out <path>", "write to this exact path (your path, used verbatim)").option("--dir <path>", "directory to write the stored name into (default: .)").action(async (id2, opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
     const apiKey = await requireApiKey2(ctx);
     if (opts.out && opts.dir) {
       throw new CliUsageError("Pass either --out <path> or --dir <path>, not both.");
     }
-    const meta3 = await ctx.client.file(id);
+    const meta3 = await ctx.client.file(id2);
     const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
-    const res = await fetchImpl(ctx.client.fileContentUrl(id), {
+    const res = await fetchImpl(ctx.client.fileContentUrl(id2), {
       // This one bypasses the SDK, so it carries the SDK's headers itself:
       // the key, and the selected workspace (a download follows it too).
       headers: {
@@ -22928,18 +23483,18 @@ function registerFileCommands(kit, program2, io) {
     io.out.write(`Downloaded ${meta3.originalName} \u2192 ${out} (${fmtBytes(buf.length)})
 `);
   });
-  files.command("rm <id>").description("Delete a file by id").action(async (id, _opts, cmd) => {
+  files.command("rm <id>").description("Delete a file by id").action(async (id2, _opts, cmd) => {
     const ctx = resolveContext2(cmd, io);
     await requireApiKey2(ctx);
-    await ctx.client.deleteFile(id);
+    await ctx.client.deleteFile(id2);
     if (ctx.json)
-      return printJson2(io, { deleted: id });
-    io.out.write(`Deleted ${id}
+      return printJson2(io, { deleted: id2 });
+    io.out.write(`Deleted ${id2}
 `);
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/completion.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/completion.js
 function commandTree(program2) {
   return program2.commands.filter((c) => !c.name().startsWith("help")).map((c) => ({
     name: c.name(),
@@ -23014,7 +23569,7 @@ function registerCompletionCommand(identity, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/program.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/program.js
 function creditFigures(credit) {
   const parts = [
     typeof credit?.credits === "number" ? `this needs ${credit.credits} credits` : null,
@@ -23032,6 +23587,7 @@ function createProgram(kit, definition) {
     registerWorkspaceCommands(kit, program2, io);
     registerProjectCommands(kit, program2, io);
     registerTeamCommands(kit, program2, io);
+    registerWebhookCommands(kit, program2, io);
     registerDemoCommands(kit, program2, io);
     registerTool2(program2, io);
     registerFileCommands(kit, program2, io);
@@ -23068,9 +23624,9 @@ function createProgram(kit, definition) {
         return e.exitCode;
       }
       if (e instanceof PlatformApiError || e instanceof CliAuthError) {
-        const explained3 = await explainWorkspaceRefusal(io, e);
-        if (explained3) {
-          io.err.write(`Error: ${explained3}
+        const explained4 = await explainWorkspaceRefusal(io, e);
+        if (explained4) {
+          io.err.write(`Error: ${explained4}
 `);
           return 1;
         }
@@ -23096,21 +23652,7 @@ function createProgram(kit, definition) {
   return { buildProgram, run: run2 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/identity.js
-function cliIdentity(identity) {
-  return {
-    bin: identity.cli.bin,
-    tool: identity.slug,
-    legacyConfigDir: identity.cli.legacyConfigDir,
-    displayName: identity.displayName,
-    envPrefix: identity.cli.envPrefix,
-    keyPrefix: identity.apiKeyPrefix,
-    exportScope: identity.scopes.dataExport,
-    cloudUrl: identity.cloud.url
-  };
-}
-
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/open.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/open.js
 import { spawn } from "node:child_process";
 function platformOpener(platform = process.platform) {
   if (platform === "darwin")
@@ -23136,7 +23678,7 @@ function isInteractive(io) {
   return io.out.isTTY === true;
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/index.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.3.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/index.js
 function defineCli(definition) {
   const { identity, createClient } = definition;
   const config2 = createConfig(identity);
@@ -23154,9 +23696,11 @@ var IDENTITY = {
   scopes: {
     read: "presentations:read",
     write: "presentations:write",
-    dataExport: "data:export"
+    dataExport: "data:export",
+    // Managing the workspace's webhook endpoints (PRDCT-3482): on the CLI key like read and write (Romain, 13 October 2026).
+    webhooks: "webhooks:manage"
   },
-  cliKeyScopesLabel: "presentations:read+write",
+  cliKeyScopesLabel: "presentations:read+write, webhooks:manage",
   cloud: { url: "https://slideless.antasphere.com" },
   cli: {
     bin: "slideless",
@@ -23173,7 +23717,9 @@ var IDENTITY = {
 
 // ../contract/dist/chassis.js
 var { read, write, dataExport } = IDENTITY.scopes;
-var chassisContract = defineChassisContract({ scopes: [read, write, dataExport] });
+var chassisContract = defineChassisContract({
+  scopes: [read, write, dataExport, IDENTITY.scopes.webhooks]
+});
 var scopeSchema2 = chassisContract.scopeSchema;
 var apiKeySchema2 = chassisContract.apiKeySchema;
 var apiKeysListSchema2 = chassisContract.apiKeysListSchema;
@@ -23881,6 +24427,250 @@ var formResponsesSummarySchema = external_exports.object({
   total: external_exports.number().int()
 });
 
+// ../contract/dist/schemas/apps.js
+var appEntrySchema = external_exports.object({
+  /** The tool's registry slug (`finance`, `hiring`, …): what picks its drawing and its sentence. */
+  slug: external_exports.string(),
+  /** The tool's display name. */
+  name: external_exports.string(),
+  /** Where opening the tool lands. */
+  launchUrl: external_exports.string(),
+  /** The operator's own sentence for the tool (the file source), else null. */
+  description: external_exports.string().nullable(),
+  /** The person has signed in to the tool (the hub source); false when nothing says so. */
+  connected: external_exports.boolean(),
+  /** When the person first signed in to the tool (the hub source), else null. */
+  firstUsedAt: external_exports.string().nullable(),
+  /** When the person last signed in to the tool (the hub source), else null. */
+  lastUsedAt: external_exports.string().nullable(),
+  /** This very tool: the page shows it, with no button. */
+  current: external_exports.boolean()
+});
+var APP_SOURCES = ["hub", "file", "none"];
+var appsListSchema = external_exports.object({
+  apps: external_exports.array(appEntrySchema),
+  /** The account that signs the person in (the hub), when the instance knows one. */
+  hub: external_exports.object({ url: external_exports.string(), name: external_exports.string() }).nullable(),
+  source: external_exports.enum(APP_SOURCES)
+});
+
+// ../contract/dist/schemas/webhooks.js
+var id = external_exports.string();
+var isoDate = external_exports.string();
+var shareLinkFacts = external_exports.object({
+  deckId: id,
+  linkId: id,
+  name: external_exports.string(),
+  purpose: external_exports.string(),
+  pinnedVersion: external_exports.number().int().nullable(),
+  expiresAt: isoDate.nullable(),
+  hasPassword: external_exports.boolean()
+});
+var formResponseFacts = external_exports.object({
+  deckId: id,
+  formName: external_exports.string(),
+  responseId: id,
+  revision: external_exports.number().int(),
+  linkId: id.nullable(),
+  version: external_exports.number().int(),
+  source: external_exports.string(),
+  placement: external_exports.string().nullable(),
+  /** The answers as submitted, by field name: a text, or a list for a multiple choice. */
+  answers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.array(external_exports.string())])),
+  files: external_exports.array(external_exports.object({ id, name: external_exports.string(), sizeBytes: external_exports.number().int() }))
+});
+var collaboratorFacts = external_exports.object({
+  deckId: id,
+  collaboratorId: id,
+  email: external_exports.string(),
+  userId: id.nullable()
+});
+var annotationFacts = external_exports.object({
+  deckId: id,
+  version: external_exports.number().int(),
+  annotationId: id,
+  linkId: id.nullable(),
+  authorName: external_exports.string().nullable()
+});
+var thumbnailFacts = external_exports.object({ deckId: id, versionId: id, version: external_exports.number().int() });
+var DECK_WEBHOOK_EVENTS = [
+  {
+    type: "deck.created",
+    description: "A deck was created: its first version was pushed, or a deck was duplicated.",
+    subjects: ["deck", "project"],
+    data: external_exports.object({
+      deckId: id,
+      title: external_exports.string(),
+      version: external_exports.number().int(),
+      projectIds: external_exports.array(id),
+      ownerUserId: id,
+      remixedFrom: id.nullable()
+    })
+  },
+  {
+    type: "deck.version_committed",
+    description: "A new version of a deck was pushed.",
+    subjects: ["deck", "project"],
+    data: external_exports.object({
+      deckId: id,
+      version: external_exports.number().int(),
+      title: external_exports.string(),
+      authorUserId: id,
+      authorRole: external_exports.string()
+    })
+  },
+  {
+    type: "deck.updated",
+    description: "A deck\u2019s settings changed (its title, its description, its form notifications\u2026); `fields` names what.",
+    subjects: ["deck", "project"],
+    data: external_exports.object({ deckId: id, fields: external_exports.array(external_exports.string()) })
+  },
+  {
+    type: "deck.deleted",
+    description: "A deck was deleted.",
+    subjects: ["deck", "project"],
+    data: external_exports.object({ deckId: id, title: external_exports.string() })
+  },
+  {
+    type: "deck.project_linked",
+    description: "A deck was put in a project (at creation, or later).",
+    subjects: ["deck", "project"],
+    data: external_exports.object({ deckId: id, projectId: id })
+  },
+  {
+    type: "deck.project_unlinked",
+    description: "A deck was taken out of a project.",
+    subjects: ["deck", "project"],
+    data: external_exports.object({ deckId: id, projectId: id })
+  },
+  {
+    type: "share_link.created",
+    description: "A share link was made for a deck (preview links never emit).",
+    subjects: ["deck", "project", "link"],
+    data: shareLinkFacts
+  },
+  {
+    type: "share_link.updated",
+    description: "A share link changed; `changed` names the fields.",
+    subjects: ["deck", "project", "link"],
+    data: shareLinkFacts.extend({ changed: external_exports.array(external_exports.string()) })
+  },
+  {
+    type: "share_link.revoked",
+    description: "A share link was revoked.",
+    subjects: ["deck", "project", "link"],
+    data: shareLinkFacts
+  },
+  {
+    type: "share_link.sent",
+    description: "A share link was sent by mail from the dashboard.",
+    subjects: ["deck", "project", "link"],
+    data: shareLinkFacts.extend({ recipient: external_exports.string() })
+  },
+  {
+    type: "share_link.viewed",
+    description: "A share link was opened. Grouped per link: the first view is sent at once, then at most one event per link per five minutes carrying the count and the facts of the views since the last one. No address, no identity.",
+    subjects: ["deck", "project", "link"],
+    data: external_exports.object({
+      deckId: id,
+      linkId: id,
+      version: external_exports.number().int().nullable(),
+      views: external_exports.number().int(),
+      firstViewAt: isoDate,
+      lastViewAt: isoDate,
+      referrerHosts: external_exports.array(external_exports.string()),
+      placements: external_exports.array(external_exports.string()),
+      browserFamilies: external_exports.array(external_exports.string())
+    })
+  },
+  {
+    type: "attachment.downloaded",
+    description: "An attachment of a deck was downloaded through a share link (`name` null for the whole bundle).",
+    subjects: ["deck", "project", "link"],
+    data: external_exports.object({ deckId: id, linkId: id, version: external_exports.number().int(), name: external_exports.string().nullable() })
+  },
+  {
+    type: "form.response_submitted",
+    description: "A form inside a deck received a response; `answers` carries it.",
+    subjects: ["deck", "project", "link"],
+    data: formResponseFacts
+  },
+  {
+    type: "form.response_edited",
+    description: "A respondent edited their response through their edit link; `answers` is the new revision.",
+    subjects: ["deck", "project", "link"],
+    data: formResponseFacts
+  },
+  {
+    type: "form.file_uploaded",
+    description: "A respondent dropped a file into a form field (before the response is submitted).",
+    subjects: ["deck", "project", "link"],
+    data: external_exports.object({
+      deckId: id,
+      formName: external_exports.string(),
+      linkId: id,
+      uploadId: id,
+      name: external_exports.string(),
+      sizeBytes: external_exports.number().int()
+    })
+  },
+  {
+    type: "form.response_deleted",
+    description: "A form response was deleted from the dashboard.",
+    subjects: ["deck", "project"],
+    data: external_exports.object({ deckId: id, responseId: id })
+  },
+  {
+    type: "collaborator.invited",
+    description: "Someone was invited to work on a deck.",
+    subjects: ["deck", "project"],
+    data: collaboratorFacts
+  },
+  {
+    type: "collaborator.revoked",
+    description: "A collaborator\u2019s grant on a deck was revoked (by hand, or with a member\u2019s removal).",
+    subjects: ["deck", "project"],
+    data: collaboratorFacts
+  },
+  {
+    type: "collaborator.claimed",
+    description: "An invited collaborator claimed their grant on a deck.",
+    subjects: ["deck", "project"],
+    data: collaboratorFacts
+  },
+  {
+    type: "annotation.created",
+    description: "An annotation was left on a deck version, by a viewer through a share link or by a member.",
+    subjects: ["deck", "project", "link"],
+    data: annotationFacts
+  },
+  {
+    type: "annotation.resolved",
+    description: "An annotation was marked resolved.",
+    subjects: ["deck", "project"],
+    data: annotationFacts
+  },
+  {
+    type: "annotation.deleted",
+    description: "An annotation was deleted.",
+    subjects: ["deck", "project"],
+    data: annotationFacts
+  },
+  {
+    type: "thumbnail.rendered",
+    description: "The still image of a deck version is ready.",
+    subjects: ["deck", "project"],
+    data: thumbnailFacts
+  },
+  {
+    type: "thumbnail.failed",
+    description: "The still image of a deck version could not be made.",
+    subjects: ["deck", "project"],
+    data: thumbnailFacts
+  }
+];
+var DECK_WEBHOOK_EVENT_TYPES = DECK_WEBHOOK_EVENTS.map((e) => e.type);
+
 // ../contract/dist/embed.js
 var EMBED_PLACEMENT_RE = /^[A-Za-z0-9._-]{1,64}$/;
 function buildEmbedSnippets(opts) {
@@ -23946,8 +24736,8 @@ var PlatformClient = class extends ChassisClient {
     const { presentations } = await this.presentations({ type, default: true, limit: 1 });
     return presentations[0] ?? null;
   }
-  presentation(id) {
-    return this.request("GET", `/presentations/${encodeURIComponent(id)}`);
+  presentation(id2) {
+    return this.request("GET", `/presentations/${encodeURIComponent(id2)}`);
   }
   /**
    * Update mutable deck properties. `metadata` replaces the stored object
@@ -23959,12 +24749,12 @@ var PlatformClient = class extends ChassisClient {
    * made private, 403 `forbidden` when the caller reads the deck but may not
    * change that property.
    */
-  updatePresentation(id, patch) {
-    return this.request("PATCH", `/presentations/${encodeURIComponent(id)}`, patch);
+  updatePresentation(id2, patch) {
+    return this.request("PATCH", `/presentations/${encodeURIComponent(id2)}`, patch);
   }
   /** Soft delete: versions and share tokens stop resolving. */
-  deletePresentation(id) {
-    return this.request("DELETE", `/presentations/${encodeURIComponent(id)}`);
+  deletePresentation(id2) {
+    return this.request("DELETE", `/presentations/${encodeURIComponent(id2)}`);
   }
   /**
    * Duplicate a deck (PRDCT-2279): a new deck in the same workspace whose
@@ -23972,8 +24762,8 @@ var PlatformClient = class extends ChassisClient {
    * re-uploaded. `version` picks the source version (current when omitted),
    * `title` names the copy. Idempotency-Key aware like the other creates.
    */
-  duplicatePresentation(id, req = {}, opts = {}) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/duplicate`, req, idempotencyHeader(opts));
+  duplicatePresentation(id2, req = {}, opts = {}) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/duplicate`, req, idempotencyHeader(opts));
   }
   // ── Projects (ADR 026) ────────────────────────────────────────────────────
   // The chassis client carries the projects themselves (`projects()`,
@@ -23982,12 +24772,12 @@ var PlatformClient = class extends ChassisClient {
    * Link a deck to a project: the project's members read it from then on.
    * The deck administrator's act, with editor or more on the project.
    */
-  linkPresentationProject(id, projectId) {
-    return this.request("PUT", `/presentations/${encodeURIComponent(id)}/projects/${encodeURIComponent(projectId)}`);
+  linkPresentationProject(id2, projectId) {
+    return this.request("PUT", `/presentations/${encodeURIComponent(id2)}/projects/${encodeURIComponent(projectId)}`);
   }
   /** Take a deck out of a project (the deck administrator, or a project manager). */
-  unlinkPresentationProject(id, projectId) {
-    return this.request("DELETE", `/presentations/${encodeURIComponent(id)}/projects/${encodeURIComponent(projectId)}`);
+  unlinkPresentationProject(id2, projectId) {
+    return this.request("DELETE", `/presentations/${encodeURIComponent(id2)}/projects/${encodeURIComponent(projectId)}`);
   }
   /** The project's brand: the brand reference its decks are authored with, or null. */
   projectBrand(projectId) {
@@ -24035,28 +24825,28 @@ var PlatformClient = class extends ChassisClient {
    * Commit a new immutable version. `expectedBaseVersion` must equal the
    * deck's currentVersion or the server answers 409 version_conflict.
    */
-  commitVersion(id, req) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/versions`, req);
+  commitVersion(id2, req) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/versions`, req);
   }
   // ── Pull ──────────────────────────────────────────────────────────────────
-  presentationVersions(id, params = {}) {
-    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id)}/versions`, params));
+  presentationVersions(id2, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id2)}/versions`, params));
   }
   /** One version including its full manifest (path → sha256). */
-  presentationVersion(id, version2) {
-    return this.request("GET", `/presentations/${encodeURIComponent(id)}/versions/${version2}`);
+  presentationVersion(id2, version2) {
+    return this.request("GET", `/presentations/${encodeURIComponent(id2)}/versions/${version2}`);
   }
   /** URL of the streamed asset download endpoint (content-addressed). */
-  presentationAssetUrl(id, sha256) {
-    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/assets/${encodeURIComponent(sha256)}`;
+  presentationAssetUrl(id2, sha256) {
+    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/assets/${encodeURIComponent(sha256)}`;
   }
   /**
    * Downloads one deck blob. Returns the raw Response so callers can stream
    * the bytes; a non-2xx answer throws PlatformApiError like every method.
    */
-  async downloadPresentationAsset(id, sha256) {
+  async downloadPresentationAsset(id2, sha256) {
     const headers = this.baseHeaders();
-    const res = await this.fetchImpl(this.presentationAssetUrl(id, sha256), {
+    const res = await this.fetchImpl(this.presentationAssetUrl(id2, sha256), {
       method: "GET",
       headers,
       credentials: "same-origin",
@@ -24070,8 +24860,8 @@ var PlatformClient = class extends ChassisClient {
     return res;
   }
   /** URL of the streamed attachments zip of one version (PRDCT-2278). */
-  versionAttachmentsZipUrl(id, version2) {
-    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/versions/${version2}/downloads.zip`;
+  versionAttachmentsZipUrl(id2, version2) {
+    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/versions/${version2}/downloads.zip`;
   }
   /**
    * Downloads one version's attachments (its `downloads/` folder) as a
@@ -24079,24 +24869,24 @@ var PlatformClient = class extends ChassisClient {
    * Content-Disposition carries it). Returns the raw Response so callers can
    * stream the bytes; 404 no_attachments when the version carries none.
    */
-  async downloadVersionAttachmentsZip(id, version2) {
-    return this.rawDownload(this.versionAttachmentsZipUrl(id, version2));
+  async downloadVersionAttachmentsZip(id2, version2) {
+    return this.rawDownload(this.versionAttachmentsZipUrl(id2, version2));
   }
   /**
    * URL of one attachment of one version by its name (the path relative to
    * `downloads/`). The name is ONE path segment on the wire: a nested name
    * (`sub/file.csv`) is percent-encoded whole (`sub%2Ffile.csv`).
    */
-  versionAttachmentUrl(id, version2, name) {
-    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/versions/${version2}/downloads/${encodeURIComponent(name)}`;
+  versionAttachmentUrl(id2, version2, name) {
+    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/versions/${version2}/downloads/${encodeURIComponent(name)}`;
   }
   /** Downloads one attachment (attachment disposition, the manifest content type). Raw Response. */
-  async downloadVersionAttachment(id, version2, name) {
-    return this.rawDownload(this.versionAttachmentUrl(id, version2, name));
+  async downloadVersionAttachment(id2, version2, name) {
+    return this.rawDownload(this.versionAttachmentUrl(id2, version2, name));
   }
   /** URL of a version's still image (WebP). */
-  versionThumbnailUrl(id, version2) {
-    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/versions/${version2}/thumbnail`;
+  versionThumbnailUrl(id2, version2) {
+    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/versions/${version2}/thumbnail`;
   }
   /**
    * A version's still image. Raw Response; a non-2xx throws PlatformApiError
@@ -24105,8 +24895,8 @@ var PlatformClient = class extends ChassisClient {
    * `private, no-cache` with an ETag, so the browser keeps the bytes and revalidates
    * on each ask (a 304), and a read right that was revoked is felt at once.
    */
-  async versionThumbnail(id, version2) {
-    const res = await this.fetchImpl(this.versionThumbnailUrl(id, version2), {
+  async versionThumbnail(id2, version2) {
+    const res = await this.fetchImpl(this.versionThumbnailUrl(id2, version2), {
       method: "GET",
       headers: this.baseHeaders(),
       credentials: "same-origin",
@@ -24120,17 +24910,17 @@ var PlatformClient = class extends ChassisClient {
     return res;
   }
   /** URL of the streamed AGENT.md briefing endpoint. */
-  agentDocUrl(id, version2) {
-    const base = `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/agent-doc`;
+  agentDocUrl(id2, version2) {
+    const base = `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/agent-doc`;
     return version2 !== void 0 ? `${base}?version=${version2}` : base;
   }
   /**
    * The deck's AGENT.md briefing as markdown text (current version, or a
    * pinned one). 404 agent_doc_not_found when that version ships none.
    */
-  async agentDoc(id, version2) {
+  async agentDoc(id2, version2) {
     const headers = this.baseHeaders();
-    const res = await this.fetchImpl(this.agentDocUrl(id, version2), {
+    const res = await this.fetchImpl(this.agentDocUrl(id2, version2), {
       method: "GET",
       headers,
       credentials: "same-origin",
@@ -24144,12 +24934,12 @@ var PlatformClient = class extends ChassisClient {
     return res.text();
   }
   // ── Sharing ───────────────────────────────────────────────────────────────
-  shareTokens(id, params = {}) {
-    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id)}/tokens`, params));
+  shareTokens(id2, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id2)}/tokens`, params));
   }
   /** The returned `secret`/`url` appear only here — never retrievable again. */
-  createShareToken(id, req, opts = {}) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/tokens`, req, idempotencyHeader(opts));
+  createShareToken(id2, req, opts = {}) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/tokens`, req, idempotencyHeader(opts));
   }
   /**
    * Mint the dashboard's transient preview token (deck owner / workspace
@@ -24157,8 +24947,8 @@ var PlatformClient = class extends ChassisClient {
    * 'preview', 1 h expiry, hidden from the sharing panel, excluded from view
    * stats, immutable. `version` pins the preview; omitted = latest.
    */
-  createPreviewToken(id, req = {}) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/preview-token`, req);
+  createPreviewToken(id2, req = {}) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/preview-token`, req);
   }
   /**
    * Per-view events of one share token, newest first (cursor-paginated):
@@ -24166,31 +24956,31 @@ var PlatformClient = class extends ChassisClient {
    * placement label, and a coarse browser family. No IP, no geolocation,
    * no full referrer URLs — the server never stores them.
    */
-  shareTokenViews(id, tokenId, params = {}) {
-    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id)}/tokens/${encodeURIComponent(tokenId)}/views`, params));
+  shareTokenViews(id2, tokenId, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id2)}/tokens/${encodeURIComponent(tokenId)}/views`, params));
   }
   /** Pin/unpin version, rename, the per-link switches (annotate, forms, downloads, bar, remembering, file uploads), expiry, password (null clears). */
-  updateShareToken(id, tokenId, patch) {
-    return this.request("PATCH", `/presentations/${encodeURIComponent(id)}/tokens/${encodeURIComponent(tokenId)}`, patch);
+  updateShareToken(id2, tokenId, patch) {
+    return this.request("PATCH", `/presentations/${encodeURIComponent(id2)}/tokens/${encodeURIComponent(tokenId)}`, patch);
   }
   /** Soft revoke — access stats survive. */
-  revokeShareToken(id, tokenId) {
-    return this.request("DELETE", `/presentations/${encodeURIComponent(id)}/tokens/${encodeURIComponent(tokenId)}`);
+  revokeShareToken(id2, tokenId) {
+    return this.request("DELETE", `/presentations/${encodeURIComponent(id2)}/tokens/${encodeURIComponent(tokenId)}`);
   }
   /** Email the viewer link to a recipient (best-effort on top of the copyable URL). */
-  sendShareToken(id, tokenId, req) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/tokens/${encodeURIComponent(tokenId)}/send`, req);
+  sendShareToken(id2, tokenId, req) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/tokens/${encodeURIComponent(tokenId)}/send`, req);
   }
   // ── Collaborators ─────────────────────────────────────────────────────────
-  collaborators(id, params = {}) {
-    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id)}/collaborators`, params));
+  collaborators(id2, params = {}) {
+    return this.request("GET", this.pathWithQuery(`/presentations/${encodeURIComponent(id2)}/collaborators`, params));
   }
   /** `claimUrl` is always returned — email delivery is best-effort on top. */
-  inviteCollaborator(id, req, opts = {}) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/collaborators`, req, idempotencyHeader(opts));
+  inviteCollaborator(id2, req, opts = {}) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/collaborators`, req, idempotencyHeader(opts));
   }
-  removeCollaborator(id, collaboratorId) {
-    return this.request("DELETE", `/presentations/${encodeURIComponent(id)}/collaborators/${encodeURIComponent(collaboratorId)}`);
+  removeCollaborator(id2, collaboratorId) {
+    return this.request("DELETE", `/presentations/${encodeURIComponent(id2)}/collaborators/${encodeURIComponent(collaboratorId)}`);
   }
   /** Public: resolves a collaborator claim token for the claim page. */
   lookupCollaboratorInvite(token) {
@@ -24214,21 +25004,21 @@ var PlatformClient = class extends ChassisClient {
     const qs = query.toString();
     return qs ? `${base}?${qs}` : base;
   }
-  annotations(id, params = {}) {
-    return this.request("GET", this.pathWithAnnotationQuery(`/presentations/${encodeURIComponent(id)}/annotations`, params));
+  annotations(id2, params = {}) {
+    return this.request("GET", this.pathWithAnnotationQuery(`/presentations/${encodeURIComponent(id2)}/annotations`, params));
   }
   /** Workspace-wide inbox: annotations across all decks, newest first. */
   annotationInbox(params = {}) {
     return this.request("GET", this.pathWithAnnotationQuery("/annotations", params));
   }
-  createAnnotation(id, req) {
-    return this.request("POST", `/presentations/${encodeURIComponent(id)}/annotations`, req);
+  createAnnotation(id2, req) {
+    return this.request("POST", `/presentations/${encodeURIComponent(id2)}/annotations`, req);
   }
-  updateAnnotation(id, annotationId, patch) {
-    return this.request("PATCH", `/presentations/${encodeURIComponent(id)}/annotations/${encodeURIComponent(annotationId)}`, patch);
+  updateAnnotation(id2, annotationId, patch) {
+    return this.request("PATCH", `/presentations/${encodeURIComponent(id2)}/annotations/${encodeURIComponent(annotationId)}`, patch);
   }
-  deleteAnnotation(id, annotationId) {
-    return this.request("DELETE", `/presentations/${encodeURIComponent(id)}/annotations/${encodeURIComponent(annotationId)}`);
+  deleteAnnotation(id2, annotationId) {
+    return this.request("DELETE", `/presentations/${encodeURIComponent(id2)}/annotations/${encodeURIComponent(annotationId)}`);
   }
   // ── Form responses (ADR 022) ──────────────────────────────────────────────
   pathWithFormResponseQuery(base, params) {
@@ -24255,8 +25045,8 @@ var PlatformClient = class extends ChassisClient {
    * form, share link, source (link/embed), placement label, and time.
    * Payload values are the respondent's RAW input — escape before rendering.
    */
-  formResponses(id, params = {}) {
-    return this.request("GET", this.pathWithFormResponseQuery(`/presentations/${encodeURIComponent(id)}/responses`, params));
+  formResponses(id2, params = {}) {
+    return this.request("GET", this.pathWithFormResponseQuery(`/presentations/${encodeURIComponent(id2)}/responses`, params));
   }
   /**
    * One response with its edit history (PRDCT-2329): the current row and
@@ -24264,8 +25054,8 @@ var PlatformClient = class extends ChassisClient {
    * written through. Payload values are RAW respondent input at every
    * revision — escape before rendering.
    */
-  formResponse(id, responseId) {
-    return this.request("GET", `/presentations/${encodeURIComponent(id)}/responses/${encodeURIComponent(responseId)}`);
+  formResponse(id2, responseId) {
+    return this.request("GET", `/presentations/${encodeURIComponent(id2)}/responses/${encodeURIComponent(responseId)}`);
   }
   // The files of form responses (PRDCT-2403): what respondents uploaded into
   // a form's file fields. `FormResponse.files` lists them (RAW respondent
@@ -24273,30 +25063,30 @@ var PlatformClient = class extends ChassisClient {
   // path); these three calls fetch the bytes. Same return shape as every
   // streamed download here: the raw Response, PlatformApiError on a non-2xx.
   /** URL of one uploaded file of one response (attachment + nosniff, Range supported). */
-  formResponseFileUrl(id, responseId, fileId) {
-    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/responses/${encodeURIComponent(responseId)}/files/${encodeURIComponent(fileId)}`;
+  formResponseFileUrl(id2, responseId, fileId) {
+    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/responses/${encodeURIComponent(responseId)}/files/${encodeURIComponent(fileId)}`;
   }
   /**
    * Downloads one file a respondent uploaded. Raw Response so callers can
    * stream it; verify the bytes against the wire's `sizeBytes` and `sha256`
    * before keeping them.
    */
-  async downloadFormResponseFile(id, responseId, fileId) {
-    return this.rawDownload(this.formResponseFileUrl(id, responseId, fileId));
+  async downloadFormResponseFile(id2, responseId, fileId) {
+    return this.rawDownload(this.formResponseFileUrl(id2, responseId, fileId));
   }
   /** URL of one response's files as one zip (`<field>/<file>`). */
-  formResponseFilesZipUrl(id, responseId) {
-    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/responses/${encodeURIComponent(responseId)}/files.zip`;
+  formResponseFilesZipUrl(id2, responseId) {
+    return `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/responses/${encodeURIComponent(responseId)}/files.zip`;
   }
   /**
    * Downloads one response's uploaded files as a streamed store-only zip (the
    * Content-Disposition carries its name). 404 no_files when it holds none.
    */
-  async downloadFormResponseFilesZip(id, responseId) {
-    return this.rawDownload(this.formResponseFilesZipUrl(id, responseId));
+  async downloadFormResponseFilesZip(id2, responseId) {
+    return this.rawDownload(this.formResponseFilesZipUrl(id2, responseId));
   }
   /** URL of the whole deck's form-files zip, with its filters. */
-  formResponsesFilesZipUrl(id, params = {}) {
+  formResponsesFilesZipUrl(id2, params = {}) {
     const query = new URLSearchParams();
     if (params.form)
       query.set("form", params.form);
@@ -24309,7 +25099,7 @@ var PlatformClient = class extends ChassisClient {
     if (params.since)
       query.set("since", params.since);
     const qs = query.toString();
-    const base = `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id)}/responses/files.zip`;
+    const base = `${this.baseUrl}/api/v1/presentations/${encodeURIComponent(id2)}/responses/files.zip`;
     return qs ? `${base}?${qs}` : base;
   }
   /**
@@ -24318,16 +25108,23 @@ var PlatformClient = class extends ChassisClient {
    * listing (form, share link, source, placement, time). 404 no_files when
    * nothing matches.
    */
-  async downloadFormResponsesFilesZip(id, params = {}) {
-    return this.rawDownload(this.formResponsesFilesZipUrl(id, params));
+  async downloadFormResponsesFilesZip(id2, params = {}) {
+    return this.rawDownload(this.formResponsesFilesZipUrl(id2, params));
   }
   /** Grouped counts per form × link × source × placement, plus the deck total. */
-  formResponsesSummary(id) {
-    return this.request("GET", `/presentations/${encodeURIComponent(id)}/responses/summary`);
+  formResponsesSummary(id2) {
+    return this.request("GET", `/presentations/${encodeURIComponent(id2)}/responses/summary`);
   }
   /** Owner moderation: delete one response (audited server-side). */
-  deleteFormResponse(id, responseId) {
-    return this.request("DELETE", `/presentations/${encodeURIComponent(id)}/responses/${encodeURIComponent(responseId)}`);
+  deleteFormResponse(id2, responseId) {
+    return this.request("DELETE", `/presentations/${encodeURIComponent(id2)}/responses/${encodeURIComponent(responseId)}`);
+  }
+  // ── Apps ──────────────────────────────────────────────────────────────────
+  // The other tools of the organization: a browser session's alone (an API key
+  // or an OAuth token is refused 403). `me()` is the chassis client's.
+  /** The tools the caller may open, the account that signs them in, and where the list came from. */
+  apps() {
+    return this.request("GET", "/apps");
   }
 };
 
@@ -24348,6 +25145,16 @@ var requireApiKey = cli.requireApiKey;
 import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/resolve.js
+var CliUsageError2 = class extends Error {
+  exitCode;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "CliUsageError";
+    this.exitCode = opts.exitCode ?? 1;
+  }
+};
+
 // src/manifest.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
@@ -24603,7 +25410,7 @@ function isReferenceType(value) {
 function parseReferenceType(value) {
   const wanted = value.trim().toLowerCase();
   if (isReferenceType(wanted)) return wanted;
-  throw new CliUsageError(`--type must be one of ${REFERENCE_TYPES.join(", ")} (got "${value}")`);
+  throw new CliUsageError2(`--type must be one of ${REFERENCE_TYPES.join(", ")} (got "${value}")`);
 }
 var OPEN_FENCE = /^---[ \t]*$/;
 var CLOSE_FENCE = /^(?:---|\.\.\.)[ \t]*$/;
@@ -24685,7 +25492,7 @@ function referenceLines(refs) {
 }
 function resolveReference(candidates, value, what) {
   const wanted = value.trim();
-  if (!wanted) throw new CliUsageError(`Name a ${what}: its id, its title, or the start of its title.`);
+  if (!wanted) throw new CliUsageError2(`Name a ${what}: its id, its title, or the start of its title.`);
   if (isDeckId(wanted)) {
     const byId = candidates.find((r) => r.id.toLowerCase() === wanted.toLowerCase());
     if (byId) return byId;
@@ -24697,13 +25504,13 @@ function resolveReference(candidates, value, what) {
   const prefixed = candidates.filter((r) => r.title.trim().toLowerCase().startsWith(lower));
   if (prefixed.length === 1) return prefixed[0];
   if (prefixed.length > 1) throw ambiguous(prefixed, wanted, what);
-  throw new CliUsageError(
+  throw new CliUsageError2(
     `No ${what} named "${wanted}" among the ones you can read` + (candidates.length > 0 ? `. Yours:
 ${referenceLines(candidates)}` : ` (there are none).`)
   );
 }
 function ambiguous(matches, wanted, what) {
-  return new CliUsageError(
+  return new CliUsageError2(
     `"${wanted}" names several ${what}s. Name one by its id:
 ${referenceLines(matches)}`
   );
@@ -24712,7 +25519,7 @@ function splitRefAtVersion(value) {
   const m = value.match(/^(.*)@(\d+)$/);
   if (!m) return { ref: value, version: void 0 };
   const version2 = Number(m[2]);
-  if (version2 < 1) throw new CliUsageError(`"${value}": a version is a whole number from 1.`);
+  if (version2 < 1) throw new CliUsageError2(`"${value}": a version is a whole number from 1.`);
   return { ref: m[1], version: version2 };
 }
 var PROVENANCE_KEY = "references";
@@ -25494,10 +26301,10 @@ function registerContentCommands(program2, io) {
 `);
     openInBrowser(io, url2);
   });
-  program2.command("agent-doc [id]").description(`Print a deck's ${AGENT_DOC_PATH} briefing (id defaults to the ${LINK_FILENAME} link in .)`).option("--at <version>", "read this version instead of the latest", (v) => parseInt(v, 10)).option("--out <file>", "write to a file instead of stdout").action(async (id, opts, cmd) => {
+  program2.command("agent-doc [id]").description(`Print a deck's ${AGENT_DOC_PATH} briefing (id defaults to the ${LINK_FILENAME} link in .)`).option("--at <version>", "read this version instead of the latest", (v) => parseInt(v, 10)).option("--out <file>", "write to a file instead of stdout").action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
-    let deckId = id ?? null;
+    let deckId = id2 ?? null;
     if (!deckId) {
       const link = await readLink(resolve6("."));
       if (!link) {
@@ -25533,13 +26340,13 @@ function registerContentCommands(program2, io) {
   });
   program2.command("pull [id] [path]").description(
     `Download a deck version to a folder (id defaults to the ${LINK_FILENAME} link in the target)`
-  ).option("--at <version>", "pull this version instead of the latest", (v) => parseInt(v, 10)).action(async (id, path, opts, cmd) => {
+  ).option("--at <version>", "pull this version instead of the latest", (v) => parseInt(v, 10)).action(async (id2, path, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     const linkMismatch = (linked) => new CliUsageError(
       `${LINK_FILENAME} links this folder to ${linked}, but you are pulling from ${ctx.baseUrl}. Pull into a different folder, or delete ${LINK_FILENAME} first.`
     );
-    let deckId = id ?? null;
+    let deckId = id2 ?? null;
     let dest = path ?? null;
     if (!deckId) {
       const link = await readLink(resolve6(dest ?? "."));
@@ -25578,10 +26385,10 @@ function registerContentCommands(program2, io) {
     );
   });
   program2.command("pull-annotations [id]").description(`List a deck's annotations (id defaults to the ${LINK_FILENAME} link in .)`).option("--version <n>", "only notes anchored to this version", (v) => parseInt(v, 10)).option("--status <status>", "open | resolved").option("--out <file>", "write the annotations as JSON to this file").action(
-    async (id, opts, cmd) => {
+    async (id2, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
-      let deckId = id ?? null;
+      let deckId = id2 ?? null;
       if (!deckId) {
         const link = await readLink(resolve6("."));
         if (!link) {
@@ -25632,10 +26439,10 @@ function registerContentCommands(program2, io) {
   );
   const annotation = program2.command("annotation").description("Update deck annotations (pull-annotations lists them)");
   annotation.command("resolve <id> <annotationId>").description("Mark an annotation resolved").action(
-    (id, annotationId, _opts, cmd) => setAnnotationStatus(cmd, io, id, annotationId, "resolved")
+    (id2, annotationId, _opts, cmd) => setAnnotationStatus(cmd, io, id2, annotationId, "resolved")
   );
   annotation.command("reopen <id> <annotationId>").description("Reopen a resolved annotation").action(
-    (id, annotationId, _opts, cmd) => setAnnotationStatus(cmd, io, id, annotationId, "open")
+    (id2, annotationId, _opts, cmd) => setAnnotationStatus(cmd, io, id2, annotationId, "open")
   );
   program2.command("dev [path]").description(
     "Serve the deck folder locally with the exact viewer sandbox headers + live reload (no backend)"
@@ -25964,10 +26771,10 @@ function openAfterPush(ctx, url2, input) {
   ctx.io.out.write("  opened in your browser (--no-open to skip)\n");
   openInBrowser(ctx.io, url2);
 }
-async function setAnnotationStatus(cmd, io, id, annotationId, status) {
+async function setAnnotationStatus(cmd, io, id2, annotationId, status) {
   const ctx = resolveContext(cmd, io);
   await requireApiKey(ctx);
-  const updated = await ctx.client.updateAnnotation(id, annotationId, { status });
+  const updated = await ctx.client.updateAnnotation(id2, annotationId, { status });
   if (ctx.json) return printJson2(io, updated);
   io.out.write(`Annotation ${updated.id} ${status === "resolved" ? "resolved" : "reopened"}.
 `);
@@ -25997,7 +26804,7 @@ function parseSetPair(pair) {
     return [key, raw];
   }
 }
-var collect2 = (value, all) => [...all, value];
+var collect3 = (value, all) => [...all, value];
 function registerDeckCommands(program2, io) {
   program2.command("list").description("List presentations (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).option("--project <id>", "only the decks in this project").action(
     async (opts, cmd) => {
@@ -26037,10 +26844,10 @@ function registerDeckCommands(program2, io) {
       }
     }
   );
-  program2.command("get <id>").description("Show one presentation (metadata + latest version)").action(async (id, _opts, cmd) => {
+  program2.command("get <id>").description("Show one presentation (metadata + latest version)").action(async (id2, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
-    const deck = await ctx.client.presentation(id);
+    const deck = await ctx.client.presentation(id2);
     if (ctx.json) return printJson2(io, deck);
     const metaKeys = Object.keys(deck.metadata);
     const references = provenanceOf(deck.metadata);
@@ -26065,9 +26872,9 @@ function registerDeckCommands(program2, io) {
   program2.command("meta <id>").description("Show or edit a deck's metadata object (the seam for building your own dashboard)").option(
     "--set <key=value>",
     "set one key (repeatable; values parse as JSON when valid, else string)",
-    collect2,
+    collect3,
     []
-  ).option("--unset <key>", "remove one key (repeatable)", collect2, []).option("--replace <object>", "replace the WHOLE metadata object with this JSON").action(async (id, opts, cmd) => {
+  ).option("--unset <key>", "remove one key (repeatable)", collect3, []).option("--replace <object>", "replace the WHOLE metadata object with this JSON").action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     const editing = opts.set.length > 0 || opts.unset.length > 0 || opts.replace !== void 0;
@@ -26075,7 +26882,7 @@ function registerDeckCommands(program2, io) {
       throw new CliUsageError("--replace cannot be combined with --set/--unset");
     }
     if (!editing) {
-      const deck = await ctx.client.presentation(id);
+      const deck = await ctx.client.presentation(id2);
       if (ctx.json) return printJson2(io, deck.metadata);
       io.out.write(`${JSON.stringify(deck.metadata, null, 2)}
 `);
@@ -26094,7 +26901,7 @@ function registerDeckCommands(program2, io) {
       }
       metadata = parsed;
     } else {
-      const deck = await ctx.client.presentation(id);
+      const deck = await ctx.client.presentation(id2);
       metadata = { ...deck.metadata };
       for (const pair of opts.set) {
         const [key, value] = parseSetPair(pair);
@@ -26102,7 +26909,7 @@ function registerDeckCommands(program2, io) {
       }
       for (const key of opts.unset) delete metadata[key];
     }
-    const updated = await ctx.client.updatePresentation(id, { metadata });
+    const updated = await ctx.client.updatePresentation(id2, { metadata });
     if (ctx.json) return printJson2(io, updated.metadata);
     io.out.write(
       `Updated metadata of "${updated.title}" (${Object.keys(updated.metadata).length} key(s)):
@@ -26110,18 +26917,18 @@ ${JSON.stringify(updated.metadata, null, 2)}
 `
     );
   });
-  program2.command("versions <id>").description("List a deck's version history (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (id, opts, cmd) => {
+  program2.command("versions <id>").description("List a deck's version history (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     const params = {};
     if (opts.cursor) params.cursor = opts.cursor;
     if (opts.limit !== void 0) params.limit = opts.limit;
-    const first = await ctx.client.presentationVersions(id, params);
+    const first = await ctx.client.presentationVersions(id2, params);
     const rows = [...first.versions];
     if (opts.all) {
       let cursor = first.nextCursor;
       while (cursor) {
-        const page = await ctx.client.presentationVersions(id, { ...params, cursor });
+        const page = await ctx.client.presentationVersions(id2, { ...params, cursor });
         rows.push(...page.versions);
         cursor = page.nextCursor;
       }
@@ -26148,10 +26955,10 @@ ${JSON.stringify(updated.metadata, null, 2)}
 `);
     }
   });
-  program2.command("delete <id>").description("Delete a presentation (soft delete; versions and share links stop resolving)").action(async (id, _opts, cmd) => {
+  program2.command("delete <id>").description("Delete a presentation (soft delete; versions and share links stop resolving)").action(async (id2, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
-    const deck = await ctx.client.deletePresentation(id);
+    const deck = await ctx.client.deletePresentation(id2);
     if (ctx.json) return printJson2(io, deck);
     io.out.write(`Deleted "${deck.title}" (${deck.id}).
 `);
@@ -26649,7 +27456,7 @@ function registerSharingCommands(program2, io) {
     "--placement <label>",
     "placement label baked into the embed snippets (per-view analytics dimension; slug of [A-Za-z0-9._-], max 64)"
   ).action(
-    async (id, opts, cmd) => {
+    async (id2, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
       if (opts.placement !== void 0 && !EMBED_PLACEMENT_RE.test(opts.placement)) {
@@ -26657,7 +27464,7 @@ function registerSharingCommands(program2, io) {
       }
       const password = await resolveSharePassword(io, opts);
       const created = await ctx.client.createShareToken(
-        id,
+        id2,
         shareOptionsOf({ ...opts, ...password !== void 0 ? { password } : {} })
       );
       const embed = buildEmbedSnippets({
@@ -26687,11 +27494,11 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
       }
     }
   );
-  program2.command("unshare <id>").description("Revoke one share token (--token) or ALL active tokens of the deck").option("--token <tokenId>", "revoke only this token").action(async (id, opts, cmd) => {
+  program2.command("unshare <id>").description("Revoke one share token (--token) or ALL active tokens of the deck").option("--token <tokenId>", "revoke only this token").action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     if (opts.token) {
-      const revoked2 = await ctx.client.revokeShareToken(id, opts.token);
+      const revoked2 = await ctx.client.revokeShareToken(id2, opts.token);
       if (ctx.json) return printJson2(io, revoked2);
       io.out.write(`Revoked share token ${revoked2.id} ("${revoked2.name}").
 `);
@@ -26700,10 +27507,10 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
     const revoked = [];
     let cursor = null;
     do {
-      const page = await ctx.client.shareTokens(id, cursor ? { cursor } : {});
+      const page = await ctx.client.shareTokens(id2, cursor ? { cursor } : {});
       for (const token of page.shareTokens) {
         if (!token.revokedAt) {
-          await ctx.client.revokeShareToken(id, token.id);
+          await ctx.client.revokeShareToken(id2, token.id);
           revoked.push(token.id);
         }
       }
@@ -26723,17 +27530,17 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
     `annotation badge slot (${BADGE_POSITIONS}); remembered as the deck default`,
     parseBadgePosition
   ).option("--expires <datetime>", "ISO expiry").option("--password <password>", `viewer password (tell recipients separately; or ${SHARE_PASSWORD_ENV})`).option("--password-stdin", "read the viewer password from stdin (keeps it out of argv)", false).option("--message <text>", "personal note included in the email").action(
-    async (id, opts, cmd) => {
+    async (id2, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
       const password = await resolveSharePassword(io, opts);
       const results = [];
       for (const email3 of opts.to) {
         const created = await ctx.client.createShareToken(
-          id,
+          id2,
           shareOptionsOf({ ...opts, name: email3, ...password !== void 0 ? { password } : {} })
         );
-        const sent = await ctx.client.sendShareToken(id, created.shareToken.id, {
+        const sent = await ctx.client.sendShareToken(id2, created.shareToken.id, {
           email: email3,
           ...opts.message ? { message: opts.message } : {}
         });
@@ -26746,14 +27553,14 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
     }
   );
   program2.command("pin <id> <tokenId>").description("Pin a share token to a version, or set it back to following the latest").option("--to-version <n>", "freeze the recipient on this version", (v) => parseInt(v, 10)).option("--latest", "follow the latest version again", false).action(
-    async (id, tokenId, opts, cmd) => {
+    async (id2, tokenId, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
       if (opts.latest === (opts.toVersion !== void 0)) {
         throw new CliUsageError("Pass exactly one of --to-version <n> or --latest.");
       }
       const patch = opts.toVersion !== void 0 ? { versionMode: "pinned", pinnedVersion: opts.toVersion } : { versionMode: "latest" };
-      const updated = await ctx.client.updateShareToken(id, tokenId, patch);
+      const updated = await ctx.client.updateShareToken(id2, tokenId, patch);
       if (ctx.json) return printJson2(io, updated);
       io.out.write(
         updated.versionMode === "pinned" ? `Token ${updated.id} pinned to v${updated.pinnedVersion}.
@@ -26762,18 +27569,18 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
       );
     }
   );
-  program2.command("tokens <id>").description("List a deck's share tokens with access stats (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (id, opts, cmd) => {
+  program2.command("tokens <id>").description("List a deck's share tokens with access stats (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     const params = {};
     if (opts.cursor) params.cursor = opts.cursor;
     if (opts.limit !== void 0) params.limit = opts.limit;
-    const first = await ctx.client.shareTokens(id, params);
+    const first = await ctx.client.shareTokens(id2, params);
     const rows = [...first.shareTokens];
     if (opts.all) {
       let cursor = first.nextCursor;
       while (cursor) {
-        const page = await ctx.client.shareTokens(id, { ...params, cursor });
+        const page = await ctx.client.shareTokens(id2, { ...params, cursor });
         rows.push(...page.shareTokens);
         cursor = page.nextCursor;
       }
@@ -26823,14 +27630,14 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
   program2.command("views <id> [tokenId]").description(
     "Per-view stats of a share link: when it was opened, the referring site, the ?p= placement label, and the browser family (no IPs, no full URLs \u2014 never stored). Omit tokenId to see which links exist."
   ).option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(
-    async (id, tokenId, opts, cmd) => {
+    async (id2, tokenId, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
       if (!tokenId) {
         const tokens = [];
         let cursor = opts.cursor ?? null;
         do {
-          const page = await ctx.client.shareTokens(id, cursor ? { cursor } : {});
+          const page = await ctx.client.shareTokens(id2, cursor ? { cursor } : {});
           tokens.push(...page.shareTokens);
           cursor = page.nextCursor;
         } while (cursor);
@@ -26849,19 +27656,19 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
             ])
           )
         );
-        io.out.write(`Pick one: slideless views ${id} <tokenId>
+        io.out.write(`Pick one: slideless views ${id2} <tokenId>
 `);
         return;
       }
       const params = {};
       if (opts.cursor) params.cursor = opts.cursor;
       if (opts.limit !== void 0) params.limit = opts.limit;
-      const first = await ctx.client.shareTokenViews(id, tokenId, params);
+      const first = await ctx.client.shareTokenViews(id2, tokenId, params);
       const rows = [...first.views];
       if (opts.all) {
         let cursor = first.nextCursor;
         while (cursor) {
-          const page = await ctx.client.shareTokenViews(id, tokenId, { ...params, cursor });
+          const page = await ctx.client.shareTokenViews(id2, tokenId, { ...params, cursor });
           rows.push(...page.views);
           cursor = page.nextCursor;
         }
@@ -26892,7 +27699,7 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
   program2.command("responses <id>").description(
     "A deck's embedded-form responses: what viewers submitted through share links and embeds, newest first. With no filters, prints the per-form summary (form, link, source, placement, count, last activity), then the most recent rows. Payload cells are the respondent's raw input."
   ).option("--form <name>", "only this form (the data-slideless-form name)").option("--link <tokenId>", "only responses that came through this share token").option("--source <source>", "only direct-link or embedded submissions (link | embed)").option("--placement <label>", "only responses whose serving document carried this ?p= label").option("--since <datetime>", "only responses created at or after this ISO instant").option("--csv", "output the listed rows as CSV (one column per payload field)", false).option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(
-    async (id, opts, cmd) => {
+    async (id2, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
       if (ctx.json && opts.csv) {
@@ -26918,12 +27725,12 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
       }
       const filtered = Boolean(opts.form || opts.link || opts.source || opts.placement || opts.since);
       const fetchRows = async () => {
-        const first = await ctx.client.formResponses(id, params);
+        const first = await ctx.client.formResponses(id2, params);
         const rows2 = [...first.responses];
         if (opts.all) {
           let cursor = first.nextCursor;
           while (cursor) {
-            const page = await ctx.client.formResponses(id, { ...params, cursor });
+            const page = await ctx.client.formResponses(id2, { ...params, cursor });
             rows2.push(...page.responses);
             cursor = page.nextCursor;
           }
@@ -26949,7 +27756,7 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
 `);
         return;
       }
-      const summary = await ctx.client.formResponsesSummary(id);
+      const summary = await ctx.client.formResponsesSummary(id2);
       if (summary.total === 0 && !ctx.json) {
         io.out.write(
           'No form responses yet. Forms are <form data-slideless-form="name"> elements in the deck HTML.\n'
@@ -26980,17 +27787,17 @@ Password-protected links do not render inside embeds; docs: sharing/embedding.
       }
       io.out.write(
         `
-Slice: slideless responses ${id} --form <name> [--link <tokenId>] [--source link|embed] [--placement <label>] [--since <ISO>]; export with --csv
+Slice: slideless responses ${id2} --form <name> [--link <tokenId>] [--source link|embed] [--placement <label>] [--since <ISO>]; export with --csv
 `
       );
     }
   );
   program2.command("response <id> <responseId>").description(
     "One form response with its edit history (PRDCT-2329): the current answer, then every kept revision newest first, with the link and the moment each was written through."
-  ).action(async (id, responseId, _opts, cmd) => {
+  ).action(async (id2, responseId, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
-    const detail = await ctx.client.formResponse(id, responseId);
+    const detail = await ctx.client.formResponse(id2, responseId);
     if (ctx.json) return printJson2(io, detail);
     const r = detail.response;
     io.out.write(
@@ -27005,7 +27812,7 @@ Slice: slideless responses ${id} --form <name> [--link <tokenId>] [--source link
 Files (${files.length}):
 `);
       io.out.write(table(files.map((f) => [`  ${f.field}`, f.name, fmtBytes(f.sizeBytes), f.id])));
-      io.out.write(`  Download them: slideless response-files ${id} ${r.id}
+      io.out.write(`  Download them: slideless response-files ${id2} ${r.id}
 `);
     }
     io.out.write(
@@ -27031,17 +27838,17 @@ History (${detail.versions.length} revision${detail.versions.length === 1 ? "" :
   });
   program2.command("uploads <id> <tokenId>").description(
     "Show or switch file uploads on one EXISTING share link (PRDCT-2403): whether its respondents may upload files into the deck's form file fields. A new link has them on; a link minted before file fields existed has them off until its owner turns them on here."
-  ).option("--on", "let respondents on this link upload files into form file fields", false).option("--off", "refuse file uploads through this link (the rest of the form still submits)", false).action(async (id, tokenId, opts, cmd) => {
+  ).option("--on", "let respondents on this link upload files into form file fields", false).option("--off", "refuse file uploads through this link (the rest of the form still submits)", false).action(async (id2, tokenId, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     if (opts.on && opts.off) throw new CliUsageError("Pass either --on or --off, not both.");
     let token;
     if (opts.on || opts.off) {
-      token = await ctx.client.updateShareToken(id, tokenId, { canUploadFiles: opts.on });
+      token = await ctx.client.updateShareToken(id2, tokenId, { canUploadFiles: opts.on });
     } else {
       let cursor = null;
       do {
-        const page = await ctx.client.shareTokens(id, { limit: 100, ...cursor ? { cursor } : {} });
+        const page = await ctx.client.shareTokens(id2, { limit: 100, ...cursor ? { cursor } : {} });
         token = page.shareTokens.find((t) => t.id === tokenId);
         cursor = token ? null : page.nextCursor;
       } while (cursor);
@@ -27063,17 +27870,17 @@ History (${detail.versions.length} revision${detail.versions.length === 1 ? "" :
   });
   program2.command("pdf <id> <tokenId>").description(
     "Show or switch the PDF export on one EXISTING share link: whether its recipient sees an Export PDF action in the viewer's bar, printed by their browser. A new link has it on; a link minted before the switch existed has it off until its owner turns it on here."
-  ).option("--on", "let the recipient export the deck to PDF from the viewer", false).option("--off", "remove the Export PDF action from this link", false).action(async (id, tokenId, opts, cmd) => {
+  ).option("--on", "let the recipient export the deck to PDF from the viewer", false).option("--off", "remove the Export PDF action from this link", false).action(async (id2, tokenId, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     if (opts.on && opts.off) throw new CliUsageError("Pass either --on or --off, not both.");
     let token;
     if (opts.on || opts.off) {
-      token = await ctx.client.updateShareToken(id, tokenId, { canExportPdf: opts.on });
+      token = await ctx.client.updateShareToken(id2, tokenId, { canExportPdf: opts.on });
     } else {
       let cursor = null;
       do {
-        const page = await ctx.client.shareTokens(id, { limit: 100, ...cursor ? { cursor } : {} });
+        const page = await ctx.client.shareTokens(id2, { limit: 100, ...cursor ? { cursor } : {} });
         token = page.shareTokens.find((t) => t.id === tokenId);
         cursor = token ? null : page.nextCursor;
       } while (cursor);
@@ -27090,11 +27897,11 @@ History (${detail.versions.length} revision${detail.versions.length === 1 ? "" :
   });
   program2.command("notify <id>").description(
     "Show or switch the owner mails for form responses on one deck (PRDCT-2330): a mail when a response arrives, another when one is edited; on by default"
-  ).option("--on", "mail the deck owner on new and edited responses", false).option("--off", "stop mailing the deck owner about responses (forms stay on)", false).action(async (id, opts, cmd) => {
+  ).option("--on", "mail the deck owner on new and edited responses", false).option("--off", "stop mailing the deck owner about responses (forms stay on)", false).action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
     if (opts.on && opts.off) throw new CliUsageError("Pass either --on or --off, not both.");
-    const deck = opts.on || opts.off ? await ctx.client.updatePresentation(id, { notifyOnResponse: opts.on }) : await ctx.client.presentation(id);
+    const deck = opts.on || opts.off ? await ctx.client.updatePresentation(id2, { notifyOnResponse: opts.on }) : await ctx.client.presentation(id2);
     if (ctx.json) return printJson2(io, { notifyOnResponse: deck.notifyOnResponse });
     io.out.write(
       deck.notifyOnResponse ? `Response mails are ON for "${deck.title}": the owner is mailed on a new response and on an edit.
@@ -27102,10 +27909,10 @@ History (${detail.versions.length} revision${detail.versions.length === 1 ? "" :
 `
     );
   });
-  program2.command("invite <id>").description("Invite a dev collaborator to one deck (prints the claim link)").requiredOption("--email <email>", "invitee email").action(async (id, opts, cmd) => {
+  program2.command("invite <id>").description("Invite a dev collaborator to one deck (prints the claim link)").requiredOption("--email <email>", "invitee email").action(async (id2, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
-    const invited = await ctx.client.inviteCollaborator(id, { email: opts.email });
+    const invited = await ctx.client.inviteCollaborator(id2, { email: opts.email });
     if (ctx.json) return printJson2(io, invited);
     io.out.write(
       `Invited ${opts.email} as a dev collaborator (grant ${invited.collaborator.id}).
@@ -27114,10 +27921,10 @@ History (${detail.versions.length} revision${detail.versions.length === 1 ? "" :
 `
     );
   });
-  program2.command("uninvite <id> <collaboratorId>").description("Revoke a collaborator grant (pending or active)").action(async (id, collaboratorId, _opts, cmd) => {
+  program2.command("uninvite <id> <collaboratorId>").description("Revoke a collaborator grant (pending or active)").action(async (id2, collaboratorId, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
     await requireApiKey(ctx);
-    const revoked = await ctx.client.removeCollaborator(id, collaboratorId);
+    const revoked = await ctx.client.removeCollaborator(id2, collaboratorId);
     if (ctx.json) return printJson2(io, revoked);
     io.out.write(`Revoked collaborator grant ${revoked.id} (${revoked.email}).
 `);
@@ -27288,7 +28095,7 @@ function registerResponseFilesCommand(program2, io) {
     "--zip [path]",
     "stream the server's zip to disk instead (default: the server's file name, in the current directory)"
   ).action(
-    async (id, responseId, opts, cmd) => {
+    async (id2, responseId, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
       await requireApiKey(ctx);
       if (opts.out !== void 0 && opts.zip !== void 0) {
@@ -27316,15 +28123,15 @@ function registerResponseFilesCommand(program2, io) {
         filters.since = new Date(opts.since).toISOString();
       }
       if (opts.zip !== void 0) {
-        return zipMode(ctx, io, id, responseId, filters, opts.zip);
+        return zipMode(ctx, io, id2, responseId, filters, opts.zip);
       }
       const responses = [];
       if (responseId !== void 0) {
-        responses.push((await ctx.client.formResponse(id, responseId)).response);
+        responses.push((await ctx.client.formResponse(id2, responseId)).response);
       } else {
         let cursor = null;
         do {
-          const page = await ctx.client.formResponses(id, {
+          const page = await ctx.client.formResponses(id2, {
             ...filters,
             limit: 100,
             ...cursor ? { cursor } : {}
@@ -27335,7 +28142,7 @@ function registerResponseFilesCommand(program2, io) {
       }
       const planned = plan(responses, responseId !== void 0);
       const root = resolve8(
-        opts.out ?? (responseId !== void 0 ? `response-files-${safePathSegment(responseId.slice(0, 8))}` : `form-files-${safePathSegment(id.slice(0, 8))}`)
+        opts.out ?? (responseId !== void 0 ? `response-files-${safePathSegment(responseId.slice(0, 8))}` : `form-files-${safePathSegment(id2.slice(0, 8))}`)
       );
       if (planned.length === 0) {
         if (ctx.json) return printJson2(io, { mode: "folder", path: null, files: [], totalBytes: 0 });
@@ -27346,7 +28153,7 @@ function registerResponseFilesCommand(program2, io) {
       }
       const written = [];
       for (const p of planned) {
-        const path = await downloadInto(ctx, id, root, p);
+        const path = await downloadInto(ctx, id2, root, p);
         written.push({
           responseId: p.response.id,
           formName: p.response.formName,
@@ -27378,10 +28185,10 @@ function registerResponseFilesCommand(program2, io) {
     }
   );
 }
-async function zipMode(ctx, io, id, responseId, filters, zip) {
+async function zipMode(ctx, io, id2, responseId, filters, zip) {
   let res;
   try {
-    res = responseId !== void 0 ? await ctx.client.downloadFormResponseFilesZip(id, responseId) : await ctx.client.downloadFormResponsesFilesZip(id, filters);
+    res = responseId !== void 0 ? await ctx.client.downloadFormResponseFilesZip(id2, responseId) : await ctx.client.downloadFormResponsesFilesZip(id2, filters);
   } catch (e) {
     if (e instanceof PlatformApiError && e.code === "no_files") {
       if (ctx.json) return printJson2(io, { mode: "zip", path: null, sizeBytes: 0 });
@@ -27407,7 +28214,7 @@ async function zipMode(ctx, io, id, responseId, filters, zip) {
     sizeBytes = (await stat6(path)).size;
   } else {
     const served = contentDispositionName(res.headers.get("content-disposition"));
-    const fallback = `form-files-${safePathSegment((responseId ?? id).slice(0, 8))}.zip`;
+    const fallback = `form-files-${safePathSegment((responseId ?? id2).slice(0, 8))}.zip`;
     let name = served ? safePathSegment(served) : fallback;
     if (name === "_") name = fallback;
     if (!/\.zip$/i.test(name)) name = `${name}.zip`;
@@ -27419,7 +28226,7 @@ async function zipMode(ctx, io, id, responseId, filters, zip) {
 }
 
 // src/index.ts
-var VERSION = "0.13.7";
+var VERSION = "0.13.9";
 function registerTool(program2, io) {
   registerDeckCommands(program2, io);
   registerContentCommands(program2, io);