@automagik/omni 2.260910.16 → 2.260910.17

package/dist/index.js

@@ -137198,7 +137198,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260910.16",
+  version: "2.260910.17",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",
@@ -150668,2282 +150668,2673 @@ function createSlackCommand() {
   return cmd;
 }
 
-// src/commands/speak.ts
-import { writeFile as writeFile2 } from "fs/promises";
+// src/commands/sources.ts
+import { randomBytes as randomBytes4 } from "crypto";
+init_config();
 init_output();
-var ALLOWED_FORMATS2 = ["mp3", "ogg", "opus", "wav", "pcm", "flac", "aac"];
-function parseFormat2(value) {
-  if (!value)
-    return;
-  const normalized = value.toLowerCase();
-  if (!ALLOWED_FORMATS2.includes(normalized)) {
-    error(`Invalid --format "${value}". Allowed: ${ALLOWED_FORMATS2.join(", ")}`);
-  }
-  return normalized;
-}
-function parseSpeed(value) {
-  if (value === undefined)
-    return;
-  const n2 = Number.parseFloat(value);
-  if (Number.isNaN(n2) || n2 < 0.5 || n2 > 2) {
-    error(`Invalid --speed "${value}". Must be a number between 0.5 and 2.0.`);
-  }
-  return n2;
-}
-function createSpeakCommand() {
-  return new Command("speak").description("Synthesize text to speech and send as a voice note (or save with --output)").argument("<text>", "Text to convert to speech").option("--provider <name>", "TTS provider (gemini, openai, elevenlabs). Default: server config.").option("--model <model>", "TTS model override (provider-specific)").option("--voice <name>", "Voice identifier (e.g. Kore for Gemini, JBFqn... for ElevenLabs)").option("--style <prompt>", 'Style prompt prepended to text (Gemini only, e.g. "Say cheerfully")').option("--instructions <text>", "Provider-native speaking instructions").option("--tone <text>", "Tone guidance").option("--accent <text>", "Accent guidance").option("--pace <text>", "Pace guidance").option("--emotion <text>", "Emotion guidance").option("--voice-note-profile <name>", "Voice-note profile/preset name").option("--language <code>", "BCP-47 language code (e.g. en-US, pt-BR)").option("--speed <factor>", "Speaking speed multiplier 0.5-2.0 (provider-dependent)").option("--format <fmt>", `Audio format: ${ALLOWED_FORMATS2.join(", ")} (default: ogg)`).option("--output <path>", "Save audio to file instead of sending").option("--instance <id>", "Override instance (default: from context)").option("--chat <id>", "Override chat (default: from context)").action(async (text3, options3) => {
-    const client = getClient();
-    const format = parseFormat2(options3.format);
-    const speed = parseSpeed(options3.speed);
-    let audioBuffer;
-    let mimeType;
-    let durationMs;
-    let providerName;
-    try {
-      const result = await client.media.tts({
-        text: text3,
-        provider: options3.provider,
-        voice: options3.voice,
-        language: options3.language,
-        speed,
-        format,
-        style: options3.style,
-        model: options3.model,
-        instructions: options3.instructions,
-        tone: options3.tone,
-        accent: options3.accent,
-        pace: options3.pace,
-        emotion: options3.emotion,
-        voiceNoteProfile: options3.voiceNoteProfile
-      });
-      audioBuffer = result.audio;
-      mimeType = result.mimeType;
-      durationMs = result.durationMs;
-      providerName = result.provider;
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      return error(`TTS synthesis failed: ${message2}`);
-    }
-    if (options3.output) {
-      try {
-        await writeFile2(options3.output, audioBuffer);
-        return success("Audio saved", {
-          path: options3.output,
-          provider: providerName,
-          mimeType,
-          durationMs,
-          sizeKb: Math.round(audioBuffer.length / 1024 * 100) / 100
-        });
-      } catch (err2) {
-        const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-        return error(`Failed to write ${options3.output}: ${message2}`);
+// src/commands/sources/github/custom.github.issues.json
+var custom_github_issues_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.issues",
+  description: "GitHub issues webhook delivery (X-GitHub-Event: issues). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["action", "issue", "repository", "sender"],
+  properties: {
+    action: {
+      type: "string",
+      description: "What happened: opened, closed, edited, labeled, ..."
+    },
+    issue: {
+      type: "object",
+      additionalProperties: true,
+      required: ["number"],
+      properties: {
+        number: { type: "integer", description: "Issue number" },
+        title: { type: "string" },
+        state: { type: "string" },
+        html_url: { type: "string" }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
       }
     }
-    const ctx = await resolveContext({
-      instance: options3.instance,
-      chat: options3.chat
-    });
-    if (!ctx.instanceId) {
-      return error("No instance in context. Set OMNI_INSTANCE, use --instance, run: omni use <instance>, or pass --output to save.");
+  }
+};
+// src/commands/sources/github/custom.github.pull_request.json
+var custom_github_pull_request_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.pull_request",
+  description: "GitHub pull_request webhook delivery (X-GitHub-Event: pull_request). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["action", "number", "repository", "sender"],
+  properties: {
+    action: {
+      type: "string",
+      description: "What happened: opened, closed, synchronize, reopened, ..."
+    },
+    number: {
+      type: "integer",
+      description: "Pull request number"
+    },
+    pull_request: {
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        title: { type: "string" },
+        state: { type: "string" },
+        merged: { type: "boolean" },
+        html_url: { type: "string" }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
     }
-    if (!ctx.chatId) {
-      return error("No chat in context. Set OMNI_CHAT, use --chat, run: omni open <contact>, or pass --output to save.");
+  }
+};
+// src/commands/sources/github/custom.github.push.json
+var custom_github_push_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.push",
+  description: "GitHub push webhook delivery (X-GitHub-Event: push). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["ref", "repository", "sender"],
+  properties: {
+    ref: {
+      type: "string",
+      description: "Full git ref that was pushed, e.g. refs/heads/main"
+    },
+    before: {
+      type: "string",
+      description: "SHA of the most recent commit on ref before the push"
+    },
+    after: {
+      type: "string",
+      description: "SHA of the most recent commit on ref after the push"
+    },
+    commits: {
+      type: "array",
+      description: "Commits in the push (GitHub caps this at 2048 entries)",
+      items: {
+        type: "object",
+        additionalProperties: true,
+        properties: {
+          id: { type: "string" },
+          message: { type: "string" },
+          url: { type: "string" }
+        }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
     }
-    try {
-      const result = await client.messages.sendMedia({
-        instanceId: ctx.instanceId,
-        to: ctx.chatId,
-        type: "audio",
-        base64: audioBuffer.toString("base64"),
-        filename: pickFilename(mimeType, providerName),
-        voiceNote: true
-      });
-      success("Voice note sent", {
-        provider: providerName,
-        durationMs,
-        sizeKb: Math.round(audioBuffer.length / 1024 * 100) / 100,
-        ...result
-      });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to send voice note: ${message2}`);
+  }
+};
+// src/commands/sources/github/custom.github.release.json
+var custom_github_release_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.release",
+  description: "GitHub release webhook delivery (X-GitHub-Event: release). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["action", "release", "repository", "sender"],
+  properties: {
+    action: {
+      type: "string",
+      description: "What happened: published, created, edited, released, ..."
+    },
+    release: {
+      type: "object",
+      additionalProperties: true,
+      required: ["tag_name"],
+      properties: {
+        tag_name: { type: "string", description: "Git tag of the release, e.g. v2.260907.4" },
+        name: { type: "string" },
+        draft: { type: "boolean" },
+        prerelease: { type: "boolean" },
+        html_url: { type: "string" }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
     }
-  });
-}
-function pickFilename(mimeType, provider) {
-  const lower = mimeType.toLowerCase();
-  if (lower.includes("ogg") || lower.includes("opus"))
-    return `${provider}-speak.ogg`;
-  if (lower.includes("wav"))
-    return `${provider}-speak.wav`;
-  if (lower.includes("mp3") || lower.includes("mpeg"))
-    return `${provider}-speak.mp3`;
-  if (lower.includes("flac"))
-    return `${provider}-speak.flac`;
-  if (lower.includes("aac") || lower.includes("m4a"))
-    return `${provider}-speak.m4a`;
-  return `${provider}-speak.bin`;
-}
+  }
+};
 
-// src/commands/start.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync11 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join17 } from "path";
-init_config();
-init_embedded_canonical_migration();
+// src/commands/webhooks.ts
+import { readFileSync as readFileSync18 } from "fs";
+init_zod();
 init_output();
-var START_HEALTH_TIMEOUT_MS = 1e4;
-function legacyEmbeddedNeedsMigration(useCanonicalPgserve, embeddedDataPresent = existsSync18(join17(EMBEDDED_PGSERVE_DATA_DIR, "PG_VERSION"))) {
-  return useCanonicalPgserve !== true && embeddedDataPresent;
-}
-async function runStart() {
-  if (!await isPm2Available()) {
-    pm2NotFoundError();
-  }
-  const bundlePath = getServerBundlePath();
-  if (!existsSync18(bundlePath)) {
-    bundleNotFoundError(bundlePath);
+var SIGNATURE_ALGORITHMS = ["hmac-sha256", "hmac-sha1", "token-match"];
+var signatureSecretSchema = exports_external.string().min(8, "at least 8 characters").max(512, "at most 512 characters");
+var SECRET_SOURCE_FLAGS = "--signature-secret, --signature-secret-env, --signature-secret-stdin";
+async function readSecretFromStdin() {
+  if (process.stdin.isTTY) {
+    throw new Error('--signature-secret-stdin requires piped stdin (e.g. `printf %s "$SECRET" | omni webhooks ...`)');
   }
-  const serverConfig = loadServerConfig();
-  const apiPort = serverConfig.port;
-  if (legacyEmbeddedNeedsMigration(serverConfig.useCanonicalPgserve)) {
-    const major = readDataDirMajor(EMBEDDED_PGSERVE_DATA_DIR);
-    error(`Legacy embedded pgserve detected \u2014 this omni build does not run an embedded Postgres.
-  Embedded data dir: ${EMBEDDED_PGSERVE_DATA_DIR}${major ? ` (PostgreSQL ${major})` : ""}
-  Your data is intact. Migrate to canonical pgserve first:
-      omni doctor --fix
-  (idempotent \u2014 preserves data; do not \`omni start\` until it completes).`, undefined, 1);
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
   }
-  mkdirSync11(getPm2LogDir(), { recursive: true });
-  info(`Starting ${PM2_PROCESSES.api} (port ${apiPort})...`);
-  const cliConfig = loadLocalRuntimeConfig();
-  const env2 = buildRuntimeEnv(serverConfig, cliConfig);
-  const launcherPath = getServerLauncherPath();
-  const apiArgs = buildPm2StartArgs({
-    kind: "api",
-    script: launcherPath,
-    name: PM2_PROCESSES.api,
-    interpreter: "bash"
-  });
-  const apiCode = await runPm2(apiArgs, env2);
-  if (apiCode !== 0) {
-    error(`Failed to start ${PM2_PROCESSES.api} (pm2 exit code ${apiCode})`, undefined, 1);
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function resolveSignatureSecret(options3, readStdin = readSecretFromStdin) {
+  const sources = [
+    options3.signatureSecret !== undefined,
+    options3.signatureSecretEnv !== undefined,
+    options3.signatureSecretStdin === true
+  ].filter(Boolean).length;
+  if (sources === 0)
     return;
+  if (sources > 1) {
+    throw new Error(`Use only one of ${SECRET_SOURCE_FLAGS}`);
   }
-  const natsPath = join17(homedir12(), ".omni", "nats-server");
-  if (existsSync18(natsPath)) {
-    info(`Starting ${PM2_PROCESSES.nats}...`);
-    const natsDataDir = join17(serverConfig.dataDir, "nats");
-    mkdirSync11(natsDataDir, { recursive: true });
-    const natsArgs = buildPm2StartArgs({
-      kind: "nats",
-      script: natsPath,
-      name: PM2_PROCESSES.nats,
-      scriptArgs: ["-js", "-sd", natsDataDir]
-    });
-    const natsCode = await runPm2(natsArgs);
-    if (natsCode !== 0) {
-      warn(`${PM2_PROCESSES.nats} failed to start \u2014 run 'omni install' to download NATS first`);
+  let raw2;
+  let origin;
+  if (options3.signatureSecretEnv !== undefined) {
+    const name = options3.signatureSecretEnv;
+    if (!name)
+      throw new Error("--signature-secret-env requires a variable name");
+    raw2 = process.env[name];
+    origin = `environment variable ${name}`;
+    if (raw2 === undefined || raw2 === "") {
+      throw new Error(`${origin} is not set or empty`);
     }
+  } else if (options3.signatureSecretStdin) {
+    raw2 = (await readStdin()).replace(/\r?\n$/, "");
+    origin = "stdin";
+    if (!raw2)
+      throw new Error("no secret received on stdin");
   } else {
-    warn(`NATS binary not found at ${natsPath} \u2014 skipping. Run 'omni install' to set it up.`);
+    raw2 = options3.signatureSecret;
+    origin = "--signature-secret";
   }
-  const healthUrl = getHealthCheckUrl(apiPort);
-  info(`Waiting for health check at ${healthUrl}...`);
-  const healthy = await waitForHealth(apiPort, START_HEALTH_TIMEOUT_MS);
-  if (healthy) {
-    success(`Server is healthy at ${healthUrl}`);
-  } else {
-    warn(`Health check did not pass within ${START_HEALTH_TIMEOUT_MS / 1000}s \u2014 server may still be starting`);
+  const parsed = signatureSecretSchema.safeParse(raw2);
+  if (!parsed.success) {
+    const reason = parsed.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid signature secret from ${origin}: ${reason}`);
   }
+  return parsed.data;
 }
-function createStartCommand() {
-  return new Command("start").description("Start API and NATS via PM2").action(runStart);
-}
-
-// src/commands/status.ts
-init_config();
-init_output();
-function formatUptime(ms) {
-  if (ms === undefined || ms === 0)
-    return "-";
-  const seconds = Math.floor(ms / 1000);
-  if (seconds < 60)
-    return `${seconds}s`;
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60)
-    return `${minutes}m`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24)
-    return `${hours}h`;
-  const days = Math.floor(hours / 24);
-  return `${days}d`;
-}
-function formatMemory(bytes) {
-  if (bytes === undefined || bytes === 0)
-    return "-";
-  return `${Math.round(bytes / 1024 / 1024)}MB`;
-}
-async function getProcessStatus() {
-  if (!await isPm2Available()) {
-    return null;
+function buildSignatureConfig(options3) {
+  const { signatureAlgorithm, signatureHeader, signaturePrefix } = options3;
+  if (!signatureAlgorithm && !signatureHeader && !signaturePrefix)
+    return;
+  if (!signatureAlgorithm || !signatureHeader) {
+    error("--signature-algorithm and --signature-header must be provided together");
   }
-  const { code, stdout } = await capturePm2("jlist");
-  if (code !== 0) {
-    return null;
+  const algorithm = SIGNATURE_ALGORITHMS.find((a2) => a2 === signatureAlgorithm);
+  if (!algorithm) {
+    error(`Invalid --signature-algorithm; expected one of: ${SIGNATURE_ALGORITHMS.join(", ")}`);
   }
-  let processes = [];
-  try {
-    processes = JSON.parse(stdout);
-  } catch {
-    return null;
+  if (algorithm === "token-match" && signaturePrefix) {
+    error("--signature-prefix is not applicable to token-match (the header carries the secret verbatim)");
   }
-  const omniProcesses = processes.filter((p11) => typeof p11.name === "string" && p11.name.startsWith("omni-"));
-  return omniProcesses.map((p11) => ({
-    service: p11.name ?? "-",
-    pid: p11.pid !== undefined ? String(p11.pid) : "-",
-    status: p11.pm2_env?.status ?? "-",
-    uptime: p11.pm2_env?.pm_uptime ? formatUptime(Date.now() - p11.pm2_env.pm_uptime) : "-",
-    cpu: p11.monit?.cpu !== undefined ? `${p11.monit.cpu}%` : "-",
-    memory: formatMemory(p11.monit?.memory)
-  }));
+  return { algorithm, header: signatureHeader, prefix: signaturePrefix };
 }
-async function checkApiHealth(statusInfo, apiUrl) {
-  try {
-    const response = await fetch(`${apiUrl.replace(/\/$/, "")}/api/v2/health`, {
-      headers: {
-        "Accept-Encoding": "identity",
-        [CLI_VERSION_HEADER]: VERSION
-      }
-    });
-    const health = await response.json();
-    statusInfo.apiStatus = health.status ?? "unknown";
-    statusInfo.apiVersion = health.version;
-    if (health.checks) {
-      statusInfo.checks = health.checks;
+var eventTypeMappingSchema = exports_external.discriminatedUnion("source", [
+  exports_external.object({
+    source: exports_external.literal("header"),
+    header: exports_external.string().min(1, "header must be 1-200 characters").max(200, "header must be 1-200 characters")
+  }),
+  exports_external.object({
+    source: exports_external.literal("body"),
+    path: exports_external.string().min(1, "path must be 1-200 characters").max(200, "path must be 1-200 characters")
+  })
+]);
+var EVENT_TYPE_MAPPING_HINT = 'expected {"source":"header","header":"X-GitHub-Event"} or {"source":"body","path":"event"}';
+function resolveEventTypeMapping(raw2) {
+  if (raw2 === undefined)
+    return;
+  let text3 = raw2;
+  if (raw2.startsWith("@")) {
+    const path = raw2.slice(1);
+    try {
+      text3 = readFileSync18(path, "utf-8");
+    } catch (err2) {
+      const reason = err2 instanceof Error ? err2.message : "Unknown error";
+      throw new Error(`Cannot read --event-type-mapping file '${path}': ${reason}`);
     }
-    return response.headers.get(SERVER_VERSION_HEADER);
-  } catch (err2) {
-    statusInfo.apiStatus = "unreachable";
-    statusInfo.apiError = err2 instanceof Error ? err2.message : "Unknown error";
-    return null;
   }
-}
-async function validateAuthKey(statusInfo, client) {
+  let parsed;
   try {
-    const auth = await client.auth.validate();
-    statusInfo.keyValid = auth.valid;
-    statusInfo.keyName = auth.keyName;
-    statusInfo.keyPrefix = auth.keyPrefix;
-    statusInfo.scopes = auth.scopes;
-    Object.assign(statusInfo, credentialStatusFields(auth));
-    Object.assign(statusInfo, serverPostureFields(auth));
+    parsed = JSON.parse(text3);
   } catch {
-    statusInfo.keyValid = false;
+    throw new Error(`Invalid JSON for --event-type-mapping; ${EVENT_TYPE_MAPPING_HINT}`);
+  }
+  const result = eventTypeMappingSchema.safeParse(parsed);
+  if (!result.success) {
+    const reason = result.error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+    throw new Error(`Invalid --event-type-mapping: ${reason}; ${EVENT_TYPE_MAPPING_HINT}`);
   }
+  return result.data;
 }
-async function collectStatusInfo() {
-  const config2 = loadConfig();
-  const isAuthenticated = hasAuth();
-  const apiUrl = config2.apiUrl ?? "http://localhost:8882";
-  const statusInfo = {
-    configDir: getConfigDir(),
-    apiUrl,
-    authenticated: isAuthenticated,
-    defaultInstance: config2.defaultInstance ?? "-",
-    format: config2.format ?? "auto (TTY detection)"
-  };
-  const serverVersion = await checkApiHealth(statusInfo, apiUrl);
-  if (isAuthenticated) {
-    const client = getOptionalClient();
-    if (client) {
-      await validateAuthKey(statusInfo, client);
-    }
+async function buildUpdateSourcePatch(options3) {
+  const updates = buildLifecycleUpdates(options3);
+  if (options3.name)
+    updates.name = options3.name;
+  if (options3.description)
+    updates.description = options3.description;
+  if (options3.idempotencyKeyTemplate)
+    updates.idempotencyKeyTemplate = options3.idempotencyKeyTemplate;
+  if (options3.strictSchemas !== undefined)
+    updates.strictSchemas = options3.strictSchemas;
+  if (options3.clearEventTypeMapping && options3.eventTypeMapping !== undefined) {
+    throw new Error("Use only one of --event-type-mapping and --clear-event-type-mapping");
   }
-  const processes = await getProcessStatus();
-  if (processes !== null) {
-    statusInfo.processes = processes;
+  if (options3.clearEventTypeMapping)
+    updates.eventTypeMapping = null;
+  const eventTypeMapping = resolveEventTypeMapping(options3.eventTypeMapping);
+  if (eventTypeMapping !== undefined)
+    updates.eventTypeMapping = eventTypeMapping;
+  if (options3.enable)
+    updates.enabled = true;
+  if (options3.disable)
+    updates.enabled = false;
+  if (options3.clearSignature) {
+    updates.signatureConfig = null;
+    return updates;
   }
-  return { statusInfo, serverVersion, processes };
+  const signatureConfig = buildSignatureConfig(options3);
+  if (signatureConfig)
+    updates.signatureConfig = signatureConfig;
+  const signatureSecret = await resolveSignatureSecret(options3);
+  if (signatureSecret)
+    updates.signatureSecret = signatureSecret;
+  return updates;
 }
-function renderHumanExtras(serverVersion, processes) {
-  if (serverVersion) {
-    raw(formatStatusVersionHint(VERSION, serverVersion));
+function assertPairedSignatureOnCreate(signatureConfig, signatureSecret) {
+  if (signatureConfig === undefined === (signatureSecret === undefined))
+    return;
+  if (signatureConfig === undefined) {
+    throw new Error(`a signature secret (${SECRET_SOURCE_FLAGS}) requires --signature-algorithm and --signature-header`);
   }
-  if (processes !== null && processes.length > 0) {
-    header("Services");
-    list(processes);
-  } else if (processes !== null) {
-    header("Services");
-    dim("No omni services running. Start with: omni start");
+  throw new Error(`--signature-algorithm and --signature-header require a signature secret (${SECRET_SOURCE_FLAGS})`);
+}
+var WINDOW_SEMANTICS = ["future_only", "includes_in_progress"];
+var MUTATION_POLICIES = ["same_id", "new_id"];
+function parseExpectedInterval(raw2) {
+  if (raw2 === undefined)
+    return;
+  const seconds = Number(raw2);
+  if (!Number.isInteger(seconds) || seconds < 1) {
+    error("--expected-interval must be a positive integer number of seconds");
   }
+  return seconds;
 }
-function createStatusCommand() {
-  const status = new Command("status").description("Show API health and connection info").action(async () => {
-    const { statusInfo, serverVersion, processes } = await collectStatusInfo();
-    data(statusInfo);
-    if (getCurrentFormat() === "human") {
-      renderHumanExtras(serverVersion, processes);
-    }
-  });
-  return status;
+function parseWindowSemantics(raw2) {
+  if (raw2 === undefined)
+    return;
+  const value = WINDOW_SEMANTICS.find((v4) => v4 === raw2);
+  if (!value) {
+    error(`Invalid --window-semantics; expected one of: ${WINDOW_SEMANTICS.join(", ")}`);
+  }
+  return value;
 }
-
-// src/commands/stop.ts
-init_output();
-var LEGACY_PROCESSES = ["omni-v2-api", "omni-v2-nats"];
-async function runStop() {
-  if (!await isPm2Available()) {
-    pm2NotFoundError();
-  }
-  info("Stopping omni services...");
-  for (const name of Object.values(PM2_PROCESSES)) {
-    await runPm2(["delete", name]);
+function parseMutationPolicy(raw2) {
+  if (raw2 === undefined)
+    return;
+  const value = MUTATION_POLICIES.find((v4) => v4 === raw2);
+  if (!value) {
+    error(`Invalid --mutation-policy; expected one of: ${MUTATION_POLICIES.join(", ")}`);
   }
-  for (const name of LEGACY_PROCESSES) {
-    await runPm2(["delete", name]);
+  return value;
+}
+function buildLifecycleUpdates(options3) {
+  if (options3.clearCadence && options3.expectedInterval !== undefined) {
+    error("Use only one of --expected-interval and --clear-cadence");
   }
-  success("Omni services stopped");
+  const updates = {};
+  if (options3.clearCadence)
+    updates.expectedIntervalSeconds = null;
+  const expectedIntervalSeconds = parseExpectedInterval(options3.expectedInterval);
+  if (expectedIntervalSeconds !== undefined)
+    updates.expectedIntervalSeconds = expectedIntervalSeconds;
+  const windowSemantics = parseWindowSemantics(options3.windowSemantics);
+  if (windowSemantics !== undefined)
+    updates.windowSemantics = windowSemantics;
+  const mutationPolicy = parseMutationPolicy(options3.mutationPolicy);
+  if (mutationPolicy !== undefined)
+    updates.mutationPolicy = mutationPolicy;
+  return updates;
 }
-function createStopCommand() {
-  return new Command("stop").description("Stop all omni PM2 processes").action(runStop);
+function createWebhooksCommand() {
+  const webhooks = new Command("webhooks").description("Manage webhook sources");
+  webhooks.command("list").description("List webhook sources").option("--enabled", "Show only enabled sources").option("--disabled", "Show only disabled sources").action(async (options3) => {
+    const client = getClient();
+    try {
+      let enabledFilter;
+      if (options3.enabled)
+        enabledFilter = true;
+      if (options3.disabled)
+        enabledFilter = false;
+      const result = await client.webhooks.listSources({
+        enabled: enabledFilter
+      });
+      const items = result.map((w) => ({
+        id: w.id,
+        name: w.name,
+        enabled: w.enabled ? "yes" : "no",
+        health: w.livenessStatus ?? "-",
+        cadence: w.expectedIntervalSeconds != null ? `${w.expectedIntervalSeconds}s` : "-",
+        createdAt: w.createdAt
+      }));
+      list(items, { emptyMessage: "No webhook sources found." });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to list webhook sources: ${message2}`);
+    }
+  });
+  webhooks.command("get <id>").description("Get webhook source details").action(async (id) => {
+    const resolvedId = await resolveWebhookId(id);
+    const client = getClient();
+    try {
+      const source = await client.webhooks.getSource(resolvedId);
+      data(source);
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to get webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("create").description("Create a webhook source").requiredOption("--name <name>", "Webhook source name").option("--description <desc>", "Description").option("--disabled", "Create in disabled state").option("--headers <json>", `Expected headers as JSON (e.g., '{"X-Secret": true}')`).option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}. Defaults to '{source}:{sha256(body)}'").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000). Recommended for new sources. Defaults to off").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'. ` + "A mapped source emits custom.{source}.{event} instead of the collapsed custom.webhook.{source}").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. Arms liveness supervision (#961)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (options3) => {
+    const client = getClient();
+    try {
+      let expectedHeaders;
+      if (options3.headers) {
+        try {
+          expectedHeaders = JSON.parse(options3.headers);
+        } catch {
+          error("Invalid JSON for --headers");
+        }
+      }
+      const signatureConfig = buildSignatureConfig(options3);
+      const signatureSecret = await resolveSignatureSecret(options3);
+      assertPairedSignatureOnCreate(signatureConfig, signatureSecret);
+      const source = await client.webhooks.createSource({
+        name: options3.name,
+        description: options3.description,
+        enabled: !options3.disabled,
+        expectedHeaders,
+        signatureConfig,
+        signatureSecret,
+        idempotencyKeyTemplate: options3.idempotencyKeyTemplate,
+        strictSchemas: options3.strictSchemas,
+        eventTypeMapping: resolveEventTypeMapping(options3.eventTypeMapping),
+        expectedIntervalSeconds: parseExpectedInterval(options3.expectedInterval),
+        windowSemantics: parseWindowSemantics(options3.windowSemantics),
+        mutationPolicy: parseMutationPolicy(options3.mutationPolicy)
+      });
+      const details = {
+        id: source.id,
+        name: source.name,
+        url: `POST /api/v2/webhooks/${source.name}`
+      };
+      if (signatureConfig) {
+        details.publicUrl = `POST /api/v2/webhooks/ingress/${source.name}`;
+      }
+      success(`Webhook source created: ${source.id}`, details);
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to create webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("update <id>").description("Update a webhook source").option("--name <name>", "New name").option("--description <desc>", "New description").option("--enable", "Enable the webhook").option("--disable", "Disable the webhook").option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--clear-signature", "Remove the signature config and stored secret").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000)").option("--no-strict-schemas", "Return the source to opt-in pass-through for unregistered event types").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'`).option("--clear-event-type-mapping", "Remove the mapping (deliveries fall back to the collapsed custom.webhook.{source} type)").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. (Re)arms liveness supervision (#961)").option("--clear-cadence", "Remove the declared cadence (disarms liveness supervision)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (id, options3) => {
+    const resolvedId = await resolveWebhookId(id);
+    const client = getClient();
+    try {
+      const updates = await buildUpdateSourcePatch(options3);
+      const source = await client.webhooks.updateSource(resolvedId, updates);
+      success(`Webhook source updated: ${source.id}`, {
+        id: source.id,
+        name: source.name,
+        enabled: source.enabled
+      });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to update webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("delete <id>").description("Delete a webhook source").action(async (id) => {
+    const resolvedId = await resolveWebhookId(id);
+    const client = getClient();
+    try {
+      await client.webhooks.deleteSource(resolvedId);
+      success(`Webhook source deleted: ${resolvedId}`);
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to delete webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("trigger").description("Trigger a custom event").requiredOption("--type <type>", "Event type").requiredOption("--payload <json>", "Event payload as JSON").option("--instance <id>", "Instance ID").option("--correlation-id <id>", "Correlation ID").option("--causation-id <event-id>", "Parent event ID (keeps the causality tree for mid-flow emissions, #1072)").action(async (options3) => {
+    const client = getClient();
+    try {
+      let payload;
+      try {
+        payload = JSON.parse(options3.payload);
+      } catch {
+        error("Invalid JSON for --payload");
+        return;
+      }
+      const result = await client.webhooks.trigger({
+        eventType: options3.type,
+        payload,
+        instanceId: options3.instance,
+        correlationId: options3.correlationId,
+        causationId: options3.causationId
+      });
+      success(`Event triggered: ${result.eventId}`, {
+        eventId: result.eventId,
+        eventType: result.eventType
+      });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to trigger event: ${message2}`);
+    }
+  });
+  webhooks.command("heartbeat <source>").description('Record a connector heartbeat ("ran, zero events found") \u2014 resets the liveness window (#961)').action(async (source) => {
+    const client = getClient();
+    try {
+      const result = await client.webhooks.heartbeat(source);
+      success(`Heartbeat recorded for '${result.source}'`, {
+        heartbeatAt: result.heartbeatAt,
+        livenessStatus: result.livenessStatus ?? "unsupervised",
+        expectedIntervalSeconds: result.expectedIntervalSeconds
+      });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to record heartbeat: ${message2}`);
+    }
+  });
+  return webhooks;
 }
 
-// src/commands/tenants.ts
-init_output();
-var TENANT_ROLES = ["tenant-owner", "tenant-admin", "tenant-operator", "tenant-viewer"];
-var MEMBERSHIP_STATUSES = ["active", "disabled"];
-var REASON_REQUIRED_HINT = "Every platform control-plane call is audited; " + 'provide a justification of 3-500 characters, e.g. --reason "onboarding request OPS-1421".';
-var CONTROL_PLANE_UNAVAILABLE = "the platform control plane is not available on this server. " + "Either multitenancy is disabled (start the API with OMNI_MULTITENANCY_ENABLED=true) " + "or the server predates the tenant control plane \u2014 upgrade it.";
-var CREDENTIAL_REJECTED_401 = "the server rejected the credential (401). " + "The platform control plane accepts only PLATFORM-class credentials \u2014 legacy admin/god keys and " + "tenant data-plane keys are denied by design. Authenticate with a platform key: " + "omni auth login --api-key <platform-key>.";
-var CREDENTIAL_FORBIDDEN_403 = "the credential authenticated but is not allowed (403). " + "A PLATFORM-class credential with the matching platform:* scope is required \u2014 tenant-class " + "credentials can never reach the control plane, and platform keys act only within their scopes.";
-function requireReason(reason, action) {
-  const trimmed = reason?.trim() ?? "";
-  if (trimmed.length < 3 || trimmed.length > 500) {
-    error(`--reason is required to ${action}. ${REASON_REQUIRED_HINT}`, undefined, 1);
+// src/commands/sources.ts
+var github = {
+  name: "github",
+  description: "GitHub repo webhooks (RFC #925 Phase 3 recipe)",
+  signatureConfig: { algorithm: "hmac-sha256", header: "X-Hub-Signature-256", prefix: "sha256=" },
+  idempotencyKeyTemplate: "github:{headers.x-github-delivery}",
+  eventTypeMapping: { source: "header", header: "X-GitHub-Event" },
+  expectedIntervalSeconds: 86400,
+  schemas: { push: custom_github_push_default, pull_request: custom_github_pull_request_default, issues: custom_github_issues_default, release: custom_github_release_default },
+  async ensureProviderWebhook(api, repo, hook) {
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo))
+      throw new Error(`--repo must be OWNER/NAME, got '${repo}'`);
+    const body = {
+      active: true,
+      events: hook.events,
+      config: { url: hook.url, content_type: "json", secret: hook.secret, insecure_ssl: "0" }
+    };
+    const existing = await api("GET", `/repos/${repo}/hooks`);
+    const match = existing.find((h10) => h10.config?.url === hook.url);
+    if (match) {
+      await api("PATCH", `/repos/${repo}/hooks/${match.id}`, body);
+      return String(match.id);
+    }
+    const created = await api("POST", `/repos/${repo}/hooks`, { name: "web", ...body });
+    return String(created.id);
   }
-  return trimmed;
-}
-function parseRole(value) {
-  if (!TENANT_ROLES.includes(value)) {
-    error(`Invalid --role "${value}". Valid roles: ${TENANT_ROLES.join(", ")}`, undefined, 1);
+};
+var PRESETS = { github };
+var GITHUB_API = "https://api.github.com";
+async function ghAvailable() {
+  try {
+    return await Bun.spawn({ cmd: ["gh", "auth", "status"], stdout: "ignore", stderr: "ignore" }).exited === 0;
+  } catch {
+    return false;
   }
-  return value;
 }
-function parseStatus(value) {
-  if (!MEMBERSHIP_STATUSES.includes(value)) {
-    error(`Invalid --status "${value}". Valid statuses: ${MEMBERSHIP_STATUSES.join(", ")}`, undefined, 1);
+async function githubApiViaGh(method, path, body) {
+  const cmd = ["gh", "api", "--method", method, path];
+  if (body !== undefined)
+    cmd.push("--input", "-");
+  const proc = Bun.spawn({ cmd, stdin: body === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
+  if (body !== undefined && proc.stdin) {
+    proc.stdin.write(JSON.stringify(body));
+    proc.stdin.end();
   }
-  return value;
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  if (code !== 0)
+    throw new Error(`gh api ${method} ${path} failed: ${stderr.trim() || stdout.trim()}`);
+  return stdout.trim() ? JSON.parse(stdout) : undefined;
 }
-function parseScopes(value) {
-  const scopes = value.split(",").map((s2) => s2.trim()).filter((s2) => s2.length > 0);
-  if (scopes.length === 0) {
-    error('--scopes must list at least one explicit tenant scope (comma-separated), e.g. --scopes "messages:send,chats:read".', undefined, 1);
-  }
-  return scopes;
+function githubApiViaToken(token) {
+  return async (method, path, body) => {
+    const resp = await fetch(`${GITHUB_API}${path}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${token}`,
+        accept: "application/vnd.github+json",
+        "content-type": "application/json"
+      },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+    if (!resp.ok)
+      throw new Error(`GitHub API ${method} ${path} returned ${resp.status}: ${await resp.text()}`);
+    return resp.status === 204 ? undefined : await resp.json();
+  };
 }
-function parseConstraints(value) {
-  const invalid = () => error(`Invalid --constraints "${value}". Expected a JSON object of string arrays, e.g. '{"instanceAllowlist":["<instance-id>"]}'.`, undefined, 1);
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    invalid();
+async function resolveGithubApi() {
+  if (await ghAvailable())
+    return githubApiViaGh;
+  const token = process.env.GITHUB_TOKEN;
+  if (token)
+    return githubApiViaToken(token);
+  throw new Error("no GitHub credentials: log in with `gh auth login` or set GITHUB_TOKEN (or pass --no-provider-webhook)");
+}
+
+class StepFailure extends Error {
+  step;
+  completed;
+  constructor(step, completed, cause) {
+    super(cause instanceof Error ? cause.message : String(cause));
+    this.step = step;
+    this.completed = completed;
   }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    invalid();
+}
+var STEPS = ["source", "idempotency", "event-type-mapping", "schemas", "provider-webhook"];
+async function addSource(input) {
+  const { preset, client } = input;
+  const unknown2 = input.events.filter((e10) => !(e10 in preset.schemas));
+  if (unknown2.length > 0) {
+    throw new Error(`unknown ${preset.name} events: ${unknown2.join(", ")} (known: ${Object.keys(preset.schemas).join(", ")})`);
   }
-  const record2 = parsed;
-  for (const entry of Object.values(record2)) {
-    if (!Array.isArray(entry) || entry.some((item) => typeof item !== "string")) {
-      invalid();
+  const webhookUrl = `${input.publicUrl.replace(/\/+$/, "")}/api/v2/webhooks/ingress/${preset.name}`;
+  const completed = [];
+  const run = async (step, fn) => {
+    try {
+      const value = await fn();
+      completed.push(step);
+      return value;
+    } catch (err2) {
+      throw new StepFailure(step, completed, err2);
     }
+  };
+  const source = await run(STEPS[0], async () => {
+    const existing = (await client.listSources()).find((s2) => s2.name === preset.name);
+    const body = {
+      description: preset.description,
+      signatureConfig: preset.signatureConfig,
+      signatureSecret: input.secret,
+      expectedIntervalSeconds: preset.expectedIntervalSeconds
+    };
+    if (existing)
+      return { id: (await client.updateSource(existing.id, body)).id, created: false };
+    return { id: (await client.createSource({ name: preset.name, enabled: true, ...body })).id, created: true };
+  });
+  await run(STEPS[1], () => client.updateSource(source.id, { idempotencyKeyTemplate: preset.idempotencyKeyTemplate }));
+  await run(STEPS[2], () => client.updateSource(source.id, { eventTypeMapping: preset.eventTypeMapping }));
+  await run(STEPS[3], async () => {
+    for (const event of input.events) {
+      const eventType = `custom.${preset.name}.${event}`;
+      await input.registerSchema(eventType, preset.schemas[event], `${preset.name} ${event} deliveries`);
+    }
+  });
+  let providerHookId;
+  if (input.providerWebhook) {
+    providerHookId = await run(STEPS[4], async () => preset.ensureProviderWebhook(await input.providerApi(), input.target, {
+      url: webhookUrl,
+      secret: input.secret,
+      events: input.events
+    }));
   }
-  return record2;
+  return { sourceId: source.id, created: source.created, webhookUrl, providerHookId, completed };
 }
-function renderPlatformError(err2, action) {
-  if (err2 instanceof OmniApiError) {
-    if (err2.status === 404 && err2.message.startsWith("Endpoint not found")) {
-      error(`Failed to ${action}: ${CONTROL_PLANE_UNAVAILABLE}`, undefined, 1);
-    }
-    if (err2.status === 401) {
-      error(`Failed to ${action}: ${CREDENTIAL_REJECTED_401}`, undefined, 1);
-    }
-    if (err2.status === 403) {
-      error(`Failed to ${action}: ${CREDENTIAL_FORBIDDEN_403}`, undefined, 1);
-    }
-  }
-  const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-  error(`Failed to ${action}: ${message2}`);
-}
-var TENANT_NOT_ACTIVE_409 = "the tenant is not active (409). Root keys can be issued only while the tenant is active \u2014 " + "a suspended or archived tenant refuses new credentials.";
-var ROOT_KEY_EXCEEDS_POLICY_403 = "the request exceeds the tenant policy ceilings (403). Keep --expires within the tenant " + "max-key-ttl and --rate-limit/--budget at or below the tenant ceilings (see: omni tenants get <id>).";
-function renderRootKeyError(err2, action) {
-  if (err2 instanceof OmniApiError) {
-    if (err2.status === 409) {
-      error(`Failed to ${action}: ${TENANT_NOT_ACTIVE_409}`, undefined, 1);
-    }
-    if (err2.status === 400) {
-      error(`Failed to ${action}: ${err2.message}`, undefined, 1);
-    }
-    if (err2.status === 403 && err2.message.includes("exceeds tenant policy")) {
-      error(`Failed to ${action}: ${ROOT_KEY_EXCEEDS_POLICY_403}`, undefined, 1);
+function createSourcesCommand() {
+  const sources = new Command("sources").description("One-command onboarding of external webhook sources");
+  sources.command("add <provider>").description(`Create or update a provider source end to end (presets: ${Object.keys(PRESETS).join(", ")})`).requiredOption("--repo <owner/name>", "Provider-side target (GitHub: OWNER/NAME)").option("--events <list>", "Comma-separated provider events (default: every bundled schema)").option("--public-url <url>", "Omni URL reachable from the provider (default: configured apiUrl)").option("--secret-env <VAR>", "Reuse the webhook secret from environment variable VAR instead of generating one").option("--no-provider-webhook", "Skip creating the webhook on the provider side").action(async (provider, options3) => {
+    const preset = PRESETS[provider];
+    if (!preset)
+      error(`Unknown provider '${provider}'. Presets: ${Object.keys(PRESETS).join(", ")}`);
+    const client = getClient();
+    try {
+      const secret = await resolveSignatureSecret({ signatureSecretEnv: options3.secretEnv }) ?? randomBytes4(32).toString("hex");
+      const result = await addSource({
+        preset,
+        target: options3.repo,
+        events: options3.events ? options3.events.split(",").map((e10) => e10.trim()) : Object.keys(preset.schemas),
+        secret,
+        publicUrl: options3.publicUrl ?? loadConfig().apiUrl ?? "http://localhost:8882",
+        providerWebhook: options3.providerWebhook,
+        client: client.webhooks,
+        registerSchema: (eventType, schema3, description) => schemaApiRequest("", { method: "POST", body: JSON.stringify({ eventType, schema: schema3, description }) }),
+        providerApi: resolveGithubApi
+      });
+      success(`Source ${result.created ? "created" : "updated"}: ${result.sourceId}`, {
+        id: result.sourceId,
+        name: preset.name,
+        secret,
+        webhookUrl: result.webhookUrl,
+        providerHookId: result.providerHookId ?? "(skipped)",
+        steps: result.completed.join(", ")
+      });
+      warn("The secret is shown once; store it now (re-run with --secret-env VAR to reuse it).");
+    } catch (err2) {
+      if (err2 instanceof StepFailure) {
+        const remaining = STEPS.filter((s2) => !err2.completed.includes(s2));
+        error(`Step '${err2.step}' failed: ${err2.message}`, {
+          completed: err2.completed,
+          remaining,
+          resume: "re-run the same command; completed steps are updated in place, not duplicated"
+        });
+      }
+      error(`Failed to add source: ${err2 instanceof Error ? err2.message : String(err2)}`);
     }
-  }
-  renderPlatformError(err2, action);
-}
-function formatTenantRow(tenant) {
-  return {
-    id: tenant.id,
-    slug: tenant.slug,
-    name: tenant.displayName,
-    status: tenant.status,
-    keyTtl: tenant.maxKeyTtlSeconds,
-    keyRate: tenant.maxKeyRateLimit,
-    keyBudget: tenant.maxKeyBudget,
-    created: new Date(tenant.createdAt).toLocaleDateString()
-  };
-}
-function formatMembershipRow(membership) {
-  return {
-    id: membership.id,
-    principal: membership.principalId,
-    role: membership.role,
-    status: membership.status,
-    invitedBy: membership.invitedByPrincipalId ?? "-",
-    created: new Date(membership.createdAt).toLocaleDateString()
-  };
-}
-async function handleList5(client, options3) {
-  const reason = requireReason(options3.reason, "list tenants");
-  const result = await client.platform.tenants.list(reason);
-  list(result.items.map(formatTenantRow), {
-    emptyMessage: "No tenants found.",
-    rawData: result.items
-  });
-}
-async function handleGet3(client, id, options3) {
-  const reason = requireReason(options3.reason, "read a tenant");
-  const tenant = await client.platform.tenants.get(id, reason);
-  data(tenant);
-}
-async function handleCreate4(client, options3) {
-  const reason = requireReason(options3.reason, "create a tenant");
-  const tenant = await client.platform.tenants.create({
-    slug: options3.slug,
-    displayName: options3.name,
-    maxKeyTtlSeconds: options3.maxKeyTtl,
-    maxKeyRateLimit: options3.maxKeyRate,
-    maxKeyBudget: options3.maxKeyBudget,
-    reason
-  });
-  success(`Tenant created: ${tenant.slug} (${tenant.id})`);
-  data(tenant);
-}
-async function handleSuspend(client, id, options3) {
-  const reason = requireReason(options3.reason, "suspend a tenant");
-  const tenant = await client.platform.tenants.suspend(id, reason);
-  success(`Tenant suspended: ${tenant.slug} (${tenant.id})`);
-  info(`Reason: ${reason}`);
-}
-async function handleArchive(client, id, options3) {
-  const reason = requireReason(options3.reason, "archive a tenant");
-  const tenant = await client.platform.tenants.archive(id, reason);
-  success(`Tenant archived: ${tenant.slug} (${tenant.id})`);
-  warn("Archived is terminal \u2014 there is no un-archive and no hard delete.");
-  info(`Reason: ${reason}`);
-}
-async function handleMembershipsList(client, tenantId, options3) {
-  const reason = requireReason(options3.reason, "list memberships");
-  const result = await client.platform.tenants.memberships.list(tenantId, reason);
-  list(result.items.map(formatMembershipRow), {
-    emptyMessage: "No memberships found.",
-    rawData: result.items
-  });
-}
-async function handleMembershipsAdd(client, tenantId, options3) {
-  const reason = requireReason(options3.reason, "attach a membership");
-  const role = parseRole(options3.role);
-  const membership = await client.platform.tenants.memberships.attach(tenantId, {
-    principalId: options3.principal,
-    role,
-    reason
   });
-  success(`Membership attached: ${membership.principalId} as ${membership.role} (${membership.id})`);
-}
-async function handleMembershipsDisable(client, tenantId, membershipId, options3) {
-  const reason = requireReason(options3.reason, "disable a membership");
-  const membership = await client.platform.tenants.memberships.disable(tenantId, membershipId, reason);
-  success(`Membership disabled: ${membership.id}`);
-  info(`Reason: ${reason}`);
-}
-async function handleMembershipsStatus(client, tenantId, membershipId, options3) {
-  const reason = requireReason(options3.reason, "set a membership status");
-  const status = parseStatus(options3.status);
-  const membership = await client.platform.tenants.memberships.setStatus(tenantId, membershipId, status, reason);
-  success(`Membership ${membership.id} status set to ${membership.status}`);
+  return sources;
 }
-async function handleMembershipsRole(client, tenantId, membershipId, options3) {
-  const reason = requireReason(options3.reason, "set a membership role");
-  const role = parseRole(options3.role);
-  const membership = await client.platform.tenants.memberships.setRole(tenantId, membershipId, role, reason);
-  success(`Membership ${membership.id} role set to ${membership.role}`);
+
+// src/commands/speak.ts
+import { writeFile as writeFile2 } from "fs/promises";
+init_output();
+var ALLOWED_FORMATS2 = ["mp3", "ogg", "opus", "wav", "pcm", "flac", "aac"];
+function parseFormat2(value) {
+  if (!value)
+    return;
+  const normalized = value.toLowerCase();
+  if (!ALLOWED_FORMATS2.includes(normalized)) {
+    error(`Invalid --format "${value}". Allowed: ${ALLOWED_FORMATS2.join(", ")}`);
+  }
+  return normalized;
 }
-async function handleKeysIssueRoot(client, tenantId, options3) {
-  const reason = requireReason(options3.reason, "issue a root key");
-  const role = parseRole(options3.role);
-  const scopes = parseScopes(options3.scopes);
-  const constraints = options3.constraints === undefined ? undefined : parseConstraints(options3.constraints);
-  const body = {
-    principalId: options3.principal,
-    membershipId: options3.membership,
-    role,
-    name: options3.name,
-    scopes,
-    expiresAt: options3.expires,
-    rateLimit: options3.rateLimit,
-    budget: options3.budget,
-    ...constraints ? { resourceConstraints: constraints } : {},
-    reason
-  };
-  const result = await client.platform.tenants.keys.issueRoot(tenantId, body);
-  if (getCurrentFormat() === "json") {
-    warn("plainTextKey is shown once and can never be retrieved again \u2014 store it now.");
-    data(result);
+function parseSpeed(value) {
+  if (value === undefined)
     return;
+  const n2 = Number.parseFloat(value);
+  if (Number.isNaN(n2) || n2 < 0.5 || n2 > 2) {
+    error(`Invalid --speed "${value}". Must be a number between 0.5 and 2.0.`);
   }
-  const { plainTextKey, ...issued } = result;
-  success(`Root key issued: ${issued.name} (${issued.id})`);
-  warn("The key below is shown ONCE and can never be retrieved again \u2014 store it now.");
-  raw(`
-  ${plainTextKey}
-`);
-  data(issued);
+  return n2;
 }
-var REASON_HELP = "Audited justification (required, 3-500 chars)";
-function createTenantsCommand() {
-  const tenants2 = new Command("tenants").description("Platform tenant control plane (requires a PLATFORM-class credential and OMNI_MULTITENANCY_ENABLED=true)");
-  tenants2.command("list").description("List tenants, newest first (the read itself is audited)").option("--reason <text>", REASON_HELP).action(async (options3) => {
+function createSpeakCommand() {
+  return new Command("speak").description("Synthesize text to speech and send as a voice note (or save with --output)").argument("<text>", "Text to convert to speech").option("--provider <name>", "TTS provider (gemini, openai, elevenlabs). Default: server config.").option("--model <model>", "TTS model override (provider-specific)").option("--voice <name>", "Voice identifier (e.g. Kore for Gemini, JBFqn... for ElevenLabs)").option("--style <prompt>", 'Style prompt prepended to text (Gemini only, e.g. "Say cheerfully")').option("--instructions <text>", "Provider-native speaking instructions").option("--tone <text>", "Tone guidance").option("--accent <text>", "Accent guidance").option("--pace <text>", "Pace guidance").option("--emotion <text>", "Emotion guidance").option("--voice-note-profile <name>", "Voice-note profile/preset name").option("--language <code>", "BCP-47 language code (e.g. en-US, pt-BR)").option("--speed <factor>", "Speaking speed multiplier 0.5-2.0 (provider-dependent)").option("--format <fmt>", `Audio format: ${ALLOWED_FORMATS2.join(", ")} (default: ogg)`).option("--output <path>", "Save audio to file instead of sending").option("--instance <id>", "Override instance (default: from context)").option("--chat <id>", "Override chat (default: from context)").action(async (text3, options3) => {
     const client = getClient();
+    const format = parseFormat2(options3.format);
+    const speed = parseSpeed(options3.speed);
+    let audioBuffer;
+    let mimeType;
+    let durationMs;
+    let providerName;
     try {
-      await handleList5(client, options3);
+      const result = await client.media.tts({
+        text: text3,
+        provider: options3.provider,
+        voice: options3.voice,
+        language: options3.language,
+        speed,
+        format,
+        style: options3.style,
+        model: options3.model,
+        instructions: options3.instructions,
+        tone: options3.tone,
+        accent: options3.accent,
+        pace: options3.pace,
+        emotion: options3.emotion,
+        voiceNoteProfile: options3.voiceNoteProfile
+      });
+      audioBuffer = result.audio;
+      mimeType = result.mimeType;
+      durationMs = result.durationMs;
+      providerName = result.provider;
     } catch (err2) {
-      renderPlatformError(err2, "list tenants");
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      return error(`TTS synthesis failed: ${message2}`);
     }
-  });
-  tenants2.command("get <id>").description("Get one tenant by id").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
-    const client = getClient();
-    try {
-      await handleGet3(client, id, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "get the tenant");
+    if (options3.output) {
+      try {
+        await writeFile2(options3.output, audioBuffer);
+        return success("Audio saved", {
+          path: options3.output,
+          provider: providerName,
+          mimeType,
+          durationMs,
+          sizeKb: Math.round(audioBuffer.length / 1024 * 100) / 100
+        });
+      } catch (err2) {
+        const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+        return error(`Failed to write ${options3.output}: ${message2}`);
+      }
     }
-  });
-  tenants2.command("create").description("Create a tenant with its mandatory credential ceilings").requiredOption("--slug <slug>", "Immutable lowercase DNS-like slug (e.g. acme)").requiredOption("--name <name>", "Human-readable tenant name").requiredOption("--max-key-ttl <seconds>", "Ceiling for credential TTL, in seconds", Number.parseInt).requiredOption("--max-key-rate <n>", "Ceiling for credential rate limit", Number.parseInt).requiredOption("--max-key-budget <n>", "Ceiling for credential budget", Number.parseInt).option("--reason <text>", REASON_HELP).action(async (options3) => {
-    const client = getClient();
-    try {
-      await handleCreate4(client, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "create the tenant");
+    const ctx = await resolveContext({
+      instance: options3.instance,
+      chat: options3.chat
+    });
+    if (!ctx.instanceId) {
+      return error("No instance in context. Set OMNI_INSTANCE, use --instance, run: omni use <instance>, or pass --output to save.");
     }
-  });
-  tenants2.command("suspend <id>").description("Suspend a tenant (bumps its revocation epoch, invalidating tenant credentials)").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
-    const client = getClient();
-    try {
-      await handleSuspend(client, id, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "suspend the tenant");
+    if (!ctx.chatId) {
+      return error("No chat in context. Set OMNI_CHAT, use --chat, run: omni open <contact>, or pass --output to save.");
     }
-  });
-  tenants2.command("archive <id>").description("Archive a tenant (TERMINAL \u2014 no un-archive, no hard delete)").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
-    const client = getClient();
     try {
-      await handleArchive(client, id, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "archive the tenant");
-    }
-  });
-  const memberships = new Command("memberships").description("Manage tenant memberships");
-  memberships.command("list <tenant-id>").description("List the memberships of one tenant (the read itself is audited)").option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
-    const client = getClient();
-    try {
-      await handleMembershipsList(client, tenantId, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "list memberships");
-    }
-  });
-  memberships.command("add <tenant-id>").description("Grant a principal a role in the tenant").requiredOption("--principal <uuid>", "Principal to grant access to").requiredOption("--role <role>", `Tenant role: ${TENANT_ROLES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
-    const client = getClient();
-    try {
-      await handleMembershipsAdd(client, tenantId, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "attach the membership");
-    }
-  });
-  memberships.command("disable <tenant-id> <membership-id>").description("Disable a membership (memberships are never hard-deleted)").option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
-    const client = getClient();
-    try {
-      await handleMembershipsDisable(client, tenantId, membershipId, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "disable the membership");
-    }
-  });
-  memberships.command("status <tenant-id> <membership-id>").description("Activate or disable an existing membership").requiredOption("--status <status>", `New status: ${MEMBERSHIP_STATUSES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
-    const client = getClient();
-    try {
-      await handleMembershipsStatus(client, tenantId, membershipId, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "set the membership status");
-    }
-  });
-  memberships.command("role <tenant-id> <membership-id>").description("Change the role an existing membership acts under").requiredOption("--role <role>", `New role: ${TENANT_ROLES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
-    const client = getClient();
-    try {
-      await handleMembershipsRole(client, tenantId, membershipId, options3);
-    } catch (err2) {
-      renderPlatformError(err2, "set the membership role");
-    }
-  });
-  tenants2.addCommand(memberships);
-  const keys = new Command("keys").description("Manage tenant credentials");
-  keys.command("issue-root <tenant-id>").description("Issue the initial tenant ROOT key (the plaintext is shown ONCE and never again)").requiredOption("--principal <uuid>", "Principal the key acts as (must hold the membership)").requiredOption("--membership <uuid>", "Active membership binding the principal to the tenant").requiredOption("--role <role>", `Tenant role: ${TENANT_ROLES.join(" | ")}`).requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <list>", "Comma-separated explicit tenant scopes (platform/wildcard scopes are refused)").requiredOption("--expires <iso>", "Expiry (ISO 8601); must be in the future and within the tenant TTL ceiling").requiredOption("--rate-limit <n>", "Rate limit; capped by the tenant policy ceiling", Number.parseInt).requiredOption("--budget <n>", "Budget; capped by the tenant policy ceiling", Number.parseInt).option("--constraints <json>", `Optional resource allowlists as JSON, e.g. '{"instanceAllowlist":["<id>"]}'`).option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
-    const client = getClient();
-    try {
-      await handleKeysIssueRoot(client, tenantId, options3);
+      const result = await client.messages.sendMedia({
+        instanceId: ctx.instanceId,
+        to: ctx.chatId,
+        type: "audio",
+        base64: audioBuffer.toString("base64"),
+        filename: pickFilename(mimeType, providerName),
+        voiceNote: true
+      });
+      success("Voice note sent", {
+        provider: providerName,
+        durationMs,
+        sizeKb: Math.round(audioBuffer.length / 1024 * 100) / 100,
+        ...result
+      });
     } catch (err2) {
-      renderRootKeyError(err2, "issue the root key");
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to send voice note: ${message2}`);
     }
   });
-  tenants2.addCommand(keys);
-  return tenants2;
+}
+function pickFilename(mimeType, provider) {
+  const lower = mimeType.toLowerCase();
+  if (lower.includes("ogg") || lower.includes("opus"))
+    return `${provider}-speak.ogg`;
+  if (lower.includes("wav"))
+    return `${provider}-speak.wav`;
+  if (lower.includes("mp3") || lower.includes("mpeg"))
+    return `${provider}-speak.mp3`;
+  if (lower.includes("flac"))
+    return `${provider}-speak.flac`;
+  if (lower.includes("aac") || lower.includes("m4a"))
+    return `${provider}-speak.m4a`;
+  return `${provider}-speak.bin`;
 }
 
-// src/commands/trust.ts
-import { hostname as osHostname } from "os";
+// src/commands/start.ts
+import { existsSync as existsSync18, mkdirSync as mkdirSync11 } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join17 } from "path";
 init_config();
+init_embedded_canonical_migration();
 init_output();
-function targetBaseUrl() {
-  return normalizeServerUrl(loadConfig().apiUrl ?? "http://localhost:8882");
-}
-function trustEndpoint(path) {
-  if (!hasAuth()) {
-    exitNotAuthenticated();
-  }
-  return `${targetBaseUrl()}/api/v2/trust${path}`;
+var START_HEALTH_TIMEOUT_MS = 1e4;
+function legacyEmbeddedNeedsMigration(useCanonicalPgserve, embeddedDataPresent = existsSync18(join17(EMBEDDED_PGSERVE_DATA_DIR, "PG_VERSION"))) {
+  return useCanonicalPgserve !== true && embeddedDataPresent;
 }
-function authHeaders() {
-  const config2 = loadConfig();
-  const headers = { "Content-Type": "application/json" };
-  if (config2.apiKey) {
-    headers.Authorization = `Bearer ${config2.apiKey}`;
+async function runStart() {
+  if (!await isPm2Available()) {
+    pm2NotFoundError();
   }
-  return headers;
-}
-var _cachedSigningContext;
-function getSigningContextOnce() {
-  if (_cachedSigningContext === undefined) {
-    _cachedSigningContext = loadSigningContextForServer(targetBaseUrl());
+  const bundlePath = getServerBundlePath();
+  if (!existsSync18(bundlePath)) {
+    bundleNotFoundError(bundlePath);
   }
-  return _cachedSigningContext;
-}
-async function callApi(method, path, body) {
-  const url = trustEndpoint(path);
-  const bodyString = body === undefined ? "" : JSON.stringify(body);
-  const headers = authHeaders();
-  const ctx = getSigningContextOnce();
-  if (ctx && !path.startsWith("/handshake")) {
-    const reqPath = new URL(url).pathname + new URL(url).search;
-    const sigHeaders = ctx.signRequest(method, reqPath, bodyString);
-    Object.assign(headers, sigHeaders);
+  const serverConfig = loadServerConfig();
+  const apiPort = serverConfig.port;
+  if (legacyEmbeddedNeedsMigration(serverConfig.useCanonicalPgserve)) {
+    const major = readDataDirMajor(EMBEDDED_PGSERVE_DATA_DIR);
+    error(`Legacy embedded pgserve detected \u2014 this omni build does not run an embedded Postgres.
+  Embedded data dir: ${EMBEDDED_PGSERVE_DATA_DIR}${major ? ` (PostgreSQL ${major})` : ""}
+  Your data is intact. Migrate to canonical pgserve first:
+      omni doctor --fix
+  (idempotent \u2014 preserves data; do not \`omni start\` until it completes).`, undefined, 1);
   }
-  const res = await fetch(url, {
-    method,
-    headers,
-    body: body === undefined ? undefined : bodyString
+  mkdirSync11(getPm2LogDir(), { recursive: true });
+  info(`Starting ${PM2_PROCESSES.api} (port ${apiPort})...`);
+  const cliConfig = loadLocalRuntimeConfig();
+  const env2 = buildRuntimeEnv(serverConfig, cliConfig);
+  const launcherPath = getServerLauncherPath();
+  const apiArgs = buildPm2StartArgs({
+    kind: "api",
+    script: launcherPath,
+    name: PM2_PROCESSES.api,
+    interpreter: "bash"
   });
-  if (!res.ok) {
-    const text3 = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} ${res.statusText}${text3 ? `: ${text3}` : ""}`);
+  const apiCode = await runPm2(apiArgs, env2);
+  if (apiCode !== 0) {
+    error(`Failed to start ${PM2_PROCESSES.api} (pm2 exit code ${apiCode})`, undefined, 1);
+    return;
   }
-  return await res.json();
-}
-function formatHostRow(host) {
-  return {
-    id: host.id.slice(0, 8),
-    hostname: host.hostname,
-    scopes: host.scopes.join(", ") || "(none)",
-    pubkeyPrefix: `${host.pubkey.slice(0, 12)}\u2026`,
-    lastSeen: host.lastSeenAt ? new Date(host.lastSeenAt).toISOString().replace("T", " ").slice(0, 16) : "never",
-    status: host.revokedAt ? "revoked" : "active"
-  };
-}
-async function handleList6() {
-  try {
-    const { items } = await callApi("GET", "/hosts");
-    list(items.map(formatHostRow), {
-      emptyMessage: "No genie hosts registered. Run `genie omni handshake` from a genie installation to register one.",
-      rawData: items
+  const natsPath = join17(homedir12(), ".omni", "nats-server");
+  if (existsSync18(natsPath)) {
+    info(`Starting ${PM2_PROCESSES.nats}...`);
+    const natsDataDir = join17(serverConfig.dataDir, "nats");
+    mkdirSync11(natsDataDir, { recursive: true });
+    const natsArgs = buildPm2StartArgs({
+      kind: "nats",
+      script: natsPath,
+      name: PM2_PROCESSES.nats,
+      scriptArgs: ["-js", "-sd", natsDataDir]
     });
-  } catch (err2) {
-    error(`Failed to list genie hosts: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
+    const natsCode = await runPm2(natsArgs);
+    if (natsCode !== 0) {
+      warn(`${PM2_PROCESSES.nats} failed to start \u2014 run 'omni install' to download NATS first`);
+    }
+  } else {
+    warn(`NATS binary not found at ${natsPath} \u2014 skipping. Run 'omni install' to set it up.`);
   }
-}
-async function handleGet4(id) {
-  try {
-    const { data: data2 } = await callApi("GET", `/hosts/${encodeURIComponent(id)}`);
-    data(data2);
-  } catch (err2) {
-    error(`Failed to get genie host: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
+  const healthUrl = getHealthCheckUrl(apiPort);
+  info(`Waiting for health check at ${healthUrl}...`);
+  const healthy = await waitForHealth(apiPort, START_HEALTH_TIMEOUT_MS);
+  if (healthy) {
+    success(`Server is healthy at ${healthUrl}`);
+  } else {
+    warn(`Health check did not pass within ${START_HEALTH_TIMEOUT_MS / 1000}s \u2014 server may still be starting`);
   }
 }
-async function handleUpdate3(id, options3) {
-  const scopes = options3.scope.split(",").map((s2) => s2.trim()).filter(Boolean);
-  if (scopes.length === 0) {
-    error("--scope must contain at least one scope (use `omni trust revoke <id>` to deny everything).");
+function createStartCommand() {
+  return new Command("start").description("Start API and NATS via PM2").action(runStart);
+}
+
+// src/commands/status.ts
+init_config();
+init_output();
+function formatUptime(ms) {
+  if (ms === undefined || ms === 0)
+    return "-";
+  const seconds = Math.floor(ms / 1000);
+  if (seconds < 60)
+    return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24)
+    return `${hours}h`;
+  const days = Math.floor(hours / 24);
+  return `${days}d`;
+}
+function formatMemory(bytes) {
+  if (bytes === undefined || bytes === 0)
+    return "-";
+  return `${Math.round(bytes / 1024 / 1024)}MB`;
+}
+async function getProcessStatus() {
+  if (!await isPm2Available()) {
+    return null;
   }
-  try {
-    const { data: data2 } = await callApi("PATCH", `/hosts/${encodeURIComponent(id)}`, { scopes });
-    success(`Updated genie host ${data2.id} scopes: ${data2.scopes.join(", ")}`);
-    data(data2);
-  } catch (err2) {
-    error(`Failed to update genie host: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
+  const { code, stdout } = await capturePm2("jlist");
+  if (code !== 0) {
+    return null;
   }
-}
-async function registerPubkey(pubkey, hostname) {
+  let processes = [];
   try {
-    const res = await callApi("POST", "/handshake", {
-      pubkey,
-      hostname,
-      capabilities: {
-        client: "omni-cli",
-        platform: process.platform,
-        nodeVersion: process.version
+    processes = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  const omniProcesses = processes.filter((p11) => typeof p11.name === "string" && p11.name.startsWith("omni-"));
+  return omniProcesses.map((p11) => ({
+    service: p11.name ?? "-",
+    pid: p11.pid !== undefined ? String(p11.pid) : "-",
+    status: p11.pm2_env?.status ?? "-",
+    uptime: p11.pm2_env?.pm_uptime ? formatUptime(Date.now() - p11.pm2_env.pm_uptime) : "-",
+    cpu: p11.monit?.cpu !== undefined ? `${p11.monit.cpu}%` : "-",
+    memory: formatMemory(p11.monit?.memory)
+  }));
+}
+async function checkApiHealth(statusInfo, apiUrl) {
+  try {
+    const response = await fetch(`${apiUrl.replace(/\/$/, "")}/api/v2/health`, {
+      headers: {
+        "Accept-Encoding": "identity",
+        [CLI_VERSION_HEADER]: VERSION
       }
     });
-    return res.data;
+    const health = await response.json();
+    statusInfo.apiStatus = health.status ?? "unknown";
+    statusInfo.apiVersion = health.version;
+    if (health.checks) {
+      statusInfo.checks = health.checks;
+    }
+    return response.headers.get(SERVER_VERSION_HEADER);
   } catch (err2) {
-    return error(`Handshake failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    statusInfo.apiStatus = "unreachable";
+    statusInfo.apiError = err2 instanceof Error ? err2.message : "Unknown error";
+    return null;
   }
 }
-async function handleHandshake(options3) {
-  const targetUrl = targetBaseUrl();
-  const serverName = getTargetServerName();
-  const existing = loadHostMetadata();
-  if (existing && !options3.rotate) {
-    const bindings = boundServerBindings(existing);
-    const bound = boundServerUrls(existing);
-    const alreadyBound = bindingForServer(existing, targetUrl);
-    if (alreadyBound) {
-      success(`Already handshook as host ${alreadyBound.hostId} for server '${serverName}' (${targetUrl}). Bound servers: ${bound.join(", ")} (each with its own host id). Requests to any other server entry are sent UNSIGNED (bearer only) \u2014 run \`omni trust handshake --server <name>\` there to bind it. Pass --rotate to issue a new keypair.`);
-      return;
-    }
-    const registered2 = await registerPubkey(existing.pubkey, options3.hostname ?? existing.hostname);
-    const meta2 = {
-      ...existing,
-      pubkey: registered2.pubkey,
-      boundServers: [...bindings, { url: targetUrl, hostId: registered2.id }]
-    };
-    writeHostMetadata(meta2);
-    success(`Bound existing host key to server '${serverName}' (${targetUrl}) \u2014 no rotation.`);
-    data({
-      hostId: registered2.id,
-      hostname: meta2.hostname,
-      pubkey: meta2.pubkey,
-      boundServers: meta2.boundServers,
-      rotated: false
-    });
-    return;
+async function validateAuthKey(statusInfo, client) {
+  try {
+    const auth = await client.auth.validate();
+    statusInfo.keyValid = auth.valid;
+    statusInfo.keyName = auth.keyName;
+    statusInfo.keyPrefix = auth.keyPrefix;
+    statusInfo.scopes = auth.scopes;
+    Object.assign(statusInfo, credentialStatusFields(auth));
+    Object.assign(statusInfo, serverPostureFields(auth));
+  } catch {
+    statusInfo.keyValid = false;
   }
-  const { pubkeyB64Url } = generateAndStoreKeypair();
-  const hostname = options3.hostname ?? osHostname();
-  const registered = await registerPubkey(pubkeyB64Url, hostname);
-  const meta = {
-    hostId: registered.id,
-    pubkey: registered.pubkey,
-    hostname: registered.hostname,
-    registeredAt: new Date().toISOString(),
-    boundServers: [{ url: targetUrl, hostId: registered.id }]
+}
+async function collectStatusInfo() {
+  const config2 = loadConfig();
+  const isAuthenticated = hasAuth();
+  const apiUrl = config2.apiUrl ?? "http://localhost:8882";
+  const statusInfo = {
+    configDir: getConfigDir(),
+    apiUrl,
+    authenticated: isAuthenticated,
+    defaultInstance: config2.defaultInstance ?? "-",
+    format: config2.format ?? "auto (TTY detection)"
   };
-  writeHostMetadata(meta);
-  success(`Operator-host registered: ${meta.hostId} (server: ${serverName})`);
-  data({
-    hostId: meta.hostId,
-    hostname: meta.hostname,
-    pubkey: meta.pubkey,
-    boundServers: meta.boundServers,
-    keysDir: "~/.omni/keys/",
-    nextStep: `Calls to '${serverName}' will now be signed automatically; other server entries stay bearer-only until you run \`omni trust handshake --server <name>\` against them. Run \`omni trust list\` to verify (lastSeenAt should advance after subsequent calls).`
-  });
+  const serverVersion = await checkApiHealth(statusInfo, apiUrl);
+  if (isAuthenticated) {
+    const client = getOptionalClient();
+    if (client) {
+      await validateAuthKey(statusInfo, client);
+    }
+  }
+  const processes = await getProcessStatus();
+  if (processes !== null) {
+    statusInfo.processes = processes;
+  }
+  return { statusInfo, serverVersion, processes };
 }
-async function handleRevoke2(id) {
-  try {
-    const { data: data2 } = await callApi("DELETE", `/hosts/${encodeURIComponent(id)}`);
-    success(`Revoked genie host ${data2.id} (${data2.hostname}). Tombstone kept for audit.`);
-    data(data2);
-  } catch (err2) {
-    error(`Failed to revoke genie host: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
+function renderHumanExtras(serverVersion, processes) {
+  if (serverVersion) {
+    raw(formatStatusVersionHint(VERSION, serverVersion));
+  }
+  if (processes !== null && processes.length > 0) {
+    header("Services");
+    list(processes);
+  } else if (processes !== null) {
+    header("Services");
+    dim("No omni services running. Start with: omni start");
   }
 }
-function createTrustCommand() {
-  const trust = new Command("trust").description("Manage genie host fingerprint registrations");
-  trust.command("handshake").description("Register THIS omni CLI as a host with the targeted server (mints ed25519 keypair in ~/.omni/keys/ on first run; later servers reuse it).").addHelpText("after", `
-Signing is per-server: only servers you have handshaken against recognize this
-keypair, so calls to other entries stay bearer-only. Bind another one with:
-  omni trust handshake --server <name>
-`).option("--rotate", "Issue a new keypair even if one already exists (unbinds every previously bound server)").option("--hostname <name>", "Override the hostname reported to omni (defaults to os.hostname())").action(handleHandshake);
-  trust.command("list").description("List active (non-revoked) genie hosts").action(handleList6);
-  trust.command("get <id>").description("Show details for one genie host (active or revoked)").action(handleGet4);
-  trust.command("update <id>").description("Replace a genie host scopes (comma-separated)").requiredOption("--scope <list>", 'Comma-separated scope list, e.g. "agents:write,providers:write"').action(handleUpdate3);
-  trust.command("revoke <id>").description("Revoke a genie host (irreversible \u2014 re-register with a fresh keypair to restore trust)").action(handleRevoke2);
-  return trust;
+function createStatusCommand() {
+  const status = new Command("status").description("Show API health and connection info").action(async () => {
+    const { statusInfo, serverVersion, processes } = await collectStatusInfo();
+    data(statusInfo);
+    if (getCurrentFormat() === "human") {
+      renderHumanExtras(serverVersion, processes);
+    }
+  });
+  return status;
 }
 
-// src/commands/tts.ts
+// src/commands/stop.ts
 init_output();
-function createTtsCommand() {
-  const tts = new Command("tts").description("Text-to-speech operations");
-  tts.command("voices").description("List available TTS voices").action(async () => {
-    const client = getClient();
-    try {
-      const voices = await client.messages.listVoices();
-      if (voices.length === 0) {
-        info("No TTS voices available. Check ElevenLabs configuration.");
-        return;
-      }
-      const items = voices.map((v4) => ({
-        voiceId: v4.voiceId,
-        name: v4.name,
-        category: v4.category ?? "-"
-      }));
-      list(items, { emptyMessage: "No voices found." });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to list voices: ${message2}`);
-    }
-  });
-  return tts;
+var LEGACY_PROCESSES = ["omni-v2-api", "omni-v2-nats"];
+async function runStop() {
+  if (!await isPm2Available()) {
+    pm2NotFoundError();
+  }
+  info("Stopping omni services...");
+  for (const name of Object.values(PM2_PROCESSES)) {
+    await runPm2(["delete", name]);
+  }
+  for (const name of LEGACY_PROCESSES) {
+    await runPm2(["delete", name]);
+  }
+  success("Omni services stopped");
+}
+function createStopCommand() {
+  return new Command("stop").description("Stop all omni PM2 processes").action(runStop);
 }
 
-// src/commands/turns.ts
+// src/commands/tenants.ts
 init_output();
-function formatDuration2(startedAt, closedAt) {
-  const start = new Date(startedAt).getTime();
-  const end = closedAt ? new Date(closedAt).getTime() : Date.now();
-  const ms = end - start;
-  if (ms < 1000)
-    return `${ms}ms`;
-  if (ms < 60000)
-    return `${Math.round(ms / 1000)}s`;
-  return `${Math.round(ms / 60000)}m`;
+var TENANT_ROLES = ["tenant-owner", "tenant-admin", "tenant-operator", "tenant-viewer"];
+var MEMBERSHIP_STATUSES = ["active", "disabled"];
+var REASON_REQUIRED_HINT = "Every platform control-plane call is audited; " + 'provide a justification of 3-500 characters, e.g. --reason "onboarding request OPS-1421".';
+var CONTROL_PLANE_UNAVAILABLE = "the platform control plane is not available on this server. " + "Either multitenancy is disabled (start the API with OMNI_MULTITENANCY_ENABLED=true) " + "or the server predates the tenant control plane \u2014 upgrade it.";
+var CREDENTIAL_REJECTED_401 = "the server rejected the credential (401). " + "The platform control plane accepts only PLATFORM-class credentials \u2014 legacy admin/god keys and " + "tenant data-plane keys are denied by design. Authenticate with a platform key: " + "omni auth login --api-key <platform-key>.";
+var CREDENTIAL_FORBIDDEN_403 = "the credential authenticated but is not allowed (403). " + "A PLATFORM-class credential with the matching platform:* scope is required \u2014 tenant-class " + "credentials can never reach the control plane, and platform keys act only within their scopes.";
+function requireReason(reason, action) {
+  const trimmed = reason?.trim() ?? "";
+  if (trimmed.length < 3 || trimmed.length > 500) {
+    error(`--reason is required to ${action}. ${REASON_REQUIRED_HINT}`, undefined, 1);
+  }
+  return trimmed;
 }
-function createTurnsCommand() {
-  const cmd = new Command("turns").description("Admin turn management");
-  cmd.command("list").description("List turns with optional filters").option("--status <status>", "Filter by status (open, done, timeout)").option("--instance <id>", "Filter by instance ID").option("--chat <id>", "Filter by chat ID").option("--agent <id>", "Filter by agent ID").option("--limit <n>", "Max results (default 50)", "50").option("--offset <n>", "Offset for pagination (default 0)", "0").action(async (opts) => {
-    const client = getClient();
-    const result = await client.turns.list({
-      status: opts.status,
-      instanceId: opts.instance,
-      chatId: opts.chat,
-      agentId: opts.agent,
-      limit: Number(opts.limit),
-      offset: Number(opts.offset)
-    });
-    const rows = result.items.map((t) => ({
-      id: t.id.slice(0, 8),
-      status: t.status,
-      chat: t.chatId.length > 20 ? `${t.chatId.slice(0, 20)}\u2026` : t.chatId,
-      agent: t.agentId.slice(0, 8),
-      duration: formatDuration2(t.startedAt, t.closedAt),
-      nudges: t.nudgeCount,
-      msgs: t.messagesSent
-    }));
-    list(rows, {
-      emptyMessage: "No turns found.",
-      rawData: result.items
-    });
-    if (getCurrentFormat() !== "json") {
-      dim(`Total: ${result.total} | Showing ${result.offset + 1}\u2013${result.offset + result.items.length}`);
-    }
-  });
-  cmd.command("get").description("Get a single turn by ID").argument("<id>", "Turn ID").action(async (id) => {
-    const client = getClient();
-    const turn = await client.turns.get(id);
-    data(turn);
-  });
-  cmd.command("close").description("Admin force-close a turn").argument("<id>", "Turn ID to close").option("--reason <text>", "Close reason").action(async (id, opts) => {
-    const client = getClient();
-    const result = await client.turns.forceClose(id, opts.reason);
-    success(`Turn ${result.turnId} closed`, result);
-  });
-  cmd.command("close-all").description("Bulk close all open turns (requires --confirm)").option("--confirm", "Confirm bulk close").option("--reason <text>", "Close reason").action(async (opts) => {
-    if (!opts.confirm) {
-      error("Bulk close requires --confirm flag to proceed.");
-    }
-    const client = getClient();
-    const result = await client.turns.bulkClose(opts.reason);
-    success(result.message, result);
-  });
-  cmd.command("stats").description("Show aggregate turn metrics").action(async () => {
-    const client = getClient();
-    const stats = await client.turns.stats();
-    data({
-      openCount: stats.openCount,
-      totalCount: stats.totalCount,
-      avgDurationMs: stats.avgDurationMs,
-      timeoutRate: `${(stats.timeoutRate * 100).toFixed(1)}%`
-    });
-  });
-  return cmd;
-}
-
-// src/commands/update.ts
-import { existsSync as existsSync20 } from "fs";
-import { join as join19 } from "path";
-import { createInterface as createInterface3 } from "readline";
-init_source();
-init_config();
-
-// src/sidecar-cleanup.ts
-var SIDECAR_BASENAME = "nats-reply-sidecar.mjs";
-var SIDECAR_NAME_HINT = "nats-reply-sidecar";
-function pm2EntryToMatch(entry) {
-  if (!entry || typeof entry !== "object")
-    return null;
-  const name = typeof entry.name === "string" ? entry.name : "";
-  const scriptPath = typeof entry.pm2_env?.pm_exec_path === "string" ? entry.pm2_env.pm_exec_path : "";
-  const pmId = typeof entry.pm_id === "number" ? entry.pm_id : null;
-  const nameMatch = name.includes(SIDECAR_NAME_HINT);
-  const pathMatch = scriptPath.endsWith(`/${SIDECAR_BASENAME}`) || scriptPath.endsWith(SIDECAR_BASENAME);
-  if (!nameMatch && !pathMatch)
-    return null;
-  return {
-    name,
-    pmId,
-    scriptPath,
-    matchedBy: nameMatch ? "name" : "script-path"
-  };
-}
-function parsePm2SidecarMatches(rawJson) {
-  const trimmed = rawJson.trim();
-  if (trimmed.length === 0 || trimmed === "[]")
-    return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return [];
-  }
-  if (!Array.isArray(parsed))
-    return [];
-  const matches = [];
-  for (const entry of parsed) {
-    const match = pm2EntryToMatch(entry);
-    if (match !== null)
-      matches.push(match);
+function parseRole(value) {
+  if (!TENANT_ROLES.includes(value)) {
+    error(`Invalid --role "${value}". Valid roles: ${TENANT_ROLES.join(", ")}`, undefined, 1);
   }
-  return matches;
+  return value;
 }
-function parseRawSidecarMatches(rawPgrep) {
-  const lines = rawPgrep.split(`
-`);
-  const matches = [];
-  for (const line3 of lines) {
-    const trimmed = line3.trim();
-    if (trimmed.length === 0)
-      continue;
-    const firstSpace = trimmed.indexOf(" ");
-    if (firstSpace === -1)
-      continue;
-    const pidStr = trimmed.slice(0, firstSpace);
-    const command = trimmed.slice(firstSpace + 1);
-    const pid = Number.parseInt(pidStr, 10);
-    if (!Number.isFinite(pid) || pid <= 0)
-      continue;
-    if (!command.includes(SIDECAR_BASENAME))
-      continue;
-    matches.push({ pid, command });
+function parseStatus(value) {
+  if (!MEMBERSHIP_STATUSES.includes(value)) {
+    error(`Invalid --status "${value}". Valid statuses: ${MEMBERSHIP_STATUSES.join(", ")}`, undefined, 1);
   }
-  return matches;
+  return value;
 }
-async function detectPm2Sidecars() {
-  try {
-    const proc = Bun.spawn({
-      cmd: ["pm2", "jlist"],
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
-    if (exitCode !== 0)
-      return [];
-    return parsePm2SidecarMatches(stdout);
-  } catch {
-    return [];
+function parseScopes(value) {
+  const scopes = value.split(",").map((s2) => s2.trim()).filter((s2) => s2.length > 0);
+  if (scopes.length === 0) {
+    error('--scopes must list at least one explicit tenant scope (comma-separated), e.g. --scopes "messages:send,chats:read".', undefined, 1);
   }
+  return scopes;
 }
-async function detectRawSidecars() {
+function parseConstraints(value) {
+  const invalid = () => error(`Invalid --constraints "${value}". Expected a JSON object of string arrays, e.g. '{"instanceAllowlist":["<instance-id>"]}'.`, undefined, 1);
+  let parsed;
   try {
-    const proc = Bun.spawn({
-      cmd: ["pgrep", "-fa", SIDECAR_BASENAME],
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
-    if (exitCode !== 0 && exitCode !== 1)
-      return [];
-    const matches = parseRawSidecarMatches(stdout);
-    const ownPid = process.pid;
-    return matches.filter((m10) => m10.pid !== ownPid);
+    parsed = JSON.parse(value);
   } catch {
-    return [];
+    invalid();
   }
-}
-async function stopPm2Sidecar(match) {
-  const target = match.name.length > 0 ? match.name : match.pmId !== null ? String(match.pmId) : null;
-  if (target === null)
-    return false;
-  for (const verb of ["stop", "delete"]) {
-    const proc = Bun.spawn({
-      cmd: ["pm2", verb, target],
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const exitCode = await proc.exited;
-    if (exitCode !== 0)
-      return false;
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    invalid();
   }
-  return true;
-}
-async function killRawSidecar(match) {
-  try {
-    process.kill(match.pid, "SIGTERM");
-    return true;
-  } catch {
-    return false;
+  const record2 = parsed;
+  for (const entry of Object.values(record2)) {
+    if (!Array.isArray(entry) || entry.some((item) => typeof item !== "string")) {
+      invalid();
+    }
   }
+  return record2;
 }
-async function cleanupSidecars() {
-  const [pm2Detected, rawDetected] = await Promise.all([detectPm2Sidecars(), detectRawSidecars()]);
-  const pm2Stopped = [];
-  const pm2Failed = [];
-  for (const match of pm2Detected) {
-    const ok3 = await stopPm2Sidecar(match);
-    if (ok3) {
-      pm2Stopped.push(match);
-    } else {
-      pm2Failed.push(match);
+function renderPlatformError(err2, action) {
+  if (err2 instanceof OmniApiError) {
+    if (err2.status === 404 && err2.message.startsWith("Endpoint not found")) {
+      error(`Failed to ${action}: ${CONTROL_PLANE_UNAVAILABLE}`, undefined, 1);
+    }
+    if (err2.status === 401) {
+      error(`Failed to ${action}: ${CREDENTIAL_REJECTED_401}`, undefined, 1);
+    }
+    if (err2.status === 403) {
+      error(`Failed to ${action}: ${CREDENTIAL_FORBIDDEN_403}`, undefined, 1);
     }
   }
-  const rawKilled = [];
-  const rawFailed = [];
-  for (const match of rawDetected) {
-    const ok3 = await killRawSidecar(match);
-    if (ok3) {
-      rawKilled.push(match);
-    } else {
-      rawFailed.push(match);
+  const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+  error(`Failed to ${action}: ${message2}`);
+}
+var TENANT_NOT_ACTIVE_409 = "the tenant is not active (409). Root keys can be issued only while the tenant is active \u2014 " + "a suspended or archived tenant refuses new credentials.";
+var ROOT_KEY_EXCEEDS_POLICY_403 = "the request exceeds the tenant policy ceilings (403). Keep --expires within the tenant " + "max-key-ttl and --rate-limit/--budget at or below the tenant ceilings (see: omni tenants get <id>).";
+function renderRootKeyError(err2, action) {
+  if (err2 instanceof OmniApiError) {
+    if (err2.status === 409) {
+      error(`Failed to ${action}: ${TENANT_NOT_ACTIVE_409}`, undefined, 1);
+    }
+    if (err2.status === 400) {
+      error(`Failed to ${action}: ${err2.message}`, undefined, 1);
+    }
+    if (err2.status === 403 && err2.message.includes("exceeds tenant policy")) {
+      error(`Failed to ${action}: ${ROOT_KEY_EXCEEDS_POLICY_403}`, undefined, 1);
     }
   }
+  renderPlatformError(err2, action);
+}
+function formatTenantRow(tenant) {
   return {
-    pm2Detected,
-    rawDetected,
-    pm2Stopped,
-    pm2Failed,
-    rawKilled,
-    rawFailed
+    id: tenant.id,
+    slug: tenant.slug,
+    name: tenant.displayName,
+    status: tenant.status,
+    keyTtl: tenant.maxKeyTtlSeconds,
+    keyRate: tenant.maxKeyRateLimit,
+    keyBudget: tenant.maxKeyBudget,
+    created: new Date(tenant.createdAt).toLocaleDateString()
   };
 }
-function formatCleanupSummary(result) {
-  const totalDetected = result.pm2Detected.length + result.rawDetected.length;
-  if (totalDetected === 0)
-    return "";
-  const lines = [];
-  lines.push(`Found ${totalDetected} legacy nats-reply-sidecar process(es) \u2014 stopping to prevent duplicate replies.`);
-  for (const match of result.pm2Stopped) {
-    const label = match.name || `pm_id=${match.pmId}`;
-    lines.push(`  \u2713 pm2: stopped and deleted "${label}" (matched by ${match.matchedBy})`);
-  }
-  for (const match of result.pm2Failed) {
-    const label = match.name || `pm_id=${match.pmId}`;
-    lines.push(`  \u2717 pm2: failed to stop "${label}" \u2014 run \`pm2 stop ${label} && pm2 delete ${label}\` manually`);
-  }
-  for (const match of result.rawKilled) {
-    lines.push(`  \u2713 raw: SIGTERM sent to pid ${match.pid}`);
-  }
-  for (const match of result.rawFailed) {
-    lines.push(`  \u2717 raw: failed to signal pid ${match.pid} \u2014 kill it manually with \`kill ${match.pid}\``);
-  }
-  if (result.pm2Failed.length > 0 || result.rawFailed.length > 0) {
-    lines.push("See docs/migration/nats-genie-sidecar-decommission.md for the manual cleanup runbook.");
-  }
-  return lines.join(`
-`);
-}
-
-// src/legacy-cleanup.ts
-function createNatsReplySidecarArtifact() {
-  let lastResult = null;
+function formatMembershipRow(membership) {
   return {
-    name: "nats-reply-sidecar",
-    async detect() {
-      return true;
-    },
-    async cleanup() {
-      const result = await cleanupSidecars();
-      lastResult = result;
-      const removed = [];
-      const warnings = [];
-      for (const m10 of result.pm2Stopped) {
-        removed.push(`pm2:${m10.name.length > 0 ? m10.name : `pm_id=${m10.pmId}`}`);
-      }
-      for (const m10 of result.rawKilled) {
-        removed.push(`pid:${m10.pid}`);
-      }
-      for (const m10 of result.pm2Failed) {
-        warnings.push(`pm2-failed:${m10.name.length > 0 ? m10.name : `pm_id=${m10.pmId}`}`);
-      }
-      for (const m10 of result.rawFailed) {
-        warnings.push(`raw-failed:pid=${m10.pid}`);
-      }
-      return { removed, warnings };
-    },
-    summary() {
-      return lastResult === null ? "" : formatCleanupSummary(lastResult);
-    }
+    id: membership.id,
+    principal: membership.principalId,
+    role: membership.role,
+    status: membership.status,
+    invitedBy: membership.invitedByPrincipalId ?? "-",
+    created: new Date(membership.createdAt).toLocaleDateString()
   };
 }
-var REGISTRY = [createNatsReplySidecarArtifact()];
-function errorMessage2(error2) {
-  return error2 instanceof Error ? error2.message : String(error2);
+async function handleList5(client, options3) {
+  const reason = requireReason(options3.reason, "list tenants");
+  const result = await client.platform.tenants.list(reason);
+  list(result.items.map(formatTenantRow), {
+    emptyMessage: "No tenants found.",
+    rawData: result.items
+  });
 }
-function erroredOutcome(name, phase, error2) {
-  const message2 = errorMessage2(error2);
-  return {
-    name,
-    state: "errored",
-    removed: [],
-    warnings: [`${phase}-threw:${message2}`],
-    summary: "",
-    error: message2
-  };
+async function handleGet3(client, id, options3) {
+  const reason = requireReason(options3.reason, "read a tenant");
+  const tenant = await client.platform.tenants.get(id, reason);
+  data(tenant);
 }
-async function runArtifact(artifact) {
-  let detected;
-  try {
-    detected = await artifact.detect();
-  } catch (error2) {
-    return erroredOutcome(artifact.name, "detect", error2);
-  }
-  if (!detected) {
-    return {
-      name: artifact.name,
-      state: "not-detected",
-      removed: [],
-      warnings: [],
-      summary: ""
-    };
-  }
-  try {
-    const { removed, warnings } = await artifact.cleanup();
-    return {
-      name: artifact.name,
-      state: "ran",
-      removed,
-      warnings,
-      summary: artifact.summary()
-    };
-  } catch (error2) {
-    return erroredOutcome(artifact.name, "cleanup", error2);
-  }
+async function handleCreate4(client, options3) {
+  const reason = requireReason(options3.reason, "create a tenant");
+  const tenant = await client.platform.tenants.create({
+    slug: options3.slug,
+    displayName: options3.name,
+    maxKeyTtlSeconds: options3.maxKeyTtl,
+    maxKeyRateLimit: options3.maxKeyRate,
+    maxKeyBudget: options3.maxKeyBudget,
+    reason
+  });
+  success(`Tenant created: ${tenant.slug} (${tenant.id})`);
+  data(tenant);
 }
-async function cleanupLegacyArtifacts(skipList) {
-  const outcomes = [];
-  const skipped = [];
-  for (const artifact of REGISTRY) {
-    if (skipList.has(artifact.name)) {
-      skipped.push(artifact.name);
-      outcomes.push({
-        name: artifact.name,
-        state: "skipped",
-        removed: [],
-        warnings: [],
-        summary: ""
-      });
-      continue;
-    }
-    outcomes.push(await runArtifact(artifact));
-  }
-  const succeeded = outcomes.every((o2) => o2.state !== "errored" && (o2.state !== "ran" || o2.warnings.length === 0));
-  return { outcomes, succeeded, skipped };
+async function handleSuspend(client, id, options3) {
+  const reason = requireReason(options3.reason, "suspend a tenant");
+  const tenant = await client.platform.tenants.suspend(id, reason);
+  success(`Tenant suspended: ${tenant.slug} (${tenant.id})`);
+  info(`Reason: ${reason}`);
 }
-
-// src/commands/update.ts
-init_output();
-
-// src/update-diagnostics.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
-import { homedir as homedir13 } from "os";
-import { join as join18 } from "path";
-var UPDATE_DIAGNOSTICS_SCHEMA_VERSION = 1;
-function createDiagnostics(args) {
-  const startedAt = new Date().toISOString();
-  return {
-    schemaVersion: UPDATE_DIAGNOSTICS_SCHEMA_VERSION,
-    startedAt,
-    finishedAt: startedAt,
-    cli: { runningVersion: args.runningVersion, channel: args.channel },
-    registry: { latestVersion: null },
-    preflight: { ran: false, blocked: false },
-    install: { attempted: false, succeeded: null, targetVersion: null },
-    restart: { attempted: false, succeeded: null, services: [] },
-    verify: null,
-    cleanups: null,
-    maintenance: null,
-    parallelNpmGlobal: null,
-    recentLogSignals: [],
-    exitCode: 0
-  };
+async function handleArchive(client, id, options3) {
+  const reason = requireReason(options3.reason, "archive a tenant");
+  const tenant = await client.platform.tenants.archive(id, reason);
+  success(`Tenant archived: ${tenant.slug} (${tenant.id})`);
+  warn("Archived is terminal \u2014 there is no un-archive and no hard delete.");
+  info(`Reason: ${reason}`);
 }
-function getDiagnosticsDir() {
-  const base = process.env.OMNI_CONFIG_DIR ?? join18(homedir13(), ".omni");
-  return join18(base, "logs");
+async function handleMembershipsList(client, tenantId, options3) {
+  const reason = requireReason(options3.reason, "list memberships");
+  const result = await client.platform.tenants.memberships.list(tenantId, reason);
+  list(result.items.map(formatMembershipRow), {
+    emptyMessage: "No memberships found.",
+    rawData: result.items
+  });
 }
-function getDiagnosticsPath(startedAt) {
-  const safe = startedAt.replace(/:/g, "-");
-  return join18(getDiagnosticsDir(), `update-diagnostics-${safe}.json`);
+async function handleMembershipsAdd(client, tenantId, options3) {
+  const reason = requireReason(options3.reason, "attach a membership");
+  const role = parseRole(options3.role);
+  const membership = await client.platform.tenants.memberships.attach(tenantId, {
+    principalId: options3.principal,
+    role,
+    reason
+  });
+  success(`Membership attached: ${membership.principalId} as ${membership.role} (${membership.id})`);
 }
-function tailFileLines(path, maxLines) {
-  if (!existsSync19(path))
-    return [];
-  try {
-    const raw2 = readFileSync18(path, "utf8");
-    const lines = raw2.split(/\r?\n/);
-    if (lines.length > 0 && lines[lines.length - 1] === "")
-      lines.pop();
-    return lines.slice(-maxLines);
-  } catch {
-    return [];
+async function handleMembershipsDisable(client, tenantId, membershipId, options3) {
+  const reason = requireReason(options3.reason, "disable a membership");
+  const membership = await client.platform.tenants.memberships.disable(tenantId, membershipId, reason);
+  success(`Membership disabled: ${membership.id}`);
+  info(`Reason: ${reason}`);
+}
+async function handleMembershipsStatus(client, tenantId, membershipId, options3) {
+  const reason = requireReason(options3.reason, "set a membership status");
+  const status = parseStatus(options3.status);
+  const membership = await client.platform.tenants.memberships.setStatus(tenantId, membershipId, status, reason);
+  success(`Membership ${membership.id} status set to ${membership.status}`);
+}
+async function handleMembershipsRole(client, tenantId, membershipId, options3) {
+  const reason = requireReason(options3.reason, "set a membership role");
+  const role = parseRole(options3.role);
+  const membership = await client.platform.tenants.memberships.setRole(tenantId, membershipId, role, reason);
+  success(`Membership ${membership.id} role set to ${membership.role}`);
+}
+async function handleKeysIssueRoot(client, tenantId, options3) {
+  const reason = requireReason(options3.reason, "issue a root key");
+  const role = parseRole(options3.role);
+  const scopes = parseScopes(options3.scopes);
+  const constraints = options3.constraints === undefined ? undefined : parseConstraints(options3.constraints);
+  const body = {
+    principalId: options3.principal,
+    membershipId: options3.membership,
+    role,
+    name: options3.name,
+    scopes,
+    expiresAt: options3.expires,
+    rateLimit: options3.rateLimit,
+    budget: options3.budget,
+    ...constraints ? { resourceConstraints: constraints } : {},
+    reason
+  };
+  const result = await client.platform.tenants.keys.issueRoot(tenantId, body);
+  if (getCurrentFormat() === "json") {
+    warn("plainTextKey is shown once and can never be retrieved again \u2014 store it now.");
+    data(result);
+    return;
   }
+  const { plainTextKey, ...issued } = result;
+  success(`Root key issued: ${issued.name} (${issued.id})`);
+  warn("The key below is shown ONCE and can never be retrieved again \u2014 store it now.");
+  raw(`
+  ${plainTextKey}
+`);
+  data(issued);
 }
-function collectRecentLogSignals(maxLinesPerStream = 30, logPathsFor = getPm2LogPaths) {
-  const signals2 = [];
-  for (const name of Object.values(PM2_PROCESSES)) {
-    const { out, error: error2 } = logPathsFor(name);
-    const outLines = tailFileLines(out, maxLinesPerStream);
-    if (outLines.length > 0) {
-      signals2.push({ source: name, stream: "out", lines: outLines });
+var REASON_HELP = "Audited justification (required, 3-500 chars)";
+function createTenantsCommand() {
+  const tenants2 = new Command("tenants").description("Platform tenant control plane (requires a PLATFORM-class credential and OMNI_MULTITENANCY_ENABLED=true)");
+  tenants2.command("list").description("List tenants, newest first (the read itself is audited)").option("--reason <text>", REASON_HELP).action(async (options3) => {
+    const client = getClient();
+    try {
+      await handleList5(client, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "list tenants");
     }
-    const errLines = tailFileLines(error2, maxLinesPerStream);
-    if (errLines.length > 0) {
-      signals2.push({ source: name, stream: "error", lines: errLines });
+  });
+  tenants2.command("get <id>").description("Get one tenant by id").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
+    const client = getClient();
+    try {
+      await handleGet3(client, id, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "get the tenant");
     }
-  }
-  return signals2;
-}
-function writeDiagnostics(state, exitCode) {
-  state.exitCode = exitCode;
-  state.finishedAt = new Date().toISOString();
-  if (state.recentLogSignals.length === 0) {
-    state.recentLogSignals = collectRecentLogSignals();
-  }
-  const dir = getDiagnosticsDir();
-  const path = getDiagnosticsPath(state.startedAt);
-  try {
-    if (!existsSync19(dir)) {
-      mkdirSync12(dir, { recursive: true, mode: 448 });
+  });
+  tenants2.command("create").description("Create a tenant with its mandatory credential ceilings").requiredOption("--slug <slug>", "Immutable lowercase DNS-like slug (e.g. acme)").requiredOption("--name <name>", "Human-readable tenant name").requiredOption("--max-key-ttl <seconds>", "Ceiling for credential TTL, in seconds", Number.parseInt).requiredOption("--max-key-rate <n>", "Ceiling for credential rate limit", Number.parseInt).requiredOption("--max-key-budget <n>", "Ceiling for credential budget", Number.parseInt).option("--reason <text>", REASON_HELP).action(async (options3) => {
+    const client = getClient();
+    try {
+      await handleCreate4(client, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "create the tenant");
     }
-    writeFileSync11(path, `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
-    return path;
-  } catch {
-    return null;
-  }
+  });
+  tenants2.command("suspend <id>").description("Suspend a tenant (bumps its revocation epoch, invalidating tenant credentials)").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
+    const client = getClient();
+    try {
+      await handleSuspend(client, id, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "suspend the tenant");
+    }
+  });
+  tenants2.command("archive <id>").description("Archive a tenant (TERMINAL \u2014 no un-archive, no hard delete)").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
+    const client = getClient();
+    try {
+      await handleArchive(client, id, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "archive the tenant");
+    }
+  });
+  const memberships = new Command("memberships").description("Manage tenant memberships");
+  memberships.command("list <tenant-id>").description("List the memberships of one tenant (the read itself is audited)").option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsList(client, tenantId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "list memberships");
+    }
+  });
+  memberships.command("add <tenant-id>").description("Grant a principal a role in the tenant").requiredOption("--principal <uuid>", "Principal to grant access to").requiredOption("--role <role>", `Tenant role: ${TENANT_ROLES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsAdd(client, tenantId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "attach the membership");
+    }
+  });
+  memberships.command("disable <tenant-id> <membership-id>").description("Disable a membership (memberships are never hard-deleted)").option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsDisable(client, tenantId, membershipId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "disable the membership");
+    }
+  });
+  memberships.command("status <tenant-id> <membership-id>").description("Activate or disable an existing membership").requiredOption("--status <status>", `New status: ${MEMBERSHIP_STATUSES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsStatus(client, tenantId, membershipId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "set the membership status");
+    }
+  });
+  memberships.command("role <tenant-id> <membership-id>").description("Change the role an existing membership acts under").requiredOption("--role <role>", `New role: ${TENANT_ROLES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsRole(client, tenantId, membershipId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "set the membership role");
+    }
+  });
+  tenants2.addCommand(memberships);
+  const keys = new Command("keys").description("Manage tenant credentials");
+  keys.command("issue-root <tenant-id>").description("Issue the initial tenant ROOT key (the plaintext is shown ONCE and never again)").requiredOption("--principal <uuid>", "Principal the key acts as (must hold the membership)").requiredOption("--membership <uuid>", "Active membership binding the principal to the tenant").requiredOption("--role <role>", `Tenant role: ${TENANT_ROLES.join(" | ")}`).requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <list>", "Comma-separated explicit tenant scopes (platform/wildcard scopes are refused)").requiredOption("--expires <iso>", "Expiry (ISO 8601); must be in the future and within the tenant TTL ceiling").requiredOption("--rate-limit <n>", "Rate limit; capped by the tenant policy ceiling", Number.parseInt).requiredOption("--budget <n>", "Budget; capped by the tenant policy ceiling", Number.parseInt).option("--constraints <json>", `Optional resource allowlists as JSON, e.g. '{"instanceAllowlist":["<id>"]}'`).option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
+    const client = getClient();
+    try {
+      await handleKeysIssueRoot(client, tenantId, options3);
+    } catch (err2) {
+      renderRootKeyError(err2, "issue the root key");
+    }
+  });
+  tenants2.addCommand(keys);
+  return tenants2;
 }
 
-// src/commands/update.ts
-var PACKAGE_NAME = "@automagik/omni";
-var UPDATE_HEALTH_TIMEOUT_MS = 1e4;
-var VERIFY_POLL_INTERVAL_MS = 500;
-function resolveChannel(options3, config2) {
-  if (options3.next)
-    return "next";
-  if (options3.stable)
-    return "latest";
-  const saved = (config2 ?? loadConfig()).updateChannel;
-  if (saved === "latest" || saved === "next")
-    return saved;
-  return "latest";
+// src/commands/trust.ts
+import { hostname as osHostname } from "os";
+init_config();
+init_output();
+function targetBaseUrl() {
+  return normalizeServerUrl(loadConfig().apiUrl ?? "http://localhost:8882");
 }
-function persistChannel(channel2) {
-  try {
-    const config2 = loadConfig();
-    config2.updateChannel = channel2;
-    saveConfig(config2);
-  } catch {}
+function trustEndpoint(path) {
+  if (!hasAuth()) {
+    exitNotAuthenticated();
+  }
+  return `${targetBaseUrl()}/api/v2/trust${path}`;
 }
-async function fetchLatestVersion(channel2) {
-  try {
-    const proc = Bun.spawn({
-      cmd: ["bunx", "npm", "view", `${PACKAGE_NAME}@${channel2}`, "version"],
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
-    if (exitCode !== 0) {
-      return null;
-    }
-    const text3 = stdout.trim();
-    return text3.length > 0 ? text3 : null;
-  } catch {
-    return null;
+function authHeaders() {
+  const config2 = loadConfig();
+  const headers = { "Content-Type": "application/json" };
+  if (config2.apiKey) {
+    headers.Authorization = `Bearer ${config2.apiKey}`;
   }
+  return headers;
 }
-function getRunningPm2Services() {
-  try {
-    const result = Bun.spawnSync({
-      cmd: ["pm2", "jlist"],
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    if (result.exitCode !== 0) {
-      return [];
-    }
-    const raw2 = new TextDecoder().decode(result.stdout).trim();
-    if (!raw2 || raw2 === "[]")
-      return [];
-    const pm2Names = new Set(Object.values(PM2_PROCESSES));
-    const list2 = JSON.parse(raw2);
-    const running = new Set;
-    for (const proc of list2) {
-      const name = proc.name;
-      if (name && pm2Names.has(name) && proc.pm2_env?.status === "online") {
-        running.add(name);
-      }
-    }
-    return [...running];
-  } catch {
-    return [];
+var _cachedSigningContext;
+function getSigningContextOnce() {
+  if (_cachedSigningContext === undefined) {
+    _cachedSigningContext = loadSigningContextForServer(targetBaseUrl());
   }
+  return _cachedSigningContext;
 }
-async function installLatest(channel2) {
-  const proc = Bun.spawn({
-    cmd: ["bun", "add", "-g", "--force", "--no-cache", `${PACKAGE_NAME}@${channel2}`],
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env: process.env
+async function callApi(method, path, body) {
+  const url = trustEndpoint(path);
+  const bodyString = body === undefined ? "" : JSON.stringify(body);
+  const headers = authHeaders();
+  const ctx = getSigningContextOnce();
+  if (ctx && !path.startsWith("/handshake")) {
+    const reqPath = new URL(url).pathname + new URL(url).search;
+    const sigHeaders = ctx.signRequest(method, reqPath, bodyString);
+    Object.assign(headers, sigHeaders);
+  }
+  const res = await fetch(url, {
+    method,
+    headers,
+    body: body === undefined ? undefined : bodyString
   });
-  const exitCode = await proc.exited;
-  return exitCode === 0;
+  if (!res.ok) {
+    const text3 = await res.text().catch(() => "");
+    throw new Error(`HTTP ${res.status} ${res.statusText}${text3 ? `: ${text3}` : ""}`);
+  }
+  return await res.json();
 }
-async function restartPm2Services(processNames) {
-  const serverConfig = loadServerConfig();
-  const cliConfig = loadLocalRuntimeConfig();
-  const runtimeEnv = buildRuntimeEnv(serverConfig, cliConfig);
-  let allSucceeded = true;
-  for (const name of processNames) {
-    const proc = Bun.spawn({
-      cmd: ["pm2", "restart", name],
-      stdout: "pipe",
-      stderr: "pipe",
-      env: { ...process.env, ...runtimeEnv }
+function formatHostRow(host) {
+  return {
+    id: host.id.slice(0, 8),
+    hostname: host.hostname,
+    scopes: host.scopes.join(", ") || "(none)",
+    pubkeyPrefix: `${host.pubkey.slice(0, 12)}\u2026`,
+    lastSeen: host.lastSeenAt ? new Date(host.lastSeenAt).toISOString().replace("T", " ").slice(0, 16) : "never",
+    status: host.revokedAt ? "revoked" : "active"
+  };
+}
+async function handleList6() {
+  try {
+    const { items } = await callApi("GET", "/hosts");
+    list(items.map(formatHostRow), {
+      emptyMessage: "No genie hosts registered. Run `genie omni handshake` from a genie installation to register one.",
+      rawData: items
     });
-    const exitCode = await proc.exited;
-    if (exitCode !== 0) {
-      allSucceeded = false;
-    }
+  } catch (err2) {
+    error(`Failed to list genie hosts: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
   }
-  return allSucceeded;
 }
-function normalizeVersion(version2) {
-  return version2.split("+")[0] ?? version2;
+async function handleGet4(id) {
+  try {
+    const { data: data2 } = await callApi("GET", `/hosts/${encodeURIComponent(id)}`);
+    data(data2);
+  } catch (err2) {
+    error(`Failed to get genie host: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
+  }
 }
-function decideVerify(args) {
-  if (args.skipReason !== undefined) {
-    return { kind: "skipped", reason: args.skipReason };
+async function handleUpdate3(id, options3) {
+  const scopes = options3.scope.split(",").map((s2) => s2.trim()).filter(Boolean);
+  if (scopes.length === 0) {
+    error("--scope must contain at least one scope (use `omni trust revoke <id>` to deny everything).");
   }
-  const cliVersion = normalizeVersion(args.latest);
-  if (args.healthBody === null) {
-    return { kind: "health-unreachable", apiPort: args.apiPort };
-  }
-  const serverVersion = args.healthBody.version ? normalizeVersion(args.healthBody.version) : null;
-  if (!serverVersion || serverVersion !== cliVersion) {
-    return { kind: "version-mismatch", cliVersion, serverVersion };
-  }
-  if (!args.keyValid) {
-    return { kind: "auth-invalid" };
-  }
-  return { kind: "ok", cliVersion, serverVersion };
-}
-function updateErrorVersionMismatch(cli, server) {
-  return `Server version mismatch: cli=v${cli} server=v${server ?? "unknown"}. Run: omni doctor`;
-}
-var UPDATE_ERROR_AUTH_INVALID = "Auth key invalid after restart. Run: omni doctor --fix";
-async function fetchHealthBody(apiPort, timeoutMs) {
-  const url = getHealthCheckUrl(apiPort);
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try {
-      const resp = await fetch(url, {
-        signal: AbortSignal.timeout(1500),
-        headers: { "Accept-Encoding": "identity" }
-      });
-      if (resp.ok) {
-        const body = await resp.json();
-        return body;
-      }
-    } catch {}
-    await Bun.sleep(VERIFY_POLL_INTERVAL_MS);
-  }
-  return null;
-}
-async function validateStoredKey(apiPort) {
-  const cliConfig = loadLocalRuntimeConfig();
-  if (!cliConfig.apiKey) {
-    return false;
-  }
-  const baseUrl = cliConfig.apiUrl ?? `http://localhost:${apiPort}`;
-  try {
-    const client = createOmniClient({ baseUrl, apiKey: cliConfig.apiKey, cliVersion: VERSION });
-    const result = await client.auth.validate();
-    return result.valid === true;
-  } catch {
-    return false;
-  }
-}
-function printVerifyBanner(latest) {
-  console.log(`${source_default.green("\u2713")} CLI:    v${latest}`);
-  console.log(`${source_default.green("\u2713")} Server: v${latest} (healthy)`);
-  console.log(`${source_default.green("\u2713")} Auth:   key valid`);
-}
-function printVerifySkippedBanner(latest) {
-  console.log(`${source_default.green("\u2713")} CLI:    v${latest}`);
-  console.log(`${source_default.yellow("-")} Server: v${latest} (skipped)`);
-  console.log(`${source_default.yellow("-")} Auth:   skipped`);
-}
-function detectParallelNpmGlobalInstall(deps) {
-  const npmRootFn = deps?.npmRoot ?? defaultNpmRoot;
-  const existsFn = deps?.exists ?? existsSync20;
-  let root;
   try {
-    root = npmRootFn();
-  } catch {
-    return { detected: false, skipped: "npm-root-failed" };
-  }
-  if (root === null || root.length === 0) {
-    return { detected: false, skipped: "npm-not-on-path" };
-  }
-  const candidate = join19(root, "@automagik", "omni");
-  if (existsFn(candidate)) {
-    return { detected: true, path: candidate };
+    const { data: data2 } = await callApi("PATCH", `/hosts/${encodeURIComponent(id)}`, { scopes });
+    success(`Updated genie host ${data2.id} scopes: ${data2.scopes.join(", ")}`);
+    data(data2);
+  } catch (err2) {
+    error(`Failed to update genie host: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
   }
-  return { detected: false };
 }
-function defaultNpmRoot() {
+async function registerPubkey(pubkey, hostname) {
   try {
-    const result = Bun.spawnSync({
-      cmd: ["npm", "root", "-g"],
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: 5000
+    const res = await callApi("POST", "/handshake", {
+      pubkey,
+      hostname,
+      capabilities: {
+        client: "omni-cli",
+        platform: process.platform,
+        nodeVersion: process.version
+      }
     });
-    if (result.exitCode !== 0)
-      return null;
-    const text3 = new TextDecoder().decode(result.stdout).trim();
-    return text3.length > 0 ? text3 : null;
-  } catch {
-    return null;
+    return res.data;
+  } catch (err2) {
+    return error(`Handshake failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
 }
-async function runLegacyCleanup(skipList) {
-  const cleanupSpinner = ora("Checking for legacy artifacts to clean up...").start();
-  const report = await cleanupLegacyArtifacts(skipList);
-  cleanupSpinner.stop();
-  for (const outcome of report.outcomes) {
-    if (outcome.state === "ran" && outcome.summary.length > 0) {
-      console.log(outcome.summary);
+async function handleHandshake(options3) {
+  const targetUrl = targetBaseUrl();
+  const serverName = getTargetServerName();
+  const existing = loadHostMetadata();
+  if (existing && !options3.rotate) {
+    const bindings = boundServerBindings(existing);
+    const bound = boundServerUrls(existing);
+    const alreadyBound = bindingForServer(existing, targetUrl);
+    if (alreadyBound) {
+      success(`Already handshook as host ${alreadyBound.hostId} for server '${serverName}' (${targetUrl}). Bound servers: ${bound.join(", ")} (each with its own host id). Requests to any other server entry are sent UNSIGNED (bearer only) \u2014 run \`omni trust handshake --server <name>\` there to bind it. Pass --rotate to issue a new keypair.`);
+      return;
     }
+    const registered2 = await registerPubkey(existing.pubkey, options3.hostname ?? existing.hostname);
+    const meta2 = {
+      ...existing,
+      pubkey: registered2.pubkey,
+      boundServers: [...bindings, { url: targetUrl, hostId: registered2.id }]
+    };
+    writeHostMetadata(meta2);
+    success(`Bound existing host key to server '${serverName}' (${targetUrl}) \u2014 no rotation.`);
+    data({
+      hostId: registered2.id,
+      hostname: meta2.hostname,
+      pubkey: meta2.pubkey,
+      boundServers: meta2.boundServers,
+      rotated: false
+    });
+    return;
   }
-  return report;
-}
-var OMNI_UPDATE_SKIP_MAINTENANCE_ENV = "OMNI_UPDATE_SKIP_MAINTENANCE";
-function resolveMaintenanceSkipReason(args) {
-  if (!args.verifyOk)
-    return "verify-failed";
-  if (args.skipMaintenance === true)
-    return "cli-flag";
-  const raw2 = args.env[OMNI_UPDATE_SKIP_MAINTENANCE_ENV];
-  if (raw2 !== undefined && raw2 !== "" && raw2 !== "0" && raw2.toLowerCase() !== "false") {
-    return "env";
-  }
-  return null;
-}
-function formatMaintenanceSummary(report) {
-  const { ok: ok3, warn: warn2, fail } = report.summary;
-  return `Maintenance: ${ok3} ok, ${warn2} warn, ${fail} fail`;
+  const { pubkeyB64Url } = generateAndStoreKeypair();
+  const hostname = options3.hostname ?? osHostname();
+  const registered = await registerPubkey(pubkeyB64Url, hostname);
+  const meta = {
+    hostId: registered.id,
+    pubkey: registered.pubkey,
+    hostname: registered.hostname,
+    registeredAt: new Date().toISOString(),
+    boundServers: [{ url: targetUrl, hostId: registered.id }]
+  };
+  writeHostMetadata(meta);
+  success(`Operator-host registered: ${meta.hostId} (server: ${serverName})`);
+  data({
+    hostId: meta.hostId,
+    hostname: meta.hostname,
+    pubkey: meta.pubkey,
+    boundServers: meta.boundServers,
+    keysDir: "~/.omni/keys/",
+    nextStep: `Calls to '${serverName}' will now be signed automatically; other server entries stay bearer-only until you run \`omni trust handshake --server <name>\` against them. Run \`omni trust list\` to verify (lastSeenAt should advance after subsequent calls).`
+  });
 }
-async function runPostUpdateMaintenance(args) {
-  if (args.skipReason !== null) {
-    return { outcome: "skipped", durationMs: 0, skipReason: args.skipReason };
-  }
-  const impl = args.runDoctorImpl ?? runDoctor;
-  const startedAt = Date.now();
+async function handleRevoke2(id) {
   try {
-    const doctorReport = await impl({ json: true, dryRun: true });
-    return {
-      outcome: "completed",
-      durationMs: Date.now() - startedAt,
-      doctorReport
-    };
+    const { data: data2 } = await callApi("DELETE", `/hosts/${encodeURIComponent(id)}`);
+    success(`Revoked genie host ${data2.id} (${data2.hostname}). Tombstone kept for audit.`);
+    data(data2);
   } catch (err2) {
-    return {
-      outcome: "failed",
-      durationMs: Date.now() - startedAt,
-      error: err2 instanceof Error ? err2.message : String(err2)
-    };
+    error(`Failed to revoke genie host: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
   }
 }
-async function restartServicesAndVerify(servicesToRestart, latest, options3, diagnostics, finalize) {
-  const apiPort = loadServerConfig().port;
-  diagnostics.restart.attempted = true;
-  diagnostics.restart.services = [...servicesToRestart];
-  const restartSpinner = ora("Restarting services...").start();
-  const restartSucceeded = await restartPm2Services(servicesToRestart);
-  restartSpinner.stop();
-  diagnostics.restart.succeeded = restartSucceeded;
-  if (!restartSucceeded) {
-    warn(`omni CLI updated to v${latest}, but one or more service restarts failed. Run \`omni status\`.`);
-    finalize(1);
-  }
-  let cleanupReport = null;
-  if (options3.legacyCleanup) {
-    cleanupReport = await runLegacyCleanup(options3.skipList);
-    diagnostics.cleanups = cleanupReport;
-  }
-  if (options3.skipVerify) {
-    const result2 = decideVerify({ skipReason: "no-verify-flag" });
-    diagnostics.verify = result2;
-    printVerifySkippedBanner(latest);
-    if (cleanupReport !== null && !cleanupReport.succeeded) {
-      warn("One or more legacy artifacts could not be cleaned up automatically. " + "See messages above and docs/migration/nats-genie-sidecar-decommission.md.");
+function createTrustCommand() {
+  const trust = new Command("trust").description("Manage genie host fingerprint registrations");
+  trust.command("handshake").description("Register THIS omni CLI as a host with the targeted server (mints ed25519 keypair in ~/.omni/keys/ on first run; later servers reuse it).").addHelpText("after", `
+Signing is per-server: only servers you have handshaken against recognize this
+keypair, so calls to other entries stay bearer-only. Bind another one with:
+  omni trust handshake --server <name>
+`).option("--rotate", "Issue a new keypair even if one already exists (unbinds every previously bound server)").option("--hostname <name>", "Override the hostname reported to omni (defaults to os.hostname())").action(handleHandshake);
+  trust.command("list").description("List active (non-revoked) genie hosts").action(handleList6);
+  trust.command("get <id>").description("Show details for one genie host (active or revoked)").action(handleGet4);
+  trust.command("update <id>").description("Replace a genie host scopes (comma-separated)").requiredOption("--scope <list>", 'Comma-separated scope list, e.g. "agents:write,providers:write"').action(handleUpdate3);
+  trust.command("revoke <id>").description("Revoke a genie host (irreversible \u2014 re-register with a fresh keypair to restore trust)").action(handleRevoke2);
+  return trust;
+}
+
+// src/commands/tts.ts
+init_output();
+function createTtsCommand() {
+  const tts = new Command("tts").description("Text-to-speech operations");
+  tts.command("voices").description("List available TTS voices").action(async () => {
+    const client = getClient();
+    try {
+      const voices = await client.messages.listVoices();
+      if (voices.length === 0) {
+        info("No TTS voices available. Check ElevenLabs configuration.");
+        return;
+      }
+      const items = voices.map((v4) => ({
+        voiceId: v4.voiceId,
+        name: v4.name,
+        category: v4.category ?? "-"
+      }));
+      list(items, { emptyMessage: "No voices found." });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to list voices: ${message2}`);
     }
-    const maintenance = await runPostUpdateMaintenance({ skipReason: "verify-failed" });
-    diagnostics.maintenance = maintenance;
-    return;
-  }
-  const verifySpinner = ora("Verifying server version...").start();
-  const healthBody = await fetchHealthBody(apiPort, UPDATE_HEALTH_TIMEOUT_MS);
-  verifySpinner.stop();
-  const keyValid = healthBody !== null ? await validateStoredKey(apiPort) : false;
-  const result = decideVerify({ latest, apiPort, healthBody, keyValid });
-  diagnostics.verify = result;
-  switch (result.kind) {
-    case "ok": {
-      printVerifyBanner(result.cliVersion);
-      if (cleanupReport !== null && !cleanupReport.succeeded) {
-        warn("One or more legacy artifacts could not be cleaned up automatically. " + "See messages above and docs/migration/nats-genie-sidecar-decommission.md.");
-      }
-      const skipReason = resolveMaintenanceSkipReason({
-        verifyOk: true,
-        skipMaintenance: options3.skipMaintenance,
-        env: process.env
-      });
-      const maintenance = await runPostUpdateMaintenance({ skipReason });
-      diagnostics.maintenance = maintenance;
-      if (maintenance.outcome === "completed" && maintenance.doctorReport) {
-        info(formatMaintenanceSummary(maintenance.doctorReport));
-      } else if (maintenance.outcome === "failed") {
-        warn(`Maintenance: skipped (runDoctor failed: ${maintenance.error ?? "unknown error"})`);
-      }
-      return;
-    }
-    case "health-unreachable":
-      warn(`omni CLI updated to v${latest}, but health check failed on port ${result.apiPort}. Run \`omni status\`.`);
-      finalize(1);
-      break;
-    case "version-mismatch":
-      console.error(`${source_default.red("\u2717")} ${updateErrorVersionMismatch(result.cliVersion, result.serverVersion)}`);
-      finalize(1);
-      break;
-    case "auth-invalid":
-      console.error(`${source_default.red("\u2717")} ${UPDATE_ERROR_AUTH_INVALID}`);
-      finalize(1);
-      break;
-  }
+  });
+  return tts;
 }
-async function promptConfirm(question) {
-  const rl = createInterface3({
-    input: process.stdin,
-    output: process.stdout
+
+// src/commands/turns.ts
+init_output();
+function formatDuration2(startedAt, closedAt) {
+  const start = new Date(startedAt).getTime();
+  const end = closedAt ? new Date(closedAt).getTime() : Date.now();
+  const ms = end - start;
+  if (ms < 1000)
+    return `${ms}ms`;
+  if (ms < 60000)
+    return `${Math.round(ms / 1000)}s`;
+  return `${Math.round(ms / 60000)}m`;
+}
+function createTurnsCommand() {
+  const cmd = new Command("turns").description("Admin turn management");
+  cmd.command("list").description("List turns with optional filters").option("--status <status>", "Filter by status (open, done, timeout)").option("--instance <id>", "Filter by instance ID").option("--chat <id>", "Filter by chat ID").option("--agent <id>", "Filter by agent ID").option("--limit <n>", "Max results (default 50)", "50").option("--offset <n>", "Offset for pagination (default 0)", "0").action(async (opts) => {
+    const client = getClient();
+    const result = await client.turns.list({
+      status: opts.status,
+      instanceId: opts.instance,
+      chatId: opts.chat,
+      agentId: opts.agent,
+      limit: Number(opts.limit),
+      offset: Number(opts.offset)
+    });
+    const rows = result.items.map((t) => ({
+      id: t.id.slice(0, 8),
+      status: t.status,
+      chat: t.chatId.length > 20 ? `${t.chatId.slice(0, 20)}\u2026` : t.chatId,
+      agent: t.agentId.slice(0, 8),
+      duration: formatDuration2(t.startedAt, t.closedAt),
+      nudges: t.nudgeCount,
+      msgs: t.messagesSent
+    }));
+    list(rows, {
+      emptyMessage: "No turns found.",
+      rawData: result.items
+    });
+    if (getCurrentFormat() !== "json") {
+      dim(`Total: ${result.total} | Showing ${result.offset + 1}\u2013${result.offset + result.items.length}`);
+    }
   });
-  return new Promise((resolve4) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      const trimmed = answer.trim().toLowerCase();
-      resolve4(trimmed === "" || trimmed === "y" || trimmed === "yes");
+  cmd.command("get").description("Get a single turn by ID").argument("<id>", "Turn ID").action(async (id) => {
+    const client = getClient();
+    const turn = await client.turns.get(id);
+    data(turn);
+  });
+  cmd.command("close").description("Admin force-close a turn").argument("<id>", "Turn ID to close").option("--reason <text>", "Close reason").action(async (id, opts) => {
+    const client = getClient();
+    const result = await client.turns.forceClose(id, opts.reason);
+    success(`Turn ${result.turnId} closed`, result);
+  });
+  cmd.command("close-all").description("Bulk close all open turns (requires --confirm)").option("--confirm", "Confirm bulk close").option("--reason <text>", "Close reason").action(async (opts) => {
+    if (!opts.confirm) {
+      error("Bulk close requires --confirm flag to proceed.");
+    }
+    const client = getClient();
+    const result = await client.turns.bulkClose(opts.reason);
+    success(result.message, result);
+  });
+  cmd.command("stats").description("Show aggregate turn metrics").action(async () => {
+    const client = getClient();
+    const stats = await client.turns.stats();
+    data({
+      openCount: stats.openCount,
+      totalCount: stats.totalCount,
+      avgDurationMs: stats.avgDurationMs,
+      timeoutRate: `${(stats.timeoutRate * 100).toFixed(1)}%`
     });
   });
+  return cmd;
 }
-async function runUpdate(options3) {
-  const channel2 = resolveChannel(options3);
-  if (options3.next || options3.stable) {
-    persistChannel(channel2);
+
+// src/commands/update.ts
+import { existsSync as existsSync20 } from "fs";
+import { join as join19 } from "path";
+import { createInterface as createInterface3 } from "readline";
+init_source();
+init_config();
+
+// src/sidecar-cleanup.ts
+var SIDECAR_BASENAME = "nats-reply-sidecar.mjs";
+var SIDECAR_NAME_HINT = "nats-reply-sidecar";
+function pm2EntryToMatch(entry) {
+  if (!entry || typeof entry !== "object")
+    return null;
+  const name = typeof entry.name === "string" ? entry.name : "";
+  const scriptPath = typeof entry.pm2_env?.pm_exec_path === "string" ? entry.pm2_env.pm_exec_path : "";
+  const pmId = typeof entry.pm_id === "number" ? entry.pm_id : null;
+  const nameMatch = name.includes(SIDECAR_NAME_HINT);
+  const pathMatch = scriptPath.endsWith(`/${SIDECAR_BASENAME}`) || scriptPath.endsWith(SIDECAR_BASENAME);
+  if (!nameMatch && !pathMatch)
+    return null;
+  return {
+    name,
+    pmId,
+    scriptPath,
+    matchedBy: nameMatch ? "name" : "script-path"
+  };
+}
+function parsePm2SidecarMatches(rawJson) {
+  const trimmed = rawJson.trim();
+  if (trimmed.length === 0 || trimmed === "[]")
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return [];
   }
-  const currentClean = VERSION.split("+")[0];
-  const diagnostics = createDiagnostics({ runningVersion: currentClean, channel: channel2 });
-  const finalize = (exitCode) => {
-    const path = writeDiagnostics(diagnostics, exitCode);
-    if (path !== null && process.env.OMNI_UPDATE_DIAGNOSTICS_VERBOSE === "1") {
-      info(`Diagnostics written: ${path}`);
+  if (!Array.isArray(parsed))
+    return [];
+  const matches = [];
+  for (const entry of parsed) {
+    const match = pm2EntryToMatch(entry);
+    if (match !== null)
+      matches.push(match);
+  }
+  return matches;
+}
+function parseRawSidecarMatches(rawPgrep) {
+  const lines = rawPgrep.split(`
+`);
+  const matches = [];
+  for (const line3 of lines) {
+    const trimmed = line3.trim();
+    if (trimmed.length === 0)
+      continue;
+    const firstSpace = trimmed.indexOf(" ");
+    if (firstSpace === -1)
+      continue;
+    const pidStr = trimmed.slice(0, firstSpace);
+    const command = trimmed.slice(firstSpace + 1);
+    const pid = Number.parseInt(pidStr, 10);
+    if (!Number.isFinite(pid) || pid <= 0)
+      continue;
+    if (!command.includes(SIDECAR_BASENAME))
+      continue;
+    matches.push({ pid, command });
+  }
+  return matches;
+}
+async function detectPm2Sidecars() {
+  try {
+    const proc = Bun.spawn({
+      cmd: ["pm2", "jlist"],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    if (exitCode !== 0)
+      return [];
+    return parsePm2SidecarMatches(stdout);
+  } catch {
+    return [];
+  }
+}
+async function detectRawSidecars() {
+  try {
+    const proc = Bun.spawn({
+      cmd: ["pgrep", "-fa", SIDECAR_BASENAME],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    if (exitCode !== 0 && exitCode !== 1)
+      return [];
+    const matches = parseRawSidecarMatches(stdout);
+    const ownPid = process.pid;
+    return matches.filter((m10) => m10.pid !== ownPid);
+  } catch {
+    return [];
+  }
+}
+async function stopPm2Sidecar(match) {
+  const target = match.name.length > 0 ? match.name : match.pmId !== null ? String(match.pmId) : null;
+  if (target === null)
+    return false;
+  for (const verb of ["stop", "delete"]) {
+    const proc = Bun.spawn({
+      cmd: ["pm2", verb, target],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0)
+      return false;
+  }
+  return true;
+}
+async function killRawSidecar(match) {
+  try {
+    process.kill(match.pid, "SIGTERM");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function cleanupSidecars() {
+  const [pm2Detected, rawDetected] = await Promise.all([detectPm2Sidecars(), detectRawSidecars()]);
+  const pm2Stopped = [];
+  const pm2Failed = [];
+  for (const match of pm2Detected) {
+    const ok3 = await stopPm2Sidecar(match);
+    if (ok3) {
+      pm2Stopped.push(match);
+    } else {
+      pm2Failed.push(match);
     }
-    process.exit(exitCode);
+  }
+  const rawKilled = [];
+  const rawFailed = [];
+  for (const match of rawDetected) {
+    const ok3 = await killRawSidecar(match);
+    if (ok3) {
+      rawKilled.push(match);
+    } else {
+      rawFailed.push(match);
+    }
+  }
+  return {
+    pm2Detected,
+    rawDetected,
+    pm2Stopped,
+    pm2Failed,
+    rawKilled,
+    rawFailed
+  };
+}
+function formatCleanupSummary(result) {
+  const totalDetected = result.pm2Detected.length + result.rawDetected.length;
+  if (totalDetected === 0)
+    return "";
+  const lines = [];
+  lines.push(`Found ${totalDetected} legacy nats-reply-sidecar process(es) \u2014 stopping to prevent duplicate replies.`);
+  for (const match of result.pm2Stopped) {
+    const label = match.name || `pm_id=${match.pmId}`;
+    lines.push(`  \u2713 pm2: stopped and deleted "${label}" (matched by ${match.matchedBy})`);
+  }
+  for (const match of result.pm2Failed) {
+    const label = match.name || `pm_id=${match.pmId}`;
+    lines.push(`  \u2717 pm2: failed to stop "${label}" \u2014 run \`pm2 stop ${label} && pm2 delete ${label}\` manually`);
+  }
+  for (const match of result.rawKilled) {
+    lines.push(`  \u2713 raw: SIGTERM sent to pid ${match.pid}`);
+  }
+  for (const match of result.rawFailed) {
+    lines.push(`  \u2717 raw: failed to signal pid ${match.pid} \u2014 kill it manually with \`kill ${match.pid}\``);
+  }
+  if (result.pm2Failed.length > 0 || result.rawFailed.length > 0) {
+    lines.push("See docs/migration/nats-genie-sidecar-decommission.md for the manual cleanup runbook.");
+  }
+  return lines.join(`
+`);
+}
+
+// src/legacy-cleanup.ts
+function createNatsReplySidecarArtifact() {
+  let lastResult = null;
+  return {
+    name: "nats-reply-sidecar",
+    async detect() {
+      return true;
+    },
+    async cleanup() {
+      const result = await cleanupSidecars();
+      lastResult = result;
+      const removed = [];
+      const warnings = [];
+      for (const m10 of result.pm2Stopped) {
+        removed.push(`pm2:${m10.name.length > 0 ? m10.name : `pm_id=${m10.pmId}`}`);
+      }
+      for (const m10 of result.rawKilled) {
+        removed.push(`pid:${m10.pid}`);
+      }
+      for (const m10 of result.pm2Failed) {
+        warnings.push(`pm2-failed:${m10.name.length > 0 ? m10.name : `pm_id=${m10.pmId}`}`);
+      }
+      for (const m10 of result.rawFailed) {
+        warnings.push(`raw-failed:pid=${m10.pid}`);
+      }
+      return { removed, warnings };
+    },
+    summary() {
+      return lastResult === null ? "" : formatCleanupSummary(lastResult);
+    }
+  };
+}
+var REGISTRY = [createNatsReplySidecarArtifact()];
+function errorMessage2(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function erroredOutcome(name, phase, error2) {
+  const message2 = errorMessage2(error2);
+  return {
+    name,
+    state: "errored",
+    removed: [],
+    warnings: [`${phase}-threw:${message2}`],
+    summary: "",
+    error: message2
   };
-  const parallelInstall = detectParallelNpmGlobalInstall();
-  diagnostics.parallelNpmGlobal = parallelInstall;
-  if (parallelInstall.detected && parallelInstall.path) {
-    warn(`Parallel npm-global install of ${PACKAGE_NAME} detected at ${parallelInstall.path}. This may shadow the bun-installed binary on PATH. Recommended: npm uninstall -g ${PACKAGE_NAME}`);
+}
+async function runArtifact(artifact) {
+  let detected;
+  try {
+    detected = await artifact.detect();
+  } catch (error2) {
+    return erroredOutcome(artifact.name, "detect", error2);
   }
-  info(`Channel: ${channel2}${channel2 === "next" ? " (dev builds)" : " (stable)"}`);
-  const versionSpinner = ora(`Checking ${channel2} version of ${PACKAGE_NAME}...`).start();
-  const latest = await fetchLatestVersion(channel2);
-  versionSpinner.stop();
-  diagnostics.registry.latestVersion = latest;
-  if (latest === null) {
-    warn("Could not reach npm registry. Check your network connection and try again.");
-    return finalize(1);
+  if (!detected) {
+    return {
+      name: artifact.name,
+      state: "not-detected",
+      removed: [],
+      warnings: [],
+      summary: ""
+    };
   }
-  if (currentClean === latest) {
-    success(`Already up to date (v${latest}, channel: ${channel2})`);
-    return finalize(0);
+  try {
+    const { removed, warnings } = await artifact.cleanup();
+    return {
+      name: artifact.name,
+      state: "ran",
+      removed,
+      warnings,
+      summary: artifact.summary()
+    };
+  } catch (error2) {
+    return erroredOutcome(artifact.name, "cleanup", error2);
   }
-  info(`Update available: v${currentClean} \u2192 v${latest} (${channel2})`);
-  if (!options3.yes) {
-    const confirmed = await promptConfirm(`Update from v${currentClean} to v${latest}? [Y/n] `);
-    if (!confirmed) {
-      info("Update cancelled.");
-      return finalize(0);
+}
+async function cleanupLegacyArtifacts(skipList) {
+  const outcomes = [];
+  const skipped = [];
+  for (const artifact of REGISTRY) {
+    if (skipList.has(artifact.name)) {
+      skipped.push(artifact.name);
+      outcomes.push({
+        name: artifact.name,
+        state: "skipped",
+        removed: [],
+        warnings: [],
+        summary: ""
+      });
+      continue;
     }
+    outcomes.push(await runArtifact(artifact));
   }
-  const servicesToRestart = options3.restart !== false ? getRunningPm2Services() : [];
-  const installSpinner = ora(`Updating ${PACKAGE_NAME}@${channel2}...`).start();
-  diagnostics.install.attempted = true;
-  diagnostics.install.targetVersion = latest;
-  const installed = await installLatest(channel2);
-  installSpinner.stop();
-  diagnostics.install.succeeded = installed;
-  if (!installed) {
-    warn(`Installation failed. Your current version (v${currentClean}) is still intact.`);
-    return finalize(1);
-  }
-  const sidecarCleanupExplicit = options3.sidecarCleanup === false;
-  if (sidecarCleanupExplicit) {
-    info("--no-sidecar-cleanup (deprecated alias for --no-legacy-cleanup)");
-  }
-  const legacyCleanupEnabled = options3.legacyCleanup !== false && options3.sidecarCleanup !== false;
-  const skipList = parseSkipCleanupList(options3.skipCleanup);
-  if (servicesToRestart.length > 0) {
-    await restartServicesAndVerify(servicesToRestart, latest, {
-      legacyCleanup: legacyCleanupEnabled,
-      skipList,
-      skipMaintenance: options3.skipMaintenance === true,
-      skipVerify: options3.verify === false
-    }, diagnostics, finalize);
-    return finalize(0);
-  }
-  diagnostics.verify = decideVerify({ skipReason: "no-restart" });
-  success(`omni updated to v${latest}`);
-  return finalize(0);
-}
-function parseSkipCleanupList(value) {
-  if (!value)
-    return new Set;
-  const names = value.split(",").map((s2) => s2.trim()).filter((s2) => s2.length > 0);
-  return new Set(names);
+  const succeeded = outcomes.every((o2) => o2.state !== "errored" && (o2.state !== "ran" || o2.warnings.length === 0));
+  return { outcomes, succeeded, skipped };
 }
-function createUpdateCommand() {
-  return new Command("update").description(`Update ${PACKAGE_NAME} to the latest version (restart only services already running)`).option("-y, --yes", "Skip confirmation prompts (non-interactive)").option("--no-restart", "Update CLI only; skip service restarts and verification").option("--no-verify", "Restart services but skip the post-restart probe (use when a release ships a broken /api/v2/health and operators need to roll forward)").option("--no-legacy-cleanup", "Skip every registered legacy-artifact cleanup (e.g. nats-reply-sidecar)").option("--no-sidecar-cleanup", "Deprecated alias for --no-legacy-cleanup").option("--skip-cleanup <names>", 'Comma-separated list of legacy-cleanup registry entries to skip (e.g. "nats-reply-sidecar")').option("--next", "Switch to dev builds (npm @next tag) and persist as default").option("--stable", "Switch to stable releases (npm @latest tag) and persist as default").option("--skip-maintenance", `Skip the post-update maintenance hook (read-only \`omni doctor\` sweep). Also honored via the ${OMNI_UPDATE_SKIP_MAINTENANCE_ENV} env var.`).addHelpText("after", `
-Channels:
-  - stable (default) \u2014 tracks the npm @latest tag, bumped from main branch releases.
-  - next (dev builds) \u2014 tracks the npm @next tag, bumped on every CI-green dev merge.
 
-  Use --next to switch to dev builds; --stable to switch back. The choice is
-  persisted to ~/.omni/config.json under 'updateChannel' so subsequent
-  'omni update' calls stay on the selected track. Check or change manually:
-    omni config get updateChannel
-    omni config set updateChannel next
-    omni config set updateChannel latest
+// src/commands/update.ts
+init_output();
 
-Behavior:
-  - Installs the latest CLI package first.
-  - Restarts tracked Omni services only when they were online before the update.
-  - When that restart path runs, update performs 3-step verification:
-      1. Server version matches the new CLI version (via /api/v2/health).
-      2. Stored CLI API key still validates against the server.
-      3. On success, prints:
-           \u2713 CLI:    v<latest>
-           \u2713 Server: v<latest> (healthy)
-           \u2713 Auth:   key valid
-  - On mismatch, exits non-zero with:
-      "Server version mismatch: cli=v<X> server=v<Y>. Run: omni doctor"
-  - On auth failure, exits non-zero with:
-      "Auth key invalid after restart. Run: omni doctor --fix"
-  - After a successful restart, runs every registered legacy-artifact cleanup.
-    The day-one entry is nats-reply-sidecar: it scans for any legacy
-    nats-reply-sidecar.mjs process (PM2-managed or raw) and stops it. The
-    sidecar was an external workaround for bugs that were fixed in #362;
-    leaving it running causes every agent reply to be delivered twice.
-    Skip every cleanup with --no-legacy-cleanup, or skip a single registry
-    entry with --skip-cleanup=<name1,name2>. The deprecated alias
-    --no-sidecar-cleanup still works and behaves identically. Manual runbook:
-      docs/migration/nats-genie-sidecar-decommission.md
-  - Use --no-restart to skip restart + verification entirely. --no-restart
-    also skips legacy-artifact cleanup; manage those services manually.
-  - Use --no-verify to restart services but skip the post-restart probe.
-    The banner shows the new CLI version on both lines but tags Server /
-    Auth as "(skipped)"; maintenance is auto-skipped because verify never
-    confirmed health.
-  - Detects parallel npm-global installs of ${PACKAGE_NAME} (omni installs
-    via bun-global; an npm-global install hides stale binaries on PATH and
-    confuses 'which omni'). When found, prints a one-line warning naming
-    the offending path; recommended remediation: npm uninstall -g ${PACKAGE_NAME}.
-  - Every invocation writes a diagnostics record to
-    ~/.omni/logs/update-diagnostics-<iso>.json (schemaVersion: 1). Captures
-    install attempt, registry probe, restart outcome, verify result, cleanup
-    registry result, maintenance hook, and a tail of pm2 log signals. Set
-    OMNI_UPDATE_DIAGNOSTICS_VERBOSE=1 to print the path on completion. A
-    failed write never changes the update exit code.
-  - On a successful restart + verify, runs a post-update maintenance hook:
-    a read-only \`omni doctor\` sweep that prints a one-line summary
-    ("Maintenance: <ok> ok, <warn> warn, <fail> fail"). The probe never
-    mutates pm2 / config / DB state (\`omni doctor --fix\` remains the
-    explicit operator action for repair). A failing maintenance call is
-    non-fatal \u2014 exit code stays 0 with a banner warning. Skip with
-    --skip-maintenance or ${OMNI_UPDATE_SKIP_MAINTENANCE_ENV}=1.
-  - Verify runtime health after update with: omni status
-`).action(runUpdate);
+// src/update-diagnostics.ts
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join18 } from "path";
+var UPDATE_DIAGNOSTICS_SCHEMA_VERSION = 1;
+function createDiagnostics(args) {
+  const startedAt = new Date().toISOString();
+  return {
+    schemaVersion: UPDATE_DIAGNOSTICS_SCHEMA_VERSION,
+    startedAt,
+    finishedAt: startedAt,
+    cli: { runningVersion: args.runningVersion, channel: args.channel },
+    registry: { latestVersion: null },
+    preflight: { ran: false, blocked: false },
+    install: { attempted: false, succeeded: null, targetVersion: null },
+    restart: { attempted: false, succeeded: null, services: [] },
+    verify: null,
+    cleanups: null,
+    maintenance: null,
+    parallelNpmGlobal: null,
+    recentLogSignals: [],
+    exitCode: 0
+  };
 }
-
-// src/commands/use.ts
-init_output();
-function createUseCommand() {
-  return new Command("use").description("Set active instance for verb commands").argument("<instance>", "Instance name, ID, or prefix").action(async (instance3) => {
-    const client = getClient();
-    const instanceId = await resolveInstanceId(instance3);
-    try {
-      await client.context.use(instanceId);
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      return error(`Failed to set active instance: ${message2}`);
+function getDiagnosticsDir() {
+  const base = process.env.OMNI_CONFIG_DIR ?? join18(homedir13(), ".omni");
+  return join18(base, "logs");
+}
+function getDiagnosticsPath(startedAt) {
+  const safe = startedAt.replace(/:/g, "-");
+  return join18(getDiagnosticsDir(), `update-diagnostics-${safe}.json`);
+}
+function tailFileLines(path, maxLines) {
+  if (!existsSync19(path))
+    return [];
+  try {
+    const raw2 = readFileSync19(path, "utf8");
+    const lines = raw2.split(/\r?\n/);
+    if (lines.length > 0 && lines[lines.length - 1] === "")
+      lines.pop();
+    return lines.slice(-maxLines);
+  } catch {
+    return [];
+  }
+}
+function collectRecentLogSignals(maxLinesPerStream = 30, logPathsFor = getPm2LogPaths) {
+  const signals2 = [];
+  for (const name of Object.values(PM2_PROCESSES)) {
+    const { out, error: error2 } = logPathsFor(name);
+    const outLines = tailFileLines(out, maxLinesPerStream);
+    if (outLines.length > 0) {
+      signals2.push({ source: name, stream: "out", lines: outLines });
     }
-    try {
-      const inst = await client.instances.get(instanceId);
-      success(`Active instance: ${inst.name} (${instanceId.slice(0, 8)}\u2026)`);
-    } catch {
-      success(`Active instance: ${instanceId.slice(0, 8)}\u2026`);
+    const errLines = tailFileLines(error2, maxLinesPerStream);
+    if (errLines.length > 0) {
+      signals2.push({ source: name, stream: "error", lines: errLines });
     }
-  });
+  }
+  return signals2;
+}
+function writeDiagnostics(state, exitCode) {
+  state.exitCode = exitCode;
+  state.finishedAt = new Date().toISOString();
+  if (state.recentLogSignals.length === 0) {
+    state.recentLogSignals = collectRecentLogSignals();
+  }
+  const dir = getDiagnosticsDir();
+  const path = getDiagnosticsPath(state.startedAt);
+  try {
+    if (!existsSync19(dir)) {
+      mkdirSync12(dir, { recursive: true, mode: 448 });
+    }
+    writeFileSync11(path, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+    return path;
+  } catch {
+    return null;
+  }
 }
 
-// src/commands/voice.ts
-init_config();
-init_output();
-function apiHeaders() {
-  const config2 = loadConfig();
-  return { "x-api-key": config2.apiKey ?? "", "Content-Type": "application/json" };
+// src/commands/update.ts
+var PACKAGE_NAME = "@automagik/omni";
+var UPDATE_HEALTH_TIMEOUT_MS = 1e4;
+var VERIFY_POLL_INTERVAL_MS = 500;
+function resolveChannel(options3, config2) {
+  if (options3.next)
+    return "next";
+  if (options3.stable)
+    return "latest";
+  const saved = (config2 ?? loadConfig()).updateChannel;
+  if (saved === "latest" || saved === "next")
+    return saved;
+  return "latest";
 }
-function apiUrl(path) {
-  const config2 = loadConfig();
-  return `${config2.apiUrl ?? "http://localhost:8882"}/api/v2${path}`;
+function persistChannel(channel2) {
+  try {
+    const config2 = loadConfig();
+    config2.updateChannel = channel2;
+    saveConfig(config2);
+  } catch {}
 }
-function createVoiceCommand() {
-  const voice = new Command("voice").description("Voice channel operations");
-  voice.command("join").description("Join a Discord voice channel").requiredOption("--instance <id>", "Instance ID or name").requiredOption("--channel <channelId>", "Discord voice channel ID").requiredOption("--guild <guildId>", "Discord guild ID").action(async (opts) => {
-    try {
-      const res = await fetch(apiUrl("/voice/join"), {
-        method: "POST",
-        headers: apiHeaders(),
-        body: JSON.stringify({
-          instanceId: opts.instance,
-          channelId: opts.channel,
-          guildId: opts.guild
-        })
-      });
-      const body = await res.json();
-      if (!res.ok) {
-        error("Failed to join", body);
-        process.exit(1);
-      }
-      success("Joined voice channel");
-      data(body);
-    } catch (err2) {
-      error("Failed to join voice channel", err2);
-      process.exit(1);
+async function fetchLatestVersion(channel2) {
+  try {
+    const proc = Bun.spawn({
+      cmd: ["bunx", "npm", "view", `${PACKAGE_NAME}@${channel2}`, "version"],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    if (exitCode !== 0) {
+      return null;
     }
-  });
-  voice.command("leave").description("Leave a voice session").requiredOption("--session <sessionId>", "Voice session ID").action(async (opts) => {
-    try {
-      const res = await fetch(apiUrl("/voice/leave"), {
-        method: "POST",
-        headers: apiHeaders(),
-        body: JSON.stringify({ sessionId: opts.session })
-      });
-      if (!res.ok) {
-        error("Failed to leave", await res.json());
-        process.exit(1);
-      }
-      success("Left voice session");
-    } catch (err2) {
-      error("Failed to leave voice session", err2);
-      process.exit(1);
+    const text3 = stdout.trim();
+    return text3.length > 0 ? text3 : null;
+  } catch {
+    return null;
+  }
+}
+function getRunningPm2Services() {
+  try {
+    const result = Bun.spawnSync({
+      cmd: ["pm2", "jlist"],
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    if (result.exitCode !== 0) {
+      return [];
     }
-  });
-  voice.command("sessions").description("List active voice sessions").action(async () => {
-    try {
-      const res = await fetch(apiUrl("/voice/sessions"), { headers: apiHeaders() });
-      const body = await res.json();
-      if (body.items.length === 0) {
-        info("No active voice sessions");
-      } else {
-        data(body.items);
+    const raw2 = new TextDecoder().decode(result.stdout).trim();
+    if (!raw2 || raw2 === "[]")
+      return [];
+    const pm2Names = new Set(Object.values(PM2_PROCESSES));
+    const list2 = JSON.parse(raw2);
+    const running = new Set;
+    for (const proc of list2) {
+      const name = proc.name;
+      if (name && pm2Names.has(name) && proc.pm2_env?.status === "online") {
+        running.add(name);
       }
-    } catch (err2) {
-      error("Failed to list sessions", err2);
-      process.exit(1);
     }
+    return [...running];
+  } catch {
+    return [];
+  }
+}
+async function installLatest(channel2) {
+  const proc = Bun.spawn({
+    cmd: ["bun", "add", "-g", "--force", "--no-cache", `${PACKAGE_NAME}@${channel2}`],
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: process.env
   });
-  voice.command("stream <sessionId>").description("Stream voice audio via WebSocket").option("--format <format>", "Audio format: opus or pcm", "opus").option("--user <userId>", "Filter to specific user").option("--save <dir>", "Save audio frames to directory").option("--events-only", "Show only control events, no audio stats").action(async (sessionId, opts) => {
-    const config2 = loadConfig();
-    if (!config2.apiKey || !config2.apiUrl) {
-      error("Not authenticated. Run: omni auth login");
-      process.exit(1);
-    }
-    const wsUrl = config2.apiUrl.replace(/^http/, "ws");
-    let url = `${wsUrl}/api/v2/voice/stream/${sessionId}?api_key=${config2.apiKey}&format=${opts.format}`;
-    if (opts.user)
-      url += `&user=${opts.user}`;
-    info(`Connecting to voice stream: ${sessionId}`);
-    info(`Format: ${opts.format} | User filter: ${opts.user || "all"}`);
-    const ws = new WebSocket(url);
-    ws.binaryType = "arraybuffer";
-    const stats = new Map;
-    let totalFrames = 0;
-    const startTime = Date.now();
-    let saveDir = "";
-    if (opts.save) {
-      const { mkdirSync: mkdirSync13 } = await import("fs");
-      saveDir = opts.save;
-      mkdirSync13(saveDir, { recursive: true });
-      info(`Saving audio to: ${saveDir}`);
+  const exitCode = await proc.exited;
+  return exitCode === 0;
+}
+async function restartPm2Services(processNames) {
+  const serverConfig = loadServerConfig();
+  const cliConfig = loadLocalRuntimeConfig();
+  const runtimeEnv = buildRuntimeEnv(serverConfig, cliConfig);
+  let allSucceeded = true;
+  for (const name of processNames) {
+    const proc = Bun.spawn({
+      cmd: ["pm2", "restart", name],
+      stdout: "pipe",
+      stderr: "pipe",
+      env: { ...process.env, ...runtimeEnv }
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      allSucceeded = false;
     }
-    ws.onopen = () => {
-      success("Connected to voice stream");
-    };
-    const handleControl = (data2) => {
-      const msg = JSON.parse(data2);
-      const ts = new Date().toLocaleTimeString();
-      const label = msg.userId || msg.sessionId || "";
-      info(`[${ts}] ${String(msg.type)}: ${String(label)}`);
-    };
-    ws.onmessage = async (ev2) => {
-      if (typeof ev2.data === "string") {
-        handleControl(ev2.data);
-        return;
-      }
-      const buf = Buffer.from(ev2.data);
-      const userIdLen = buf[0] ?? 0;
-      const userId = buf.subarray(1, 1 + userIdLen).toString("utf8");
-      const audio = buf.subarray(1 + userIdLen);
-      let s2 = stats.get(userId);
-      if (!s2) {
-        s2 = { frames: 0, bytes: 0 };
-        stats.set(userId, s2);
-        const ts = new Date().toLocaleTimeString();
-        info(`[${ts}] New speaker: ${userId}`);
-      }
-      s2.frames++;
-      s2.bytes += audio.length;
-      totalFrames++;
-      if (saveDir) {
-        const { appendFileSync: appendFileSync2 } = await import("fs");
-        appendFileSync2(`${saveDir}/${userId}.opus`, audio);
-      }
-      if (!opts.eventsOnly && totalFrames % 500 === 0) {
-        const elapsed = ((Date.now() - startTime) / 1000).toFixed(0);
-        const lines = [];
-        for (const [uid2, st] of stats) {
-          lines.push(`  ${uid2}: ${st.frames} frames, ${(st.bytes / 1024).toFixed(1)}KB`);
-        }
-        info(`[${elapsed}s] ${totalFrames} frames total
-${lines.join(`
-`)}`);
-      }
-    };
-    ws.onerror = () => {
-      error("WebSocket error");
-    };
-    ws.onclose = (ev2) => {
-      info(`Disconnected: code=${ev2.code} ${ev2.reason}`);
-      const elapsed = ((Date.now() - startTime) / 1000).toFixed(0);
-      info(`Session lasted ${elapsed}s, ${totalFrames} total frames`);
-      for (const [uid2, st] of stats) {
-        info(`  ${uid2}: ${st.frames} frames, ${(st.bytes / 1024).toFixed(1)}KB`);
+  }
+  return allSucceeded;
+}
+function normalizeVersion(version2) {
+  return version2.split("+")[0] ?? version2;
+}
+function decideVerify(args) {
+  if (args.skipReason !== undefined) {
+    return { kind: "skipped", reason: args.skipReason };
+  }
+  const cliVersion = normalizeVersion(args.latest);
+  if (args.healthBody === null) {
+    return { kind: "health-unreachable", apiPort: args.apiPort };
+  }
+  const serverVersion = args.healthBody.version ? normalizeVersion(args.healthBody.version) : null;
+  if (!serverVersion || serverVersion !== cliVersion) {
+    return { kind: "version-mismatch", cliVersion, serverVersion };
+  }
+  if (!args.keyValid) {
+    return { kind: "auth-invalid" };
+  }
+  return { kind: "ok", cliVersion, serverVersion };
+}
+function updateErrorVersionMismatch(cli, server) {
+  return `Server version mismatch: cli=v${cli} server=v${server ?? "unknown"}. Run: omni doctor`;
+}
+var UPDATE_ERROR_AUTH_INVALID = "Auth key invalid after restart. Run: omni doctor --fix";
+async function fetchHealthBody(apiPort, timeoutMs) {
+  const url = getHealthCheckUrl(apiPort);
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const resp = await fetch(url, {
+        signal: AbortSignal.timeout(1500),
+        headers: { "Accept-Encoding": "identity" }
+      });
+      if (resp.ok) {
+        const body = await resp.json();
+        return body;
       }
-      process.exit(0);
-    };
-    process.on("SIGINT", () => {
-      info("Closing stream...");
-      ws.close();
-    });
-    await new Promise(() => {});
-  });
-  return voice;
+    } catch {}
+    await Bun.sleep(VERIFY_POLL_INTERVAL_MS);
+  }
+  return null;
 }
-
-// src/commands/webhooks.ts
-import { readFileSync as readFileSync19 } from "fs";
-init_zod();
-init_output();
-var SIGNATURE_ALGORITHMS = ["hmac-sha256", "hmac-sha1", "token-match"];
-var signatureSecretSchema = exports_external.string().min(8, "at least 8 characters").max(512, "at most 512 characters");
-var SECRET_SOURCE_FLAGS = "--signature-secret, --signature-secret-env, --signature-secret-stdin";
-async function readSecretFromStdin() {
-  if (process.stdin.isTTY) {
-    throw new Error('--signature-secret-stdin requires piped stdin (e.g. `printf %s "$SECRET" | omni webhooks ...`)');
+async function validateStoredKey(apiPort) {
+  const cliConfig = loadLocalRuntimeConfig();
+  if (!cliConfig.apiKey) {
+    return false;
   }
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(Buffer.from(chunk));
+  const baseUrl = cliConfig.apiUrl ?? `http://localhost:${apiPort}`;
+  try {
+    const client = createOmniClient({ baseUrl, apiKey: cliConfig.apiKey, cliVersion: VERSION });
+    const result = await client.auth.validate();
+    return result.valid === true;
+  } catch {
+    return false;
   }
-  return Buffer.concat(chunks).toString("utf-8");
 }
-async function resolveSignatureSecret(options3, readStdin = readSecretFromStdin) {
-  const sources = [
-    options3.signatureSecret !== undefined,
-    options3.signatureSecretEnv !== undefined,
-    options3.signatureSecretStdin === true
-  ].filter(Boolean).length;
-  if (sources === 0)
-    return;
-  if (sources > 1) {
-    throw new Error(`Use only one of ${SECRET_SOURCE_FLAGS}`);
+function printVerifyBanner(latest) {
+  console.log(`${source_default.green("\u2713")} CLI:    v${latest}`);
+  console.log(`${source_default.green("\u2713")} Server: v${latest} (healthy)`);
+  console.log(`${source_default.green("\u2713")} Auth:   key valid`);
+}
+function printVerifySkippedBanner(latest) {
+  console.log(`${source_default.green("\u2713")} CLI:    v${latest}`);
+  console.log(`${source_default.yellow("-")} Server: v${latest} (skipped)`);
+  console.log(`${source_default.yellow("-")} Auth:   skipped`);
+}
+function detectParallelNpmGlobalInstall(deps) {
+  const npmRootFn = deps?.npmRoot ?? defaultNpmRoot;
+  const existsFn = deps?.exists ?? existsSync20;
+  let root;
+  try {
+    root = npmRootFn();
+  } catch {
+    return { detected: false, skipped: "npm-root-failed" };
   }
-  let raw2;
-  let origin;
-  if (options3.signatureSecretEnv !== undefined) {
-    const name = options3.signatureSecretEnv;
-    if (!name)
-      throw new Error("--signature-secret-env requires a variable name");
-    raw2 = process.env[name];
-    origin = `environment variable ${name}`;
-    if (raw2 === undefined || raw2 === "") {
-      throw new Error(`${origin} is not set or empty`);
-    }
-  } else if (options3.signatureSecretStdin) {
-    raw2 = (await readStdin()).replace(/\r?\n$/, "");
-    origin = "stdin";
-    if (!raw2)
-      throw new Error("no secret received on stdin");
-  } else {
-    raw2 = options3.signatureSecret;
-    origin = "--signature-secret";
+  if (root === null || root.length === 0) {
+    return { detected: false, skipped: "npm-not-on-path" };
   }
-  const parsed = signatureSecretSchema.safeParse(raw2);
-  if (!parsed.success) {
-    const reason = parsed.error.issues.map((issue) => issue.message).join("; ");
-    throw new Error(`Invalid signature secret from ${origin}: ${reason}`);
+  const candidate = join19(root, "@automagik", "omni");
+  if (existsFn(candidate)) {
+    return { detected: true, path: candidate };
   }
-  return parsed.data;
+  return { detected: false };
 }
-function buildSignatureConfig(options3) {
-  const { signatureAlgorithm, signatureHeader, signaturePrefix } = options3;
-  if (!signatureAlgorithm && !signatureHeader && !signaturePrefix)
-    return;
-  if (!signatureAlgorithm || !signatureHeader) {
-    error("--signature-algorithm and --signature-header must be provided together");
+function defaultNpmRoot() {
+  try {
+    const result = Bun.spawnSync({
+      cmd: ["npm", "root", "-g"],
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: 5000
+    });
+    if (result.exitCode !== 0)
+      return null;
+    const text3 = new TextDecoder().decode(result.stdout).trim();
+    return text3.length > 0 ? text3 : null;
+  } catch {
+    return null;
   }
-  const algorithm = SIGNATURE_ALGORITHMS.find((a2) => a2 === signatureAlgorithm);
-  if (!algorithm) {
-    error(`Invalid --signature-algorithm; expected one of: ${SIGNATURE_ALGORITHMS.join(", ")}`);
+}
+async function runLegacyCleanup(skipList) {
+  const cleanupSpinner = ora("Checking for legacy artifacts to clean up...").start();
+  const report = await cleanupLegacyArtifacts(skipList);
+  cleanupSpinner.stop();
+  for (const outcome of report.outcomes) {
+    if (outcome.state === "ran" && outcome.summary.length > 0) {
+      console.log(outcome.summary);
+    }
   }
-  if (algorithm === "token-match" && signaturePrefix) {
-    error("--signature-prefix is not applicable to token-match (the header carries the secret verbatim)");
+  return report;
+}
+var OMNI_UPDATE_SKIP_MAINTENANCE_ENV = "OMNI_UPDATE_SKIP_MAINTENANCE";
+function resolveMaintenanceSkipReason(args) {
+  if (!args.verifyOk)
+    return "verify-failed";
+  if (args.skipMaintenance === true)
+    return "cli-flag";
+  const raw2 = args.env[OMNI_UPDATE_SKIP_MAINTENANCE_ENV];
+  if (raw2 !== undefined && raw2 !== "" && raw2 !== "0" && raw2.toLowerCase() !== "false") {
+    return "env";
   }
-  return { algorithm, header: signatureHeader, prefix: signaturePrefix };
+  return null;
 }
-var eventTypeMappingSchema = exports_external.discriminatedUnion("source", [
-  exports_external.object({
-    source: exports_external.literal("header"),
-    header: exports_external.string().min(1, "header must be 1-200 characters").max(200, "header must be 1-200 characters")
-  }),
-  exports_external.object({
-    source: exports_external.literal("body"),
-    path: exports_external.string().min(1, "path must be 1-200 characters").max(200, "path must be 1-200 characters")
-  })
-]);
-var EVENT_TYPE_MAPPING_HINT = 'expected {"source":"header","header":"X-GitHub-Event"} or {"source":"body","path":"event"}';
-function resolveEventTypeMapping(raw2) {
-  if (raw2 === undefined)
-    return;
-  let text3 = raw2;
-  if (raw2.startsWith("@")) {
-    const path = raw2.slice(1);
-    try {
-      text3 = readFileSync19(path, "utf-8");
-    } catch (err2) {
-      const reason = err2 instanceof Error ? err2.message : "Unknown error";
-      throw new Error(`Cannot read --event-type-mapping file '${path}': ${reason}`);
-    }
+function formatMaintenanceSummary(report) {
+  const { ok: ok3, warn: warn2, fail } = report.summary;
+  return `Maintenance: ${ok3} ok, ${warn2} warn, ${fail} fail`;
+}
+async function runPostUpdateMaintenance(args) {
+  if (args.skipReason !== null) {
+    return { outcome: "skipped", durationMs: 0, skipReason: args.skipReason };
   }
-  let parsed;
+  const impl = args.runDoctorImpl ?? runDoctor;
+  const startedAt = Date.now();
   try {
-    parsed = JSON.parse(text3);
-  } catch {
-    throw new Error(`Invalid JSON for --event-type-mapping; ${EVENT_TYPE_MAPPING_HINT}`);
+    const doctorReport = await impl({ json: true, dryRun: true });
+    return {
+      outcome: "completed",
+      durationMs: Date.now() - startedAt,
+      doctorReport
+    };
+  } catch (err2) {
+    return {
+      outcome: "failed",
+      durationMs: Date.now() - startedAt,
+      error: err2 instanceof Error ? err2.message : String(err2)
+    };
   }
-  const result = eventTypeMappingSchema.safeParse(parsed);
-  if (!result.success) {
-    const reason = result.error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
-    throw new Error(`Invalid --event-type-mapping: ${reason}; ${EVENT_TYPE_MAPPING_HINT}`);
+}
+async function restartServicesAndVerify(servicesToRestart, latest, options3, diagnostics, finalize) {
+  const apiPort = loadServerConfig().port;
+  diagnostics.restart.attempted = true;
+  diagnostics.restart.services = [...servicesToRestart];
+  const restartSpinner = ora("Restarting services...").start();
+  const restartSucceeded = await restartPm2Services(servicesToRestart);
+  restartSpinner.stop();
+  diagnostics.restart.succeeded = restartSucceeded;
+  if (!restartSucceeded) {
+    warn(`omni CLI updated to v${latest}, but one or more service restarts failed. Run \`omni status\`.`);
+    finalize(1);
+  }
+  let cleanupReport = null;
+  if (options3.legacyCleanup) {
+    cleanupReport = await runLegacyCleanup(options3.skipList);
+    diagnostics.cleanups = cleanupReport;
+  }
+  if (options3.skipVerify) {
+    const result2 = decideVerify({ skipReason: "no-verify-flag" });
+    diagnostics.verify = result2;
+    printVerifySkippedBanner(latest);
+    if (cleanupReport !== null && !cleanupReport.succeeded) {
+      warn("One or more legacy artifacts could not be cleaned up automatically. " + "See messages above and docs/migration/nats-genie-sidecar-decommission.md.");
+    }
+    const maintenance = await runPostUpdateMaintenance({ skipReason: "verify-failed" });
+    diagnostics.maintenance = maintenance;
+    return;
+  }
+  const verifySpinner = ora("Verifying server version...").start();
+  const healthBody = await fetchHealthBody(apiPort, UPDATE_HEALTH_TIMEOUT_MS);
+  verifySpinner.stop();
+  const keyValid = healthBody !== null ? await validateStoredKey(apiPort) : false;
+  const result = decideVerify({ latest, apiPort, healthBody, keyValid });
+  diagnostics.verify = result;
+  switch (result.kind) {
+    case "ok": {
+      printVerifyBanner(result.cliVersion);
+      if (cleanupReport !== null && !cleanupReport.succeeded) {
+        warn("One or more legacy artifacts could not be cleaned up automatically. " + "See messages above and docs/migration/nats-genie-sidecar-decommission.md.");
+      }
+      const skipReason = resolveMaintenanceSkipReason({
+        verifyOk: true,
+        skipMaintenance: options3.skipMaintenance,
+        env: process.env
+      });
+      const maintenance = await runPostUpdateMaintenance({ skipReason });
+      diagnostics.maintenance = maintenance;
+      if (maintenance.outcome === "completed" && maintenance.doctorReport) {
+        info(formatMaintenanceSummary(maintenance.doctorReport));
+      } else if (maintenance.outcome === "failed") {
+        warn(`Maintenance: skipped (runDoctor failed: ${maintenance.error ?? "unknown error"})`);
+      }
+      return;
+    }
+    case "health-unreachable":
+      warn(`omni CLI updated to v${latest}, but health check failed on port ${result.apiPort}. Run \`omni status\`.`);
+      finalize(1);
+      break;
+    case "version-mismatch":
+      console.error(`${source_default.red("\u2717")} ${updateErrorVersionMismatch(result.cliVersion, result.serverVersion)}`);
+      finalize(1);
+      break;
+    case "auth-invalid":
+      console.error(`${source_default.red("\u2717")} ${UPDATE_ERROR_AUTH_INVALID}`);
+      finalize(1);
+      break;
   }
-  return result.data;
 }
-async function buildUpdateSourcePatch(options3) {
-  const updates = buildLifecycleUpdates(options3);
-  if (options3.name)
-    updates.name = options3.name;
-  if (options3.description)
-    updates.description = options3.description;
-  if (options3.idempotencyKeyTemplate)
-    updates.idempotencyKeyTemplate = options3.idempotencyKeyTemplate;
-  if (options3.strictSchemas !== undefined)
-    updates.strictSchemas = options3.strictSchemas;
-  if (options3.clearEventTypeMapping && options3.eventTypeMapping !== undefined) {
-    throw new Error("Use only one of --event-type-mapping and --clear-event-type-mapping");
+async function promptConfirm(question) {
+  const rl = createInterface3({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve4) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      const trimmed = answer.trim().toLowerCase();
+      resolve4(trimmed === "" || trimmed === "y" || trimmed === "yes");
+    });
+  });
+}
+async function runUpdate(options3) {
+  const channel2 = resolveChannel(options3);
+  if (options3.next || options3.stable) {
+    persistChannel(channel2);
   }
-  if (options3.clearEventTypeMapping)
-    updates.eventTypeMapping = null;
-  const eventTypeMapping = resolveEventTypeMapping(options3.eventTypeMapping);
-  if (eventTypeMapping !== undefined)
-    updates.eventTypeMapping = eventTypeMapping;
-  if (options3.enable)
-    updates.enabled = true;
-  if (options3.disable)
-    updates.enabled = false;
-  if (options3.clearSignature) {
-    updates.signatureConfig = null;
-    return updates;
+  const currentClean = VERSION.split("+")[0];
+  const diagnostics = createDiagnostics({ runningVersion: currentClean, channel: channel2 });
+  const finalize = (exitCode) => {
+    const path = writeDiagnostics(diagnostics, exitCode);
+    if (path !== null && process.env.OMNI_UPDATE_DIAGNOSTICS_VERBOSE === "1") {
+      info(`Diagnostics written: ${path}`);
+    }
+    process.exit(exitCode);
+  };
+  const parallelInstall = detectParallelNpmGlobalInstall();
+  diagnostics.parallelNpmGlobal = parallelInstall;
+  if (parallelInstall.detected && parallelInstall.path) {
+    warn(`Parallel npm-global install of ${PACKAGE_NAME} detected at ${parallelInstall.path}. This may shadow the bun-installed binary on PATH. Recommended: npm uninstall -g ${PACKAGE_NAME}`);
   }
-  const signatureConfig = buildSignatureConfig(options3);
-  if (signatureConfig)
-    updates.signatureConfig = signatureConfig;
-  const signatureSecret = await resolveSignatureSecret(options3);
-  if (signatureSecret)
-    updates.signatureSecret = signatureSecret;
-  return updates;
-}
-function assertPairedSignatureOnCreate(signatureConfig, signatureSecret) {
-  if (signatureConfig === undefined === (signatureSecret === undefined))
-    return;
-  if (signatureConfig === undefined) {
-    throw new Error(`a signature secret (${SECRET_SOURCE_FLAGS}) requires --signature-algorithm and --signature-header`);
+  info(`Channel: ${channel2}${channel2 === "next" ? " (dev builds)" : " (stable)"}`);
+  const versionSpinner = ora(`Checking ${channel2} version of ${PACKAGE_NAME}...`).start();
+  const latest = await fetchLatestVersion(channel2);
+  versionSpinner.stop();
+  diagnostics.registry.latestVersion = latest;
+  if (latest === null) {
+    warn("Could not reach npm registry. Check your network connection and try again.");
+    return finalize(1);
   }
-  throw new Error(`--signature-algorithm and --signature-header require a signature secret (${SECRET_SOURCE_FLAGS})`);
-}
-var WINDOW_SEMANTICS = ["future_only", "includes_in_progress"];
-var MUTATION_POLICIES = ["same_id", "new_id"];
-function parseExpectedInterval(raw2) {
-  if (raw2 === undefined)
-    return;
-  const seconds = Number(raw2);
-  if (!Number.isInteger(seconds) || seconds < 1) {
-    error("--expected-interval must be a positive integer number of seconds");
+  if (currentClean === latest) {
+    success(`Already up to date (v${latest}, channel: ${channel2})`);
+    return finalize(0);
   }
-  return seconds;
-}
-function parseWindowSemantics(raw2) {
-  if (raw2 === undefined)
-    return;
-  const value = WINDOW_SEMANTICS.find((v4) => v4 === raw2);
-  if (!value) {
-    error(`Invalid --window-semantics; expected one of: ${WINDOW_SEMANTICS.join(", ")}`);
+  info(`Update available: v${currentClean} \u2192 v${latest} (${channel2})`);
+  if (!options3.yes) {
+    const confirmed = await promptConfirm(`Update from v${currentClean} to v${latest}? [Y/n] `);
+    if (!confirmed) {
+      info("Update cancelled.");
+      return finalize(0);
+    }
   }
-  return value;
-}
-function parseMutationPolicy(raw2) {
-  if (raw2 === undefined)
-    return;
-  const value = MUTATION_POLICIES.find((v4) => v4 === raw2);
-  if (!value) {
-    error(`Invalid --mutation-policy; expected one of: ${MUTATION_POLICIES.join(", ")}`);
+  const servicesToRestart = options3.restart !== false ? getRunningPm2Services() : [];
+  const installSpinner = ora(`Updating ${PACKAGE_NAME}@${channel2}...`).start();
+  diagnostics.install.attempted = true;
+  diagnostics.install.targetVersion = latest;
+  const installed = await installLatest(channel2);
+  installSpinner.stop();
+  diagnostics.install.succeeded = installed;
+  if (!installed) {
+    warn(`Installation failed. Your current version (v${currentClean}) is still intact.`);
+    return finalize(1);
   }
-  return value;
-}
-function buildLifecycleUpdates(options3) {
-  if (options3.clearCadence && options3.expectedInterval !== undefined) {
-    error("Use only one of --expected-interval and --clear-cadence");
+  const sidecarCleanupExplicit = options3.sidecarCleanup === false;
+  if (sidecarCleanupExplicit) {
+    info("--no-sidecar-cleanup (deprecated alias for --no-legacy-cleanup)");
   }
-  const updates = {};
-  if (options3.clearCadence)
-    updates.expectedIntervalSeconds = null;
-  const expectedIntervalSeconds = parseExpectedInterval(options3.expectedInterval);
-  if (expectedIntervalSeconds !== undefined)
-    updates.expectedIntervalSeconds = expectedIntervalSeconds;
-  const windowSemantics = parseWindowSemantics(options3.windowSemantics);
-  if (windowSemantics !== undefined)
-    updates.windowSemantics = windowSemantics;
-  const mutationPolicy = parseMutationPolicy(options3.mutationPolicy);
-  if (mutationPolicy !== undefined)
-    updates.mutationPolicy = mutationPolicy;
-  return updates;
+  const legacyCleanupEnabled = options3.legacyCleanup !== false && options3.sidecarCleanup !== false;
+  const skipList = parseSkipCleanupList(options3.skipCleanup);
+  if (servicesToRestart.length > 0) {
+    await restartServicesAndVerify(servicesToRestart, latest, {
+      legacyCleanup: legacyCleanupEnabled,
+      skipList,
+      skipMaintenance: options3.skipMaintenance === true,
+      skipVerify: options3.verify === false
+    }, diagnostics, finalize);
+    return finalize(0);
+  }
+  diagnostics.verify = decideVerify({ skipReason: "no-restart" });
+  success(`omni updated to v${latest}`);
+  return finalize(0);
 }
-function createWebhooksCommand() {
-  const webhooks = new Command("webhooks").description("Manage webhook sources");
-  webhooks.command("list").description("List webhook sources").option("--enabled", "Show only enabled sources").option("--disabled", "Show only disabled sources").action(async (options3) => {
-    const client = getClient();
-    try {
-      let enabledFilter;
-      if (options3.enabled)
-        enabledFilter = true;
-      if (options3.disabled)
-        enabledFilter = false;
-      const result = await client.webhooks.listSources({
-        enabled: enabledFilter
-      });
-      const items = result.map((w) => ({
-        id: w.id,
-        name: w.name,
-        enabled: w.enabled ? "yes" : "no",
-        health: w.livenessStatus ?? "-",
-        cadence: w.expectedIntervalSeconds != null ? `${w.expectedIntervalSeconds}s` : "-",
-        createdAt: w.createdAt
-      }));
-      list(items, { emptyMessage: "No webhook sources found." });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to list webhook sources: ${message2}`);
-    }
-  });
-  webhooks.command("get <id>").description("Get webhook source details").action(async (id) => {
-    const resolvedId = await resolveWebhookId(id);
+function parseSkipCleanupList(value) {
+  if (!value)
+    return new Set;
+  const names = value.split(",").map((s2) => s2.trim()).filter((s2) => s2.length > 0);
+  return new Set(names);
+}
+function createUpdateCommand() {
+  return new Command("update").description(`Update ${PACKAGE_NAME} to the latest version (restart only services already running)`).option("-y, --yes", "Skip confirmation prompts (non-interactive)").option("--no-restart", "Update CLI only; skip service restarts and verification").option("--no-verify", "Restart services but skip the post-restart probe (use when a release ships a broken /api/v2/health and operators need to roll forward)").option("--no-legacy-cleanup", "Skip every registered legacy-artifact cleanup (e.g. nats-reply-sidecar)").option("--no-sidecar-cleanup", "Deprecated alias for --no-legacy-cleanup").option("--skip-cleanup <names>", 'Comma-separated list of legacy-cleanup registry entries to skip (e.g. "nats-reply-sidecar")').option("--next", "Switch to dev builds (npm @next tag) and persist as default").option("--stable", "Switch to stable releases (npm @latest tag) and persist as default").option("--skip-maintenance", `Skip the post-update maintenance hook (read-only \`omni doctor\` sweep). Also honored via the ${OMNI_UPDATE_SKIP_MAINTENANCE_ENV} env var.`).addHelpText("after", `
+Channels:
+  - stable (default) \u2014 tracks the npm @latest tag, bumped from main branch releases.
+  - next (dev builds) \u2014 tracks the npm @next tag, bumped on every CI-green dev merge.
+
+  Use --next to switch to dev builds; --stable to switch back. The choice is
+  persisted to ~/.omni/config.json under 'updateChannel' so subsequent
+  'omni update' calls stay on the selected track. Check or change manually:
+    omni config get updateChannel
+    omni config set updateChannel next
+    omni config set updateChannel latest
+
+Behavior:
+  - Installs the latest CLI package first.
+  - Restarts tracked Omni services only when they were online before the update.
+  - When that restart path runs, update performs 3-step verification:
+      1. Server version matches the new CLI version (via /api/v2/health).
+      2. Stored CLI API key still validates against the server.
+      3. On success, prints:
+           \u2713 CLI:    v<latest>
+           \u2713 Server: v<latest> (healthy)
+           \u2713 Auth:   key valid
+  - On mismatch, exits non-zero with:
+      "Server version mismatch: cli=v<X> server=v<Y>. Run: omni doctor"
+  - On auth failure, exits non-zero with:
+      "Auth key invalid after restart. Run: omni doctor --fix"
+  - After a successful restart, runs every registered legacy-artifact cleanup.
+    The day-one entry is nats-reply-sidecar: it scans for any legacy
+    nats-reply-sidecar.mjs process (PM2-managed or raw) and stops it. The
+    sidecar was an external workaround for bugs that were fixed in #362;
+    leaving it running causes every agent reply to be delivered twice.
+    Skip every cleanup with --no-legacy-cleanup, or skip a single registry
+    entry with --skip-cleanup=<name1,name2>. The deprecated alias
+    --no-sidecar-cleanup still works and behaves identically. Manual runbook:
+      docs/migration/nats-genie-sidecar-decommission.md
+  - Use --no-restart to skip restart + verification entirely. --no-restart
+    also skips legacy-artifact cleanup; manage those services manually.
+  - Use --no-verify to restart services but skip the post-restart probe.
+    The banner shows the new CLI version on both lines but tags Server /
+    Auth as "(skipped)"; maintenance is auto-skipped because verify never
+    confirmed health.
+  - Detects parallel npm-global installs of ${PACKAGE_NAME} (omni installs
+    via bun-global; an npm-global install hides stale binaries on PATH and
+    confuses 'which omni'). When found, prints a one-line warning naming
+    the offending path; recommended remediation: npm uninstall -g ${PACKAGE_NAME}.
+  - Every invocation writes a diagnostics record to
+    ~/.omni/logs/update-diagnostics-<iso>.json (schemaVersion: 1). Captures
+    install attempt, registry probe, restart outcome, verify result, cleanup
+    registry result, maintenance hook, and a tail of pm2 log signals. Set
+    OMNI_UPDATE_DIAGNOSTICS_VERBOSE=1 to print the path on completion. A
+    failed write never changes the update exit code.
+  - On a successful restart + verify, runs a post-update maintenance hook:
+    a read-only \`omni doctor\` sweep that prints a one-line summary
+    ("Maintenance: <ok> ok, <warn> warn, <fail> fail"). The probe never
+    mutates pm2 / config / DB state (\`omni doctor --fix\` remains the
+    explicit operator action for repair). A failing maintenance call is
+    non-fatal \u2014 exit code stays 0 with a banner warning. Skip with
+    --skip-maintenance or ${OMNI_UPDATE_SKIP_MAINTENANCE_ENV}=1.
+  - Verify runtime health after update with: omni status
+`).action(runUpdate);
+}
+
+// src/commands/use.ts
+init_output();
+function createUseCommand() {
+  return new Command("use").description("Set active instance for verb commands").argument("<instance>", "Instance name, ID, or prefix").action(async (instance3) => {
     const client = getClient();
+    const instanceId = await resolveInstanceId(instance3);
     try {
-      const source = await client.webhooks.getSource(resolvedId);
-      data(source);
+      await client.context.use(instanceId);
     } catch (err2) {
       const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to get webhook source: ${message2}`);
+      return error(`Failed to set active instance: ${message2}`);
     }
-  });
-  webhooks.command("create").description("Create a webhook source").requiredOption("--name <name>", "Webhook source name").option("--description <desc>", "Description").option("--disabled", "Create in disabled state").option("--headers <json>", `Expected headers as JSON (e.g., '{"X-Secret": true}')`).option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}. Defaults to '{source}:{sha256(body)}'").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000). Recommended for new sources. Defaults to off").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'. ` + "A mapped source emits custom.{source}.{event} instead of the collapsed custom.webhook.{source}").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. Arms liveness supervision (#961)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (options3) => {
-    const client = getClient();
     try {
-      let expectedHeaders;
-      if (options3.headers) {
-        try {
-          expectedHeaders = JSON.parse(options3.headers);
-        } catch {
-          error("Invalid JSON for --headers");
-        }
-      }
-      const signatureConfig = buildSignatureConfig(options3);
-      const signatureSecret = await resolveSignatureSecret(options3);
-      assertPairedSignatureOnCreate(signatureConfig, signatureSecret);
-      const source = await client.webhooks.createSource({
-        name: options3.name,
-        description: options3.description,
-        enabled: !options3.disabled,
-        expectedHeaders,
-        signatureConfig,
-        signatureSecret,
-        idempotencyKeyTemplate: options3.idempotencyKeyTemplate,
-        strictSchemas: options3.strictSchemas,
-        eventTypeMapping: resolveEventTypeMapping(options3.eventTypeMapping),
-        expectedIntervalSeconds: parseExpectedInterval(options3.expectedInterval),
-        windowSemantics: parseWindowSemantics(options3.windowSemantics),
-        mutationPolicy: parseMutationPolicy(options3.mutationPolicy)
-      });
-      const details = {
-        id: source.id,
-        name: source.name,
-        url: `POST /api/v2/webhooks/${source.name}`
-      };
-      if (signatureConfig) {
-        details.publicUrl = `POST /api/v2/webhooks/ingress/${source.name}`;
-      }
-      success(`Webhook source created: ${source.id}`, details);
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to create webhook source: ${message2}`);
+      const inst = await client.instances.get(instanceId);
+      success(`Active instance: ${inst.name} (${instanceId.slice(0, 8)}\u2026)`);
+    } catch {
+      success(`Active instance: ${instanceId.slice(0, 8)}\u2026`);
     }
   });
-  webhooks.command("update <id>").description("Update a webhook source").option("--name <name>", "New name").option("--description <desc>", "New description").option("--enable", "Enable the webhook").option("--disable", "Disable the webhook").option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--clear-signature", "Remove the signature config and stored secret").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000)").option("--no-strict-schemas", "Return the source to opt-in pass-through for unregistered event types").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'`).option("--clear-event-type-mapping", "Remove the mapping (deliveries fall back to the collapsed custom.webhook.{source} type)").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. (Re)arms liveness supervision (#961)").option("--clear-cadence", "Remove the declared cadence (disarms liveness supervision)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (id, options3) => {
-    const resolvedId = await resolveWebhookId(id);
-    const client = getClient();
+}
+
+// src/commands/voice.ts
+init_config();
+init_output();
+function apiHeaders() {
+  const config2 = loadConfig();
+  return { "x-api-key": config2.apiKey ?? "", "Content-Type": "application/json" };
+}
+function apiUrl(path) {
+  const config2 = loadConfig();
+  return `${config2.apiUrl ?? "http://localhost:8882"}/api/v2${path}`;
+}
+function createVoiceCommand() {
+  const voice = new Command("voice").description("Voice channel operations");
+  voice.command("join").description("Join a Discord voice channel").requiredOption("--instance <id>", "Instance ID or name").requiredOption("--channel <channelId>", "Discord voice channel ID").requiredOption("--guild <guildId>", "Discord guild ID").action(async (opts) => {
     try {
-      const updates = await buildUpdateSourcePatch(options3);
-      const source = await client.webhooks.updateSource(resolvedId, updates);
-      success(`Webhook source updated: ${source.id}`, {
-        id: source.id,
-        name: source.name,
-        enabled: source.enabled
+      const res = await fetch(apiUrl("/voice/join"), {
+        method: "POST",
+        headers: apiHeaders(),
+        body: JSON.stringify({
+          instanceId: opts.instance,
+          channelId: opts.channel,
+          guildId: opts.guild
+        })
       });
+      const body = await res.json();
+      if (!res.ok) {
+        error("Failed to join", body);
+        process.exit(1);
+      }
+      success("Joined voice channel");
+      data(body);
     } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to update webhook source: ${message2}`);
+      error("Failed to join voice channel", err2);
+      process.exit(1);
     }
   });
-  webhooks.command("delete <id>").description("Delete a webhook source").action(async (id) => {
-    const resolvedId = await resolveWebhookId(id);
-    const client = getClient();
+  voice.command("leave").description("Leave a voice session").requiredOption("--session <sessionId>", "Voice session ID").action(async (opts) => {
     try {
-      await client.webhooks.deleteSource(resolvedId);
-      success(`Webhook source deleted: ${resolvedId}`);
+      const res = await fetch(apiUrl("/voice/leave"), {
+        method: "POST",
+        headers: apiHeaders(),
+        body: JSON.stringify({ sessionId: opts.session })
+      });
+      if (!res.ok) {
+        error("Failed to leave", await res.json());
+        process.exit(1);
+      }
+      success("Left voice session");
     } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to delete webhook source: ${message2}`);
+      error("Failed to leave voice session", err2);
+      process.exit(1);
     }
   });
-  webhooks.command("trigger").description("Trigger a custom event").requiredOption("--type <type>", "Event type").requiredOption("--payload <json>", "Event payload as JSON").option("--instance <id>", "Instance ID").option("--correlation-id <id>", "Correlation ID").option("--causation-id <event-id>", "Parent event ID (keeps the causality tree for mid-flow emissions, #1072)").action(async (options3) => {
-    const client = getClient();
+  voice.command("sessions").description("List active voice sessions").action(async () => {
     try {
-      let payload;
-      try {
-        payload = JSON.parse(options3.payload);
-      } catch {
-        error("Invalid JSON for --payload");
-        return;
+      const res = await fetch(apiUrl("/voice/sessions"), { headers: apiHeaders() });
+      const body = await res.json();
+      if (body.items.length === 0) {
+        info("No active voice sessions");
+      } else {
+        data(body.items);
       }
-      const result = await client.webhooks.trigger({
-        eventType: options3.type,
-        payload,
-        instanceId: options3.instance,
-        correlationId: options3.correlationId,
-        causationId: options3.causationId
-      });
-      success(`Event triggered: ${result.eventId}`, {
-        eventId: result.eventId,
-        eventType: result.eventType
-      });
     } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to trigger event: ${message2}`);
+      error("Failed to list sessions", err2);
+      process.exit(1);
     }
   });
-  webhooks.command("heartbeat <source>").description('Record a connector heartbeat ("ran, zero events found") \u2014 resets the liveness window (#961)').action(async (source) => {
-    const client = getClient();
-    try {
-      const result = await client.webhooks.heartbeat(source);
-      success(`Heartbeat recorded for '${result.source}'`, {
-        heartbeatAt: result.heartbeatAt,
-        livenessStatus: result.livenessStatus ?? "unsupervised",
-        expectedIntervalSeconds: result.expectedIntervalSeconds
-      });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to record heartbeat: ${message2}`);
+  voice.command("stream <sessionId>").description("Stream voice audio via WebSocket").option("--format <format>", "Audio format: opus or pcm", "opus").option("--user <userId>", "Filter to specific user").option("--save <dir>", "Save audio frames to directory").option("--events-only", "Show only control events, no audio stats").action(async (sessionId, opts) => {
+    const config2 = loadConfig();
+    if (!config2.apiKey || !config2.apiUrl) {
+      error("Not authenticated. Run: omni auth login");
+      process.exit(1);
+    }
+    const wsUrl = config2.apiUrl.replace(/^http/, "ws");
+    let url = `${wsUrl}/api/v2/voice/stream/${sessionId}?api_key=${config2.apiKey}&format=${opts.format}`;
+    if (opts.user)
+      url += `&user=${opts.user}`;
+    info(`Connecting to voice stream: ${sessionId}`);
+    info(`Format: ${opts.format} | User filter: ${opts.user || "all"}`);
+    const ws = new WebSocket(url);
+    ws.binaryType = "arraybuffer";
+    const stats = new Map;
+    let totalFrames = 0;
+    const startTime = Date.now();
+    let saveDir = "";
+    if (opts.save) {
+      const { mkdirSync: mkdirSync13 } = await import("fs");
+      saveDir = opts.save;
+      mkdirSync13(saveDir, { recursive: true });
+      info(`Saving audio to: ${saveDir}`);
     }
+    ws.onopen = () => {
+      success("Connected to voice stream");
+    };
+    const handleControl = (data2) => {
+      const msg = JSON.parse(data2);
+      const ts = new Date().toLocaleTimeString();
+      const label = msg.userId || msg.sessionId || "";
+      info(`[${ts}] ${String(msg.type)}: ${String(label)}`);
+    };
+    ws.onmessage = async (ev2) => {
+      if (typeof ev2.data === "string") {
+        handleControl(ev2.data);
+        return;
+      }
+      const buf = Buffer.from(ev2.data);
+      const userIdLen = buf[0] ?? 0;
+      const userId = buf.subarray(1, 1 + userIdLen).toString("utf8");
+      const audio = buf.subarray(1 + userIdLen);
+      let s2 = stats.get(userId);
+      if (!s2) {
+        s2 = { frames: 0, bytes: 0 };
+        stats.set(userId, s2);
+        const ts = new Date().toLocaleTimeString();
+        info(`[${ts}] New speaker: ${userId}`);
+      }
+      s2.frames++;
+      s2.bytes += audio.length;
+      totalFrames++;
+      if (saveDir) {
+        const { appendFileSync: appendFileSync2 } = await import("fs");
+        appendFileSync2(`${saveDir}/${userId}.opus`, audio);
+      }
+      if (!opts.eventsOnly && totalFrames % 500 === 0) {
+        const elapsed = ((Date.now() - startTime) / 1000).toFixed(0);
+        const lines = [];
+        for (const [uid2, st] of stats) {
+          lines.push(`  ${uid2}: ${st.frames} frames, ${(st.bytes / 1024).toFixed(1)}KB`);
+        }
+        info(`[${elapsed}s] ${totalFrames} frames total
+${lines.join(`
+`)}`);
+      }
+    };
+    ws.onerror = () => {
+      error("WebSocket error");
+    };
+    ws.onclose = (ev2) => {
+      info(`Disconnected: code=${ev2.code} ${ev2.reason}`);
+      const elapsed = ((Date.now() - startTime) / 1000).toFixed(0);
+      info(`Session lasted ${elapsed}s, ${totalFrames} total frames`);
+      for (const [uid2, st] of stats) {
+        info(`  ${uid2}: ${st.frames} frames, ${(st.bytes / 1024).toFixed(1)}KB`);
+      }
+      process.exit(0);
+    };
+    process.on("SIGINT", () => {
+      info("Closing stream...");
+      ws.close();
+    });
+    await new Promise(() => {});
   });
-  return webhooks;
+  return voice;
 }
 
 // src/commands/where.ts
@@ -153438,6 +153829,12 @@ var COMMANDS = [
     helpGroup: "Management",
     helpDescription: "Webhook management"
   },
+  {
+    create: createSourcesCommand,
+    category: "advanced",
+    helpGroup: "Management",
+    helpDescription: "One-command external source onboarding (github, ...)"
+  },
   {
     create: createTurnsCommand,
     category: "advanced",