@burdenoff/bigconsole-cli 2026.802.1 → 2026.1110.1

package/dist/cli.js

@@ -1,65 +1,2921 @@
 #!/usr/bin/env node
-/**
- * BigConsole CLI — dashboard, widget, parser, and workflow management from the terminal.
- */
-import { Command } from 'commander';
-import chalk from 'chalk';
-import boxen from 'boxen';
-import updateNotifier from 'update-notifier';
-import { readFileSync } from 'fs';
-import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
-import { registerAuthCommands, registerCLIConfigCommands, registerWorkspaceCommands, registerDashboardCommands, registerWidgetCommands, registerDataSinkCommands, registerParserCommands, registerPipelineCommands, registerWorkflowCommands, registerDrilldownCommands, registerShareCommands, registerTemplateCommands, registerPromptCommands, } from './commands/index.js';
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-let pkg = {
-    name: '@burdenoff/bigconsole-cli',
-    version: '0.0.0-dev',
+
+// src/cli.ts
+import { Command } from "commander";
+import chalk from "chalk";
+import boxen from "boxen";
+import updateNotifier from "update-notifier";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join3, dirname } from "path";
+import { fileURLToPath } from "url";
+
+// src/utils/sanitize.ts
+var MAX_ERROR_MESSAGE_LENGTH = 500;
+var MAX_HTTP_BODY_EXCERPT_LENGTH = 200;
+var MAX_SCAN_LENGTH = 4000;
+var REDACTED = "[REDACTED]";
+var ELLIPSIS = "…";
+var ESC = 27;
+var BEL = 7;
+var TAB = 9;
+var LF = 10;
+var CR = 13;
+var DEL = 127;
+var NEL = 133;
+var C1_CSI = 155;
+var C1_ST = 156;
+var LINE_SEPARATOR = 8232;
+var PARAGRAPH_SEPARATOR = 8233;
+var C1_STRING_INTRODUCERS = new Set([144, 152, 157, 158, 159]);
+var ESC_STRING_INTRODUCERS = new Set(["P", "X", "]", "^", "_"].map((c) => c.charCodeAt(0)));
+var BIDI_CONTROLS = /[\u202a-\u202e\u2066-\u2069]/g;
+function toUnicodeEscape(char) {
+  return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
+function escapeBidiControls(text) {
+  return text.replace(BIDI_CONTROLS, toUnicodeEscape);
+}
+function isInRange(code, low, high) {
+  return code >= low && code <= high;
+}
+function skipControlSequence(text, index) {
+  let i = index;
+  while (i < text.length && isInRange(text.charCodeAt(i), 48, 63))
+    i++;
+  while (i < text.length && isInRange(text.charCodeAt(i), 32, 47))
+    i++;
+  if (i < text.length && isInRange(text.charCodeAt(i), 64, 126))
+    i++;
+  return i;
+}
+function skipControlString(text, index) {
+  let i = index;
+  while (i < text.length) {
+    const code = text.charCodeAt(i);
+    if (code === BEL || code === C1_ST)
+      return i + 1;
+    if (code === ESC)
+      return text.charCodeAt(i + 1) === 92 ? i + 2 : i;
+    i++;
+  }
+  return i;
+}
+function skipEscapeSequence(text, index) {
+  const next = text.charCodeAt(index + 1);
+  if (Number.isNaN(next))
+    return index + 1;
+  if (next === 91)
+    return skipControlSequence(text, index + 2);
+  if (ESC_STRING_INTRODUCERS.has(next))
+    return skipControlString(text, index + 2);
+  let i = index + 1;
+  while (i < text.length && isInRange(text.charCodeAt(i), 32, 47))
+    i++;
+  if (i < text.length && isInRange(text.charCodeAt(i), 48, 126))
+    i++;
+  return i;
+}
+function sanitizeForTerminal(value, options = {}) {
+  const text = value === null || value === undefined ? "" : String(value);
+  const multiline = options.preserveNewlines === true;
+  let out = "";
+  let i = 0;
+  while (i < text.length) {
+    const code = text.charCodeAt(i);
+    if (code === ESC) {
+      i = skipEscapeSequence(text, i);
+      continue;
+    }
+    if (code === C1_CSI) {
+      i = skipControlSequence(text, i + 1);
+      continue;
+    }
+    if (C1_STRING_INTRODUCERS.has(code)) {
+      i = skipControlString(text, i + 1);
+      continue;
+    }
+    if (code === CR || code === LF) {
+      const crlf = code === CR && text.charCodeAt(i + 1) === LF;
+      out += multiline ? `
+` : " ";
+      i += crlf ? 2 : 1;
+      continue;
+    }
+    if (code === NEL || code === LINE_SEPARATOR || code === PARAGRAPH_SEPARATOR) {
+      out += multiline ? toUnicodeEscape(text.charAt(i)) : " ";
+      i++;
+      continue;
+    }
+    if (code === TAB) {
+      out += multiline ? "\t" : " ";
+      i++;
+      continue;
+    }
+    if (code < 32 || isInRange(code, DEL, 159)) {
+      i++;
+      continue;
+    }
+    out += text.charAt(i);
+    i++;
+  }
+  return escapeBidiControls(out);
+}
+var SECRET_KEY_HINT = /pass(?:word|wd|phrase)?|secret|token|api[-_]?key|private[-_]?key|access[-_]?key|credential|authori[sz]ation|cookie|session[-_]?id/i;
+var KEY_VALUE_OPENING = /\b([A-Za-z_$][\w$-]{0,127})\\*["']?\s*[:=]\s*/g;
+var QUOTE_OPENING = /^(\\*)(["'])/;
+var UNQUOTED_VALUE = /^[^\s"'\\,;&)}\]]*/;
+var AUTH_SCHEME = /^(?:Bearer|Basic|Digest|Token)\s+/i;
+var BEARER_CREDENTIAL = /\bBearer\s+[A-Za-z0-9\-._~+/]+=*/g;
+var JWT_LIKE = /\beyJ[\w-]{4,}\.[\w-]{4,}\.[\w-]*/g;
+var URL_USERINFO = /\b([a-z][a-z0-9+.-]{1,31}:\/\/)[^\s/?#@"'\\]+@/gi;
+function backslashRun(text, index, floor) {
+  let run = 0;
+  while (index - run - 1 >= floor && text.charAt(index - run - 1) === "\\")
+    run++;
+  return run;
+}
+function maskValue(text, start) {
+  if (text.startsWith(REDACTED, start)) {
+    return { replacement: REDACTED, end: start + REDACTED.length };
+  }
+  const quote = QUOTE_OPENING.exec(text.slice(start, start + 64));
+  if (quote) {
+    const opener = quote[0];
+    const depth = (quote[1] ?? "").length;
+    const quoteChar = quote[2] ?? '"';
+    let search = start + opener.length;
+    while (search < text.length) {
+      const candidate = text.indexOf(quoteChar, search);
+      if (candidate === -1)
+        break;
+      if (backslashRun(text, candidate, start + opener.length) === depth) {
+        return { replacement: `${opener}${REDACTED}${opener}`, end: candidate + 1 };
+      }
+      search = candidate + 1;
+    }
+    return { replacement: `${opener}${REDACTED}`, end: text.length };
+  }
+  const rest = text.slice(start);
+  const scheme = AUTH_SCHEME.exec(rest);
+  const offset = scheme ? scheme[0].length : 0;
+  const run = UNQUOTED_VALUE.exec(rest.slice(offset));
+  const length = offset + (run ? run[0].length : 0);
+  return { replacement: length > 0 ? REDACTED : "", end: start + length };
+}
+function redactKeyValues(text) {
+  let out = "";
+  let copiedUpTo = 0;
+  KEY_VALUE_OPENING.lastIndex = 0;
+  let match;
+  while ((match = KEY_VALUE_OPENING.exec(text)) !== null) {
+    if (!SECRET_KEY_HINT.test(match[1] ?? ""))
+      continue;
+    const start = match.index + match[0].length;
+    const { replacement, end } = maskValue(text, start);
+    if (end === start)
+      continue;
+    out += text.slice(copiedUpTo, start) + replacement;
+    copiedUpTo = end;
+    KEY_VALUE_OPENING.lastIndex = end;
+  }
+  return out + text.slice(copiedUpTo);
+}
+function redactSecrets(text) {
+  return redactKeyValues(text).replace(BEARER_CREDENTIAL, `Bearer ${REDACTED}`).replace(JWT_LIKE, REDACTED).replace(URL_USERINFO, `$1${REDACTED}@`);
+}
+var LINE_BREAK = /\r\n|[\r\n\u0085\u2028\u2029]/;
+function toDisplayLine(value, maxLength = MAX_ERROR_MESSAGE_LENGTH) {
+  if (value === null || value === undefined)
+    return "";
+  const firstLine = String(value).split(LINE_BREAK, 1)[0] ?? "";
+  const scanned = firstLine.slice(0, MAX_SCAN_LENGTH);
+  const line = redactSecrets(sanitizeForTerminal(scanned)).trim();
+  return line.length > maxLength ? `${line.slice(0, maxLength)}${ELLIPSIS}` : line;
+}
+function summarizeHttpBody(body) {
+  return toDisplayLine(body, MAX_HTTP_BODY_EXCERPT_LENGTH) || "empty response body";
+}
+var ERROR_CODE = /^[A-Z][A-Z0-9_]{1,63}$/;
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : undefined;
+}
+function stringField(record, key) {
+  const value = record?.[key];
+  return typeof value === "string" ? value : undefined;
+}
+function isAbortError(error) {
+  const name = stringField(asRecord(error), "name");
+  return name === "AbortError" || name === "TimeoutError";
+}
+function describeResponseError(response) {
+  const status = typeof response.status === "number" ? response.status : undefined;
+  const errors = Array.isArray(response.errors) ? response.errors : [];
+  const first = asRecord(errors[0]);
+  const extensions = asRecord(first?.extensions);
+  const original = toDisplayLine(stringField(asRecord(extensions?.originalError), "message"));
+  const wrapper = toDisplayLine(stringField(first, "message"));
+  const rawCode = stringField(extensions, "code");
+  const code = rawCode !== undefined && ERROR_CODE.test(rawCode) ? rawCode : undefined;
+  const base = original || wrapper || (status !== undefined ? `Request failed (HTTP ${status})` : "Request failed");
+  return {
+    message: code ? `${base} [${code}]` : base,
+    ...status !== undefined ? { status } : {},
+    ...code ? { code } : {}
+  };
+}
+function networkErrorCode(error) {
+  const code = stringField(asRecord(asRecord(error)?.cause), "code");
+  return code !== undefined && ERROR_CODE.test(code) ? code : undefined;
+}
+function describeRequestError(error) {
+  const response = asRecord(asRecord(error)?.response);
+  if (response)
+    return describeResponseError(response);
+  if (isAbortError(error))
+    return { message: "Request timed out" };
+  if (error instanceof TypeError) {
+    const detail = toDisplayLine(error.message, MAX_HTTP_BODY_EXCERPT_LENGTH);
+    const code = networkErrorCode(error);
+    return {
+      message: `Network error${detail ? `: ${detail}` : ""}${code ? ` (${code})` : ""}`
+    };
+  }
+  return { message: toSafeErrorMessage(error) };
+}
+function toSafeErrorMessage(error) {
+  const response = asRecord(asRecord(error)?.response);
+  if (response)
+    return describeResponseError(response).message;
+  if (isAbortError(error))
+    return "Request timed out";
+  if (error instanceof Error || typeof error === "string") {
+    const text = typeof error === "string" ? error : error.message;
+    return toDisplayLine(text) || "Unexpected error";
+  }
+  return "Unexpected error";
+}
+
+// src/config/index.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CONFIG_DIR = join(homedir(), ".config", "bigconsole-cli");
+var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+var DEFAULT_CLIENT_ID = "burdenoff_cli_bigconsole";
+var PROD_OIDC_ISSUER = "https://graphql.burdenoff.com/global";
+var PROD_WORKSPACE_ENDPOINT = "https://graphqlworkspaces.burdenoff.com/workspaces/graphql";
+var PROD_GLOBAL_ENDPOINT = "https://graphql.burdenoff.com/global/graphql";
+var DEFAULT_CONFIG = {
+  workspaceEndpoint: PROD_WORKSPACE_ENDPOINT,
+  globalEndpoint: PROD_GLOBAL_ENDPOINT
 };
-try {
-    const packagePath = join(__dirname, '../package.json');
-    pkg = JSON.parse(readFileSync(packagePath, 'utf8'));
+function ensureConfigDir() {
+  if (!existsSync(CONFIG_DIR)) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  }
 }
-catch {
-    // package.json not found in dev mode — use defaults
+function getEnvOverrides() {
+  const overrides = {};
+  if (process.env.BIGCONSOLE_WORKSPACE_ENDPOINT) {
+    overrides.workspaceEndpoint = process.env.BIGCONSOLE_WORKSPACE_ENDPOINT;
+  }
+  if (process.env.BIGCONSOLE_GLOBAL_ENDPOINT) {
+    overrides.globalEndpoint = process.env.BIGCONSOLE_GLOBAL_ENDPOINT;
+  }
+  if (process.env.BIGCONSOLE_OIDC_ISSUER) {
+    overrides.oidcIssuer = process.env.BIGCONSOLE_OIDC_ISSUER;
+  }
+  if (process.env.BIGCONSOLE_CLIENT_ID) {
+    overrides.clientId = process.env.BIGCONSOLE_CLIENT_ID;
+  }
+  return overrides;
 }
-try {
-    const notifier = updateNotifier({
-        pkg,
-        updateCheckInterval: 1000 * 60 * 60 * 24,
+function readConfig() {
+  try {
+    const envOverrides = getEnvOverrides();
+    if (!existsSync(CONFIG_FILE))
+      return { ...DEFAULT_CONFIG, ...envOverrides };
+    const raw = readFileSync(CONFIG_FILE, "utf8");
+    const stored = JSON.parse(raw);
+    return { ...DEFAULT_CONFIG, ...envOverrides, ...stored };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+function writeConfig(config) {
+  ensureConfigDir();
+  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: "utf8" });
+  try {
+    chmodSync(CONFIG_FILE, 384);
+  } catch {}
+}
+function getConfigValue(key) {
+  const config = readConfig();
+  return config[key];
+}
+function setConfigValue(key, value) {
+  const config = readConfig();
+  config[key] = value;
+  writeConfig(config);
+}
+function getConfigPath() {
+  return CONFIG_FILE;
+}
+function getConfigDir() {
+  return CONFIG_DIR;
+}
+function resolveOIDCConfig() {
+  const config = readConfig();
+  const clientId = config.clientId || DEFAULT_CLIENT_ID;
+  let oidcIssuer = config.oidcIssuer;
+  if (!oidcIssuer) {
+    const globalEndpoint = config.globalEndpoint;
+    const isProdEndpoint = globalEndpoint.includes("graphql.burdenoff.com");
+    if (isProdEndpoint) {
+      oidcIssuer = PROD_OIDC_ISSUER;
+    } else {
+      oidcIssuer = globalEndpoint.replace(/\/graphql$/, "");
+    }
+  }
+  return { oidcIssuer, clientId };
+}
+var KNOWN_CONFIG_KEYS = [
+  "workspaceEndpoint",
+  "globalEndpoint",
+  "oidcIssuer",
+  "clientId",
+  "defaultFormat",
+  "verbose",
+  "authServiceEndpoint"
+];
+
+// src/auth/store.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2, chmodSync as chmodSync2, unlinkSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+var CONFIG_DIR2 = join2(homedir2(), ".config", "bigconsole-cli");
+var AUTH_FILE = join2(CONFIG_DIR2, "auth.json");
+function ensureConfigDir2() {
+  if (!existsSync2(CONFIG_DIR2)) {
+    mkdirSync2(CONFIG_DIR2, { recursive: true, mode: 448 });
+  }
+}
+function readAuth() {
+  try {
+    if (!existsSync2(AUTH_FILE))
+      return null;
+    const raw = readFileSync2(AUTH_FILE, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function writeAuth(auth) {
+  ensureConfigDir2();
+  writeFileSync2(AUTH_FILE, JSON.stringify(auth, null, 2), { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync2(AUTH_FILE, 384);
+  } catch {}
+}
+function clearAuth() {
+  try {
+    if (existsSync2(AUTH_FILE)) {
+      unlinkSync(AUTH_FILE);
+    }
+  } catch {}
+}
+function isTokenExpired(auth) {
+  if (!auth.expiresAt)
+    return false;
+  return Date.now() >= auth.expiresAt;
+}
+function isTokenExpiringSoon(auth) {
+  if (!auth.expiresAt)
+    return false;
+  const BUFFER_MS = 5 * 60 * 1000;
+  return Date.now() + BUFFER_MS >= auth.expiresAt;
+}
+function isWorkspaceTokenExpiringSoon(auth) {
+  if (!auth.workspaceTokenExpiresAt)
+    return false;
+  const BUFFER_MS = 5 * 60 * 1000;
+  return Date.now() + BUFFER_MS >= auth.workspaceTokenExpiresAt;
+}
+
+// src/auth/device-code.ts
+import fetch from "cross-fetch";
+function serverMessage(message) {
+  return toDisplayLine(message, MAX_HTTP_BODY_EXCERPT_LENGTH) || "Unknown error";
+}
+async function httpFailure(prefix, response) {
+  const body = await response.text().catch(() => "");
+  return new Error(`${prefix} (${response.status}): ${summarizeHttpBody(body)}`);
+}
+async function startDeviceCodeFlow(config) {
+  const url = `${config.oidcIssuer}/oidc/device/code`;
+  const body = new URLSearchParams({
+    client_id: config.clientId,
+    scope: "openid profile email offline_access"
+  });
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    throw await httpFailure("Device code request failed", response);
+  }
+  const data = await response.json();
+  return {
+    deviceCode: data["device_code"],
+    userCode: data["user_code"],
+    verificationUri: data["verification_uri"],
+    verificationUriComplete: data["verification_uri_complete"] ?? null,
+    expiresIn: data["expires_in"],
+    interval: data["interval"] ?? 5
+  };
+}
+async function pollForToken(deviceCode, interval, config) {
+  const url = `${config.oidcIssuer}/oauth/device/token`;
+  let pollInterval = interval;
+  while (true) {
+    await new Promise((resolve) => setTimeout(resolve, pollInterval * 1000));
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: deviceCode,
+        client_id: config.clientId
+      }).toString()
     });
-    // Suppress the update banner when the caller asked for machine-readable
-    // output (`--format json|yaml`) or when stdout isn't a TTY. Printing a
-    // human-readable box on stdout corrupts JSON/YAML piped to jq, yq,
-    // shell vars, etc. Also send the banner to stderr (not stdout) so
-    // it still doesn't mingle with data even in formats we miss.
-    const argv = process.argv.slice(2);
-    const fmtIndex = argv.findIndex((a) => a === '-f' || a === '--format');
-    const fmt = fmtIndex !== -1 ? argv[fmtIndex + 1]?.toLowerCase() : undefined;
-    const isMachineOutput = fmt === 'json' || fmt === 'yaml' || fmt === 'yml';
-    const isTty = Boolean(process.stdout.isTTY);
-    if (notifier.update && !isMachineOutput && isTty) {
-        const message = `Update available: ${chalk.dim(notifier.update.current)} → ${chalk.green(notifier.update.latest)}\nRun ${chalk.cyan(`bun add -g ${pkg.name}`)} to update`;
-        process.stderr.write(boxen(message, {
-            padding: 1,
-            margin: 1,
-            align: 'center',
-            borderColor: 'yellow',
-            borderStyle: 'round',
-        }) + '\n');
-    }
-}
-catch {
-    // Update check is best-effort; never block CLI startup on a network failure.
-}
-const program = new Command();
-program
-    .name('bigconsole')
-    .description('BigConsole CLI — dashboards, widgets, parsers, and workflows from the terminal')
-    .version(pkg.version, '-v, --version')
-    .option('-f, --format <format>', 'Output format (json, table, yaml)')
-    .option('--verbose', 'Enable verbose logging')
-    .option('--no-color', 'Disable colored output');
+    const raw = await response.text();
+    let data;
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      if (response.status >= 500) {
+        continue;
+      }
+      throw new Error(`Token endpoint returned non-JSON response (status ${response.status}): ${summarizeHttpBody(raw)}`);
+    }
+    if (response.ok && data["access_token"]) {
+      return {
+        accessToken: data["access_token"],
+        refreshToken: data["refresh_token"] ?? "",
+        expiresIn: data["expires_in"] ?? 3600
+      };
+    }
+    const errorCode = data["error"];
+    switch (errorCode) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        pollInterval += 5;
+        continue;
+      case "expired_token":
+        throw new Error("Device code has expired. Please try again.");
+      case "access_denied":
+        throw new Error("Authorization was denied by the user.");
+      default:
+        throw new Error(`Device code polling failed: ${serverMessage(data["error_description"] ?? errorCode)}`);
+    }
+  }
+}
+async function clientCredentialsFlow(globalEndpoint, clientId, clientSecret, scopes) {
+  const query = `
+    mutation AuthenticateApp($input: AuthenticateAppInput!) {
+      authenticateApp(input: $input) {
+        accessToken tokenType expiresIn scopes
+      }
+    }
+  `;
+  const response = await fetch(globalEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      query,
+      variables: { input: { clientId, clientSecret, scopes } }
+    })
+  });
+  if (!response.ok) {
+    throw await httpFailure("App authentication failed", response);
+  }
+  const data = await response.json();
+  if (data.errors?.length) {
+    throw new Error(`App authentication failed: ${serverMessage(data.errors[0]?.message)}`);
+  }
+  if (!data.data?.authenticateApp?.accessToken) {
+    throw new Error("App authentication failed: no access token returned");
+  }
+  return data.data.authenticateApp;
+}
+async function issueWorkspaceToken(workspaceEndpoint, authToken, workspaceId, organizationId) {
+  const query = `
+    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
+      issueWorkspaceToken(input: $input) {
+        success token expiresAt scopes
+        error { code message }
+      }
+    }
+  `;
+  const response = await fetch(workspaceEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${authToken}`
+    },
+    body: JSON.stringify({
+      query,
+      variables: { input: { workspaceId, organizationId } }
+    })
+  });
+  if (!response.ok) {
+    throw await httpFailure("Workspace token request failed", response);
+  }
+  const data = await response.json();
+  if (data.errors?.length) {
+    throw new Error(`Workspace token failed: ${serverMessage(data.errors[0]?.message)}`);
+  }
+  const result = data.data?.issueWorkspaceToken;
+  if (!result?.success || !result.token) {
+    throw new Error(`Workspace token failed: ${serverMessage(result?.error?.message)}`);
+  }
+  return { token: result.token, expiresAt: result.expiresAt, scopes: result.scopes ?? [] };
+}
+async function fetchWorkspaces(globalEndpoint, authToken) {
+  const query = `
+    query MyWorkspaces($limit: Int) {
+      myWorkspaces(limit: $limit) {
+        items { id name slug tenantId organizationId }
+      }
+    }
+  `;
+  const response = await fetch(globalEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${authToken}`
+    },
+    body: JSON.stringify({ query, variables: { limit: 50 } })
+  });
+  if (!response.ok) {
+    throw await httpFailure("Failed to fetch workspaces", response);
+  }
+  const data = await response.json();
+  if (data.errors?.length) {
+    throw new Error(`Failed to fetch workspaces: ${serverMessage(data.errors[0]?.message)}`);
+  }
+  return data.data?.myWorkspaces?.items ?? [];
+}
+function isValidHttpUrl(urlString) {
+  try {
+    const parsed = new URL(urlString);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+async function openBrowser(url) {
+  try {
+    if (!isValidHttpUrl(url)) {
+      return false;
+    }
+    const { execFile } = await import("child_process");
+    const platform = process.platform;
+    let command;
+    let args;
+    if (platform === "darwin") {
+      command = "open";
+      args = [url];
+    } else if (platform === "win32") {
+      command = "cmd";
+      args = ["/c", "start", "", url];
+    } else {
+      command = "xdg-open";
+      args = [url];
+    }
+    return new Promise((resolve) => {
+      execFile(command, args, (error) => {
+        resolve(!error);
+      });
+    });
+  } catch {
+    return false;
+  }
+}
+
+// src/graphql/client.ts
+import { GraphQLClient } from "graphql-request";
+
+// src/utils/output.ts
+import {
+  DEFAULT_SCALAR_STYLE_RULES,
+  JSON_SCHEMA,
+  SCALAR_STYLE,
+  dump,
+  strTag
+} from "js-yaml";
+var MAX_COLUMN_WIDTH = 50;
+function isInteractive() {
+  return Boolean(process.stdout.isTTY && process.stdin.isTTY);
+}
+function getFormat(options) {
+  if (options.format) {
+    const f = options.format.toLowerCase();
+    if (f === "json" || f === "table" || f === "yaml")
+      return f;
+    if (f === "yml")
+      return "yaml";
+  }
+  return isInteractive() ? "table" : "json";
+}
+var JSON_DISPLAY_ESCAPES = /[\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+function toJson(data) {
+  const json = JSON.stringify(data, null, 2) ?? "null";
+  return json.replace(JSON_DISPLAY_ESCAPES, toUnicodeEscape);
+}
+function printJson(data) {
+  console.log(toJson(data));
+}
+function printTable(headers, rows) {
+  if (headers.length === 0)
+    return;
+  const header = headers.map((h) => sanitizeForTerminal(h));
+  const body = rows.map((row) => headers.map((_, i) => sanitizeForTerminal(row[i])));
+  const colWidths = header.map((h, i) => Math.min(body.reduce((max, row) => Math.max(max, (row[i] ?? "").length), h.length), MAX_COLUMN_WIDTH));
+  const separator = colWidths.map((w) => "-".repeat(w + 2)).join("+");
+  const formatRow = (cells) => cells.map((cell, i) => ` ${cell.padEnd(colWidths[i] ?? 0)} `).join("|");
+  console.log(formatRow(header));
+  console.log(separator);
+  for (const row of body) {
+    console.log(formatRow(row));
+  }
+}
+function allowsStyle(mask, style) {
+  return (mask & 1 << style) !== 0;
+}
+var BIDI_CONTROL = /[\u202a-\u202e\u2066-\u2069]/;
+var UNAMBIGUOUS_PLAIN = /^\p{L}[\p{L}\p{N} _./@+-]*$/u;
+var NON_STRING_WORDS = /^(?:y|n|yes|no|on|off|true|false|null)$/i;
+var doubleQuoteBidiControls = (layout) => {
+  if (BIDI_CONTROL.test(layout.node.value))
+    layout.style = SCALAR_STYLE.DOUBLE_QUOTED;
+};
+var quoteAmbiguousStrings = (layout) => {
+  if (layout.style !== SCALAR_STYLE.PLAIN || layout.node.tag !== strTag.tagName)
+    return;
+  const value = layout.node.value;
+  if (UNAMBIGUOUS_PLAIN.test(value) && !NON_STRING_WORDS.test(value))
+    return;
+  layout.style = allowsStyle(layout.allowedStylesMask, SCALAR_STYLE.SINGLE_QUOTED) ? SCALAR_STYLE.SINGLE_QUOTED : SCALAR_STYLE.DOUBLE_QUOTED;
+};
+var YAML_STYLE_RULES = [
+  doubleQuoteBidiControls,
+  ...Object.values(DEFAULT_SCALAR_STYLE_RULES),
+  quoteAmbiguousStrings
+];
+function toYaml(data) {
+  const yaml = dump(data ?? null, {
+    schema: JSON_SCHEMA,
+    noRefs: true,
+    skipInvalid: true,
+    lineWidth: -1,
+    scalarStyleRules: YAML_STYLE_RULES
+  });
+  return escapeBidiControls(yaml).trimEnd();
+}
+function printYaml(data) {
+  console.log(toYaml(data));
+}
+function printSuccess(message) {
+  console.error(`✓ ${sanitizeForTerminal(message)}`);
+}
+function printError(message) {
+  console.error(`✗ ${redactSecrets(sanitizeForTerminal(message))}`);
+}
+function printWarning(message) {
+  console.warn(`! ${redactSecrets(sanitizeForTerminal(message))}`);
+}
+function printInfo(message) {
+  console.error(`ℹ ${sanitizeForTerminal(message)}`);
+}
+function formatDate(date) {
+  if (!date)
+    return "-";
+  try {
+    return new Date(date).toLocaleString();
+  } catch {
+    return date;
+  }
+}
+function formatStatus(status) {
+  if (!status)
+    return "-";
+  const upper = status.toUpperCase();
+  switch (upper) {
+    case "ACTIVE":
+    case "RUNNING":
+    case "HEALTHY":
+      return `✓ ${status}`;
+    case "INACTIVE":
+    case "STOPPED":
+    case "PENDING":
+      return `○ ${status}`;
+    case "ERROR":
+      return `✗ ${status}`;
+    case "ARCHIVED":
+      return `→ ${status}`;
+    case "STARTING":
+      return `▶ ${status}`;
+    case "TERMINATED":
+      return `■ ${status}`;
+    default:
+      return status;
+  }
+}
+function outputData(format, data, tableConfig) {
+  switch (format) {
+    case "json":
+      printJson(data);
+      break;
+    case "yaml":
+      printYaml(data);
+      break;
+    case "table":
+      if (tableConfig) {
+        printTable(tableConfig.headers, tableConfig.rows);
+      } else {
+        printJson(data);
+      }
+      break;
+  }
+}
+function truncate(str, maxLen) {
+  if (!str)
+    return "-";
+  const clean = sanitizeForTerminal(str);
+  if (clean.length <= maxLen)
+    return clean;
+  return clean.substring(0, maxLen - 3) + "...";
+}
+
+// src/graphql/client.ts
+var DEFAULT_TIMEOUT = 30000;
+var MAX_RETRIES = 3;
+var INITIAL_RETRY_DELAY_MS = 1000;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isNetworkOrServerError(error) {
+  if (error instanceof TypeError)
+    return true;
+  if (error && typeof error === "object" && "response" in error) {
+    const resp = error.response;
+    if (resp && typeof resp.status === "number" && resp.status >= 500)
+      return true;
+  }
+  return false;
+}
+
+class BigConsoleRequestError extends Error {
+  status;
+  code;
+  constructor(description) {
+    super(description.message);
+    this.name = "BigConsoleRequestError";
+    this.status = description.status;
+    this.code = description.code;
+  }
+}
+var workspaceClient = null;
+var globalClient = null;
+function getHeaders(auth) {
+  const headers = {};
+  if (auth?.accessToken) {
+    headers["Authorization"] = `Bearer ${auth.accessToken}`;
+  }
+  return headers;
+}
+function getWorkspaceHeaders(auth) {
+  const headers = getHeaders(auth);
+  if (auth?.workspaceToken) {
+    headers["X-Workspace-Authorization"] = `Bearer ${auth.workspaceToken}`;
+  }
+  if (auth?.organizationId) {
+    headers["x-org-id"] = auth.organizationId;
+  }
+  return headers;
+}
+function initClients() {
+  const config = readConfig();
+  const auth = readAuth();
+  workspaceClient = new GraphQLClient(config.workspaceEndpoint);
+  workspaceClient.setHeaders(getWorkspaceHeaders(auth));
+  globalClient = new GraphQLClient(config.globalEndpoint);
+  globalClient.setHeaders(getHeaders(auth));
+  return { workspace: workspaceClient, global: globalClient };
+}
+async function refreshPlatformToken() {
+  const auth = readAuth();
+  if (!auth)
+    return;
+  if (auth.authMethod === "client_credentials" && auth.clientId && auth.clientSecret) {
+    const config = readConfig();
+    try {
+      const result = await clientCredentialsFlow(config.globalEndpoint, auth.clientId, auth.clientSecret);
+      writeAuth({
+        ...auth,
+        accessToken: result.accessToken,
+        expiresAt: Date.now() + result.expiresIn * 1000
+      });
+      workspaceClient = null;
+      globalClient = null;
+    } catch (error) {
+      printError(`App token refresh failed: ${toSafeErrorMessage(error)}`);
+    }
+    return;
+  }
+  if (!auth.refreshToken)
+    return;
+  const config = readConfig();
+  const client = new GraphQLClient(config.globalEndpoint);
+  client.setHeaders({ Authorization: `Bearer ${auth.accessToken}` });
+  const REFRESH_MUTATION = `
+    mutation RefreshToken($token: String!) {
+      refreshToken(token: $token) {
+        accessToken
+        refreshToken
+        expiresIn
+      }
+    }
+  `;
+  try {
+    const data = await client.request(REFRESH_MUTATION, {
+      token: auth.refreshToken
+    });
+    const result = data.refreshToken;
+    const expiresAt = Date.now() + result.expiresIn * 1000;
+    writeAuth({
+      ...auth,
+      accessToken: result.accessToken,
+      refreshToken: result.refreshToken,
+      expiresAt
+    });
+    workspaceClient = null;
+    globalClient = null;
+  } catch (error) {
+    printError(`Token refresh failed: ${toSafeErrorMessage(error)}`);
+  }
+}
+async function refreshWorkspaceToken() {
+  const auth = readAuth();
+  if (!auth?.accessToken || !auth.workspaceId || !auth.organizationId)
+    return;
+  const config = readConfig();
+  try {
+    const result = await issueWorkspaceToken(config.workspaceEndpoint, auth.accessToken, auth.workspaceId, auth.organizationId);
+    writeAuth({
+      ...auth,
+      workspaceToken: result.token,
+      workspaceTokenExpiresAt: new Date(result.expiresAt).getTime()
+    });
+    workspaceClient = null;
+  } catch (error) {
+    printError(`Workspace token refresh failed: ${toSafeErrorMessage(error)}`);
+  }
+}
+async function ensureFreshTokens() {
+  const auth = readAuth();
+  if (!auth)
+    return;
+  if (isTokenExpiringSoon(auth)) {
+    await refreshPlatformToken();
+  }
+  const freshAuth = readAuth();
+  if (freshAuth && freshAuth.workspaceToken && isWorkspaceTokenExpiringSoon(freshAuth)) {
+    await refreshWorkspaceToken();
+  }
+}
+function isRetryableDocument(document) {
+  const text = typeof document === "string" ? document : typeof document?.loc?.source?.body === "string" ? document.loc.source.body : "";
+  const m = text.match(/\b(query|mutation|subscription)\b/i);
+  return !m || m[1].toLowerCase() === "query";
+}
+async function executeWithRetry(client, document, variables) {
+  const retryable = isRetryableDocument(document);
+  const maxAttempts = retryable ? MAX_RETRIES : 1;
+  let lastError;
+  for (let attempt = 0;attempt < maxAttempts; attempt++) {
+    try {
+      const controller = new AbortController;
+      const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
+      try {
+        return await client.request({
+          document,
+          variables,
+          signal: controller.signal
+        });
+      } finally {
+        clearTimeout(timer);
+      }
+    } catch (error) {
+      lastError = error;
+      if (error && typeof error === "object" && "response" in error) {
+        const resp = error.response;
+        if (resp && typeof resp.status === "number" && resp.status >= 400 && resp.status < 500) {
+          break;
+        }
+      }
+      if (retryable && isNetworkOrServerError(error) && attempt < maxAttempts - 1) {
+        const delay = INITIAL_RETRY_DELAY_MS * Math.pow(2, attempt);
+        await sleep(delay);
+        continue;
+      }
+      break;
+    }
+  }
+  throw new BigConsoleRequestError(describeRequestError(lastError));
+}
+async function workspaceRequest(document, variables) {
+  await ensureFreshTokens();
+  const { workspace } = workspaceClient ? { workspace: workspaceClient } : initClients();
+  const auth = readAuth();
+  workspace.setHeaders(getWorkspaceHeaders(auth));
+  return executeWithRetry(workspace, document, variables);
+}
+async function globalRequest(document, variables) {
+  const { global: client } = globalClient ? { global: globalClient } : initClients();
+  const auth = readAuth();
+  client.setHeaders(getHeaders(auth));
+  return executeWithRetry(client, document, variables);
+}
+function resetClients() {
+  workspaceClient = null;
+  globalClient = null;
+}
+
+// src/graphql/operations.ts
+var SIGN_OUT = `
+  mutation SignOut {
+    signOut
+  }
+`;
+var REFRESH_TOKEN = `
+  mutation RefreshToken($token: String!) {
+    refreshToken(token: $token) {
+      accessToken
+      refreshToken
+      expiresIn
+    }
+  }
+`;
+var LIST_DASHBOARDS = `
+  query ListDashboards(
+    $first: Int
+    $after: String
+    $search: String
+    $visibility: BigConsoleDashboardVisibility
+    $category: BigConsoleDashboardCategory
+    $includeArchived: Boolean
+    $sortBy: BigConsoleDashboardSortField
+    $sortOrder: SortOrder
+  ) {
+    listDashboards(
+      first: $first
+      after: $after
+      search: $search
+      visibility: $visibility
+      category: $category
+      includeArchived: $includeArchived
+      sortBy: $sortBy
+      sortOrder: $sortOrder
+    ) {
+      edges {
+        node {
+          id
+          name
+          description
+          status
+          visibility
+          category
+          ownerId
+          createdAt
+          updatedAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_DASHBOARD = `
+  query GetDashboard($id: ID!) {
+    getDashboard(id: $id) {
+      id
+      name
+      description
+      status
+      visibility
+      category
+      ownerId
+      definitionVersion
+      createdAt
+      updatedAt
+    }
+  }
+`;
+var ARCHIVE_DASHBOARD = `
+  mutation ArchiveDashboard($id: ID!) {
+    archiveDashboard(id: $id) {
+      id
+      name
+      status
+    }
+  }
+`;
+var DELETE_DASHBOARD = `
+  mutation DeleteDashboard($id: ID!) {
+    deleteBigConsoleDashboard(id: $id)
+  }
+`;
+var LIST_WIDGETS = `
+  query ListWidgets($pageId: ID!, $first: Int, $after: String, $type: BigConsoleWidgetType) {
+    listWidgets(pageId: $pageId, first: $first, after: $after, type: $type) {
+      edges {
+        node {
+          id
+          pageId
+          dashboardId
+          type
+          title
+          dataSinkId
+          lastRefreshedAt
+          createdAt
+          updatedAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_WIDGET = `
+  query GetWidget($id: ID!) {
+    getWidget(id: $id) {
+      id
+      pageId
+      dashboardId
+      type
+      title
+      config
+      dataSinkId
+      datasetId
+      lastRefreshedAt
+      cacheTTL
+      createdAt
+      updatedAt
+    }
+  }
+`;
+var DELETE_WIDGET = `
+  mutation DeleteWidget($id: ID!) {
+    deleteBigConsoleWidget(id: $id)
+  }
+`;
+var LIST_DATASINKS = `
+  query ListDataSinks(
+    $first: Int
+    $after: String
+    $search: String
+    $status: DataSinkStatus
+    $setupState: DataSinkSetupState
+    $isActive: Boolean
+  ) {
+    listDataSinks(
+      first: $first
+      after: $after
+      search: $search
+      status: $status
+      setupState: $setupState
+      isActive: $isActive
+    ) {
+      edges {
+        node {
+          id
+          name
+          key
+          description
+          status
+          setupState
+          isActive
+          createdAt
+          updatedAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_DATASINK = `
+  query GetDataSink($id: ID, $key: String) {
+    getDataSink(id: $id, key: $key) {
+      id
+      name
+      key
+      description
+      status
+      setupState
+      isActive
+      version
+      createdAt
+      updatedAt
+    }
+  }
+`;
+var GET_DATASINK_DATA = `
+  query GetDataSinkData($id: ID, $key: String, $dataPath: String, $forceRefresh: Boolean) {
+    getDataSinkData(id: $id, key: $key, dataPath: $dataPath, forceRefresh: $forceRefresh) {
+      raw
+      extracted
+      cached
+      fetchedAt
+      version
+      totalCount
+      hasMore
+      limit
+      offset
+    }
+  }
+`;
+var DELETE_DATASINK = `
+  mutation DeleteDataSink($id: ID!) {
+    deleteDataSink(id: $id) {
+      id
+      name
+    }
+  }
+`;
+var LIST_PARSERS = `
+  query ListParsers($first: Int, $after: String, $filter: ParserFilterInput) {
+    listParsers(first: $first, after: $after, filter: $filter) {
+      edges {
+        node {
+          id
+          name
+          description
+          type
+          status
+          inputSinkKey
+          outputKey
+          outputWidgetId
+          ttl
+          version
+          createdAt
+          updatedAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_PARSER = `
+  query GetParser($id: ID!) {
+    parser(id: $id) {
+      id
+      name
+      description
+      type
+      status
+      expression
+      inputSinkKey
+      outputKey
+      outputWidgetId
+      ttl
+      version
+      createdAt
+      updatedAt
+    }
+  }
+`;
+var DELETE_PARSER = `
+  mutation DeleteParser($id: ID!) {
+    deleteParser(id: $id)
+  }
+`;
+var LIST_PIPELINES = `
+  query ListPipelines($first: Int, $after: String, $filter: PipelineFilterInput) {
+    listPipelines(first: $first, after: $after, filter: $filter) {
+      edges {
+        node {
+          id
+          name
+          description
+          status
+          version
+          lastExecutedAt
+          createdAt
+          updatedAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_PIPELINE = `
+  query GetPipeline($id: ID!) {
+    pipeline(id: $id) {
+      id
+      name
+      description
+      status
+      version
+      lastExecutedAt
+      stages {
+        id
+        position
+        inputKey
+        outputKey
+        enabled
+        parserName
+        parserType
+      }
+      createdAt
+      updatedAt
+    }
+  }
+`;
+var DELETE_PIPELINE = `
+  mutation DeletePipeline($id: ID!) {
+    deletePipeline(id: $id)
+  }
+`;
+var CREATE_DASHBOARD = `
+  mutation CreateDashboard($input: BigConsoleCreateDashboardInput!) {
+    createBigConsoleDashboard(input: $input) {
+      id
+      name
+      status
+      visibility
+      category
+      createdAt
+    }
+  }
+`;
+var UPDATE_DASHBOARD = `
+  mutation UpdateDashboard($input: BigConsoleUpdateDashboardInput!) {
+    updateBigConsoleDashboard(input: $input) {
+      id
+      name
+      status
+      visibility
+      category
+      updatedAt
+    }
+  }
+`;
+var IMPORT_DASHBOARD = `
+  mutation ImportDashboard($input: BigConsoleImportDashboardInput!) {
+    importDashboard(input: $input) {
+      id
+      name
+      status
+      visibility
+      category
+      createdAt
+    }
+  }
+`;
+var EXPORT_DASHBOARD = `
+  query ExportDashboard($id: ID!, $options: BigConsoleExportDashboardOptions) {
+    exportDashboard(id: $id, options: $options)
+  }
+`;
+var CREATE_WIDGET = `
+  mutation CreateWidget($input: BigConsoleCreateWidgetInput!) {
+    createBigConsoleWidget(input: $input) {
+      id
+      pageId
+      type
+      title
+      createdAt
+    }
+  }
+`;
+var UPDATE_WIDGET = `
+  mutation UpdateWidget($input: BigConsoleUpdateWidgetInput!) {
+    updateBigConsoleWidget(input: $input) {
+      id
+      pageId
+      type
+      title
+      updatedAt
+    }
+  }
+`;
+var CREATE_DATASINK = `
+  mutation CreateDataSink($input: CreateDataSinkInput!) {
+    createDataSink(input: $input) {
+      id
+      name
+      key
+      status
+      setupState
+      isActive
+      createdAt
+    }
+  }
+`;
+var UPDATE_DATASINK = `
+  mutation UpdateDataSink($input: UpdateDataSinkInput!) {
+    updateDataSink(input: $input) {
+      id
+      name
+      key
+      status
+      isActive
+      updatedAt
+    }
+  }
+`;
+var CREATE_PARSER = `
+  mutation CreateParser($input: CreateParserInput!) {
+    createParser(input: $input) {
+      id
+      name
+      type
+      status
+      inputSinkKey
+      outputKey
+      version
+      createdAt
+    }
+  }
+`;
+var UPDATE_PARSER = `
+  mutation UpdateParser($id: ID!, $version: Int!, $input: UpdateParserInput!) {
+    updateParser(id: $id, version: $version, input: $input) {
+      id
+      name
+      type
+      status
+      version
+      updatedAt
+    }
+  }
+`;
+var CREATE_PIPELINE = `
+  mutation CreatePipeline($input: CreatePipelineInput!) {
+    createPipeline(input: $input) {
+      id
+      name
+      status
+      version
+      createdAt
+    }
+  }
+`;
+var UPDATE_PIPELINE = `
+  mutation UpdatePipeline($id: ID!, $version: Int!, $input: UpdatePipelineInput!) {
+    updatePipeline(id: $id, version: $version, input: $input) {
+      id
+      name
+      status
+      version
+      updatedAt
+    }
+  }
+`;
+var GET_WIDGET_ACTIONS = `
+  query GetWidgetActions($widgetId: ID!) {
+    getWidgetActions(widgetId: $widgetId) {
+      id
+      widgetId
+      type
+      name
+      label
+      order
+      disabled
+      hidden
+      createdAt
+    }
+  }
+`;
+var DELETE_WIDGET_DRILLDOWN = `
+  mutation DeleteWidgetDrilldown($id: ID!) {
+    deleteWidgetDrilldown(id: $id)
+  }
+`;
+var GET_WIDGET_DRILLDOWN = `
+  query GetWidgetDrilldown($id: ID!) {
+    getWidget(id: $id) {
+      id
+      drilldown {
+        id
+      }
+    }
+  }
+`;
+var LIST_DASHBOARD_SHARES = `
+  query ListDashboardShares(
+    $dashboardId: ID!
+    $first: Int
+    $after: String
+    $isActive: Boolean
+    $permission: BigConsoleDashboardSharePermission
+    $recipientType: BigConsoleDashboardShareRecipientType
+  ) {
+    listDashboardShares(
+      dashboardId: $dashboardId
+      first: $first
+      after: $after
+      isActive: $isActive
+      permission: $permission
+      recipientType: $recipientType
+    ) {
+      edges {
+        node {
+          id
+          dashboardId
+          permission
+          isActive
+          expiresAt
+          createdAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var LIST_TEMPLATES = `
+  query ListTemplates(
+    $first: Int
+    $after: String
+    $category: BigConsoleDashboardCategory
+    $search: String
+    $isFeatured: Boolean
+  ) {
+    listTemplates(
+      first: $first
+      after: $after
+      category: $category
+      search: $search
+      isFeatured: $isFeatured
+    ) {
+      edges {
+        node {
+          id
+          name
+          description
+          category
+          isFeatured
+          status
+          createdAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_TEMPLATE = `
+  query GetTemplate($id: ID!) {
+    getTemplate(id: $id) {
+      id
+      name
+      description
+      category
+      isFeatured
+      status
+      createdAt
+    }
+  }
+`;
+var GENERATE_DASHBOARD_FROM_PROMPT = `
+  mutation GenerateDashboardFromPrompt($input: BigConsoleGenerateDashboardFromPromptInput!) {
+    generateDashboardFromPrompt(input: $input) {
+      id
+      status
+      prompt
+      createdAt
+    }
+  }
+`;
+var LIST_PROMPT_GENERATIONS = `
+  query ListPromptGenerations($first: Int, $after: String, $status: PromptGenerationStatus) {
+    listPromptGenerations(first: $first, after: $after, status: $status) {
+      edges {
+        node {
+          id
+          status
+          prompt
+          createdAt
+        }
+      }
+      pageInfo { hasNextPage endCursor }
+      totalCount
+    }
+  }
+`;
+var GET_PROMPT_GENERATION = `
+  query GetPromptGeneration($id: ID!) {
+    getPromptGeneration(id: $id) {
+      id
+      status
+      prompt
+      createdAt
+    }
+  }
+`;
+var CANCEL_PROMPT_GENERATION = `
+  mutation CancelPromptGeneration($generationId: ID!) {
+    cancelPromptGeneration(generationId: $generationId) {
+      id
+      status
+    }
+  }
+`;
+var LIST_WORKFLOWS = `
+  query ListWorkflows($filter: FluidGridsWorkflowFilterInput) {
+    workflows(filter: $filter) {
+      id
+      name
+      key
+      description
+      status
+      executionCount
+      linkedDataSinkCount
+      lastExecutedAt
+      createdAt
+      updatedAt
+    }
+  }
+`;
+var GET_WORKFLOW = `
+  query GetWorkflow($id: ID!) {
+    workflow(id: $id) {
+      id
+      name
+      key
+      description
+      status
+      executionCount
+      linkedDataSinkCount
+      externalWorkflowId
+      lastExecutionId
+      lastExecutedAt
+      webhookUrl
+      createdAt
+      updatedAt
+    }
+  }
+`;
+
+// src/commands/base.ts
+import { readFileSync as readFileSync3 } from "fs";
+function loadJsonInput(file, inline) {
+  if (!file && !inline)
+    return;
+  if (file && inline) {
+    printError("Provide --file OR --json, not both");
+    process.exit(1);
+  }
+  try {
+    const raw = file ? readFileSync3(file, "utf8") : inline;
+    return JSON.parse(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    printError(`Failed to parse JSON input: ${msg}`);
+    process.exit(1);
+  }
+}
+function loadTextInput(file, inline) {
+  if (!file && !inline)
+    return;
+  if (file && inline) {
+    printError("Provide --file OR inline value, not both");
+    process.exit(1);
+  }
+  try {
+    return file ? readFileSync3(file, "utf8") : inline;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    printError(`Failed to read file: ${msg}`);
+    process.exit(1);
+  }
+}
+function requireAuth() {
+  const auth = readAuth();
+  if (!auth?.accessToken) {
+    printError("Authentication required. Run: bigconsole auth login");
+    process.exit(1);
+  }
+}
+async function execWorkspace(document, variables) {
+  requireAuth();
+  return workspaceRequest(document, variables);
+}
+function handleCommandError(error) {
+  printError(toSafeErrorMessage(error));
+  process.exit(1);
+}
+function inheritGlobalFormat(actionCommand) {
+  const declaresFormat = actionCommand.options.some((o) => o.attributeName() === "format");
+  if (!declaresFormat)
+    return;
+  const current = actionCommand.getOptionValue("format");
+  if (current !== undefined)
+    return;
+  const { format } = actionCommand.optsWithGlobals();
+  if (format !== undefined)
+    actionCommand.setOptionValue("format", format);
+}
+function formatAndOutput(options, data, tableConfig) {
+  const format = getFormat(options);
+  outputData(format, data, tableConfig);
+}
+
+// src/commands/auth.ts
+function registerAuthCommands(program) {
+  const auth = program.command("auth").description("Authentication commands");
+  auth.command("login").description("Authenticate with BigConsole").option("--client-credentials", "Authenticate as an app with client ID and secret").option("--workspace-id <id>", "Workspace ID (for app auth)").action(async (options) => {
+    try {
+      if (options.clientCredentials) {
+        await loginWithClientCredentials(options.workspaceId);
+      } else {
+        await loginWithDeviceCode();
+      }
+    } catch (error) {
+      handleCommandError(error);
+    }
+  });
+  auth.command("logout").description("Revoke tokens and clear stored auth").action(async () => {
+    try {
+      const authData = readAuth();
+      if (authData?.accessToken) {
+        try {
+          await globalRequest(SIGN_OUT);
+        } catch {
+          printWarning("Server-side logout failed, clearing local tokens");
+        }
+      }
+      clearAuth();
+      resetClients();
+      printSuccess("Logged out successfully");
+    } catch (error) {
+      handleCommandError(error);
+    }
+  });
+  auth.command("status").description("Show current auth state").option("-f, --format <format>", "Output format (json, table)").action((options) => {
+    const authData = readAuth();
+    const config = readConfig();
+    const authenticated = Boolean(authData?.accessToken);
+    const expired = authData?.accessToken ? isTokenExpired(authData) : false;
+    const expiresAt = authData?.expiresAt ? formatDate(new Date(authData.expiresAt).toISOString()) : "-";
+    const method = authData?.authMethod === "client_credentials" ? "Client Credentials" : "OAuth2 Device Code";
+    const wsTokenExpires = authData?.workspaceTokenExpiresAt ? formatDate(new Date(authData.workspaceTokenExpiresAt).toISOString()) : "-";
+    formatAndOutput(options, {
+      authenticated,
+      method,
+      expired,
+      expiresAt,
+      workspaceId: authData?.workspaceId ?? "-",
+      organizationId: authData?.organizationId ?? "-",
+      workspaceTokenExpiresAt: wsTokenExpires,
+      workspaceEndpoint: config.workspaceEndpoint,
+      globalEndpoint: config.globalEndpoint
+    }, {
+      headers: ["Key", "Value"],
+      rows: [
+        ["Authenticated", String(authenticated)],
+        ["Method", method],
+        ["Expired", String(expired)],
+        ["Expires At", expiresAt],
+        ["Workspace ID", authData?.workspaceId ?? "-"],
+        ["Organization ID", authData?.organizationId ?? "-"],
+        ["Workspace Token Expires", wsTokenExpires],
+        ["Workspace Endpoint", config.workspaceEndpoint],
+        ["Global Endpoint", config.globalEndpoint]
+      ]
+    });
+  });
+  auth.command("token").description("Print access token to stdout").option("--workspace", "Print workspace token instead").action((options) => {
+    const authData = readAuth();
+    if (options.workspace) {
+      if (!authData?.workspaceToken) {
+        printError("No workspace token. Log in and select a workspace: bigconsole auth login");
+        process.exit(1);
+      }
+      process.stdout.write(authData.workspaceToken);
+      return;
+    }
+    if (!authData?.accessToken) {
+      printError("Not authenticated. Run: bigconsole auth login");
+      process.exit(1);
+    }
+    process.stdout.write(authData.accessToken);
+  });
+  auth.command("refresh").description("Force token refresh").action(async () => {
+    try {
+      const authData = readAuth();
+      if (!authData?.refreshToken && authData?.authMethod !== "client_credentials") {
+        printError("No refresh token available. Run: bigconsole auth login");
+        process.exit(1);
+      }
+      if (authData?.authMethod === "client_credentials" && authData.clientId && authData.clientSecret) {
+        const config = readConfig();
+        const result = await clientCredentialsFlow(config.globalEndpoint, authData.clientId, authData.clientSecret);
+        writeAuth({
+          ...authData,
+          accessToken: result.accessToken,
+          expiresAt: Date.now() + result.expiresIn * 1000
+        });
+        resetClients();
+        printSuccess("App token refreshed successfully");
+        if (authData.workspaceId && authData.organizationId) {
+          await refreshWorkspaceTokenForAuth();
+        }
+        return;
+      }
+      const data = await globalRequest(REFRESH_TOKEN, {
+        token: authData.refreshToken
+      });
+      const r = data.refreshToken;
+      writeAuth({
+        ...authData,
+        accessToken: r.accessToken,
+        refreshToken: r.refreshToken,
+        expiresAt: Date.now() + r.expiresIn * 1000
+      });
+      resetClients();
+      printSuccess("Token refreshed successfully");
+      if (authData.workspaceId && authData.organizationId) {
+        await refreshWorkspaceTokenForAuth();
+      }
+    } catch (error) {
+      handleCommandError(error);
+    }
+  });
+}
+async function refreshWorkspaceTokenForAuth() {
+  const authData = readAuth();
+  if (!authData?.accessToken || !authData.workspaceId || !authData.organizationId)
+    return;
+  const config = readConfig();
+  try {
+    const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, authData.accessToken, authData.workspaceId, authData.organizationId);
+    writeAuth({
+      ...authData,
+      workspaceToken: wsResult.token,
+      workspaceTokenExpiresAt: new Date(wsResult.expiresAt).getTime()
+    });
+    resetClients();
+    printSuccess("Workspace token refreshed");
+  } catch {
+    printWarning("Workspace token refresh failed — workspace operations may require re-login");
+  }
+}
+async function loginWithDeviceCode() {
+  const config = readConfig();
+  const { oidcIssuer, clientId } = resolveOIDCConfig();
+  const oidcConfig = { ...config, oidcIssuer, clientId };
+  printInfo("Starting device code authentication...");
+  const dc = await startDeviceCodeFlow(oidcConfig);
+  console.log("");
+  console.log(`  Open: ${sanitizeForTerminal(dc.verificationUri)}`);
+  console.log(`  Code: ${sanitizeForTerminal(dc.userCode)}`);
+  console.log("");
+  const opened = await openBrowser(dc.verificationUriComplete ?? dc.verificationUri);
+  if (opened)
+    printInfo("Browser opened");
+  else
+    printWarning("Could not open browser — open the URL manually");
+  printInfo("Waiting for authorization...");
+  const result = await pollForToken(dc.deviceCode, dc.interval, oidcConfig);
+  const accessToken = result.accessToken;
+  const expiresAt = Date.now() + result.expiresIn * 1000;
+  printInfo("Fetching workspaces...");
+  try {
+    const workspaces = await fetchWorkspaces(config.globalEndpoint, accessToken);
+    if (workspaces.length === 0) {
+      writeAuth({
+        accessToken,
+        refreshToken: result.refreshToken,
+        expiresAt,
+        authMethod: "device_code"
+      });
+      resetClients();
+      printSuccess("Authentication successful (no workspaces found)");
+      return;
+    }
+    let selected = workspaces[0];
+    if (workspaces.length > 1) {
+      console.log(`
+Available workspaces:`);
+      workspaces.forEach((ws, i) => console.log(`  ${i + 1}. ${sanitizeForTerminal(ws.name)} (${sanitizeForTerminal(ws.slug)})`));
+      const readline = await import("readline");
+      for (let attempt = 0;attempt < 3; attempt++) {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise((resolve) => {
+          rl.question(`
+Select workspace [1-${workspaces.length}]: `, (a) => {
+            rl.close();
+            resolve(a.trim());
+          });
+        });
+        const idx = parseInt(answer, 10) - 1;
+        if (!Number.isNaN(idx) && idx >= 0 && idx < workspaces.length) {
+          selected = workspaces[idx];
+          break;
+        }
+        if (attempt < 2) {
+          printError(`Invalid selection. Enter a number between 1 and ${workspaces.length}.`);
+        } else {
+          printError("Too many invalid attempts — aborting login.");
+          process.exit(1);
+        }
+      }
+    }
+    printInfo(`Using workspace: ${selected.name} (${selected.id})`);
+    const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, accessToken, selected.id, selected.organizationId);
+    writeAuth({
+      accessToken,
+      refreshToken: result.refreshToken,
+      expiresAt,
+      workspaceToken: wsResult.token,
+      workspaceTokenExpiresAt: new Date(wsResult.expiresAt).getTime(),
+      workspaceId: selected.id,
+      organizationId: selected.organizationId,
+      authMethod: "device_code"
+    });
+    resetClients();
+    printSuccess("Authentication successful");
+  } catch (wsError) {
+    writeAuth({
+      accessToken,
+      refreshToken: result.refreshToken,
+      expiresAt,
+      authMethod: "device_code"
+    });
+    resetClients();
+    printSuccess("Authentication successful");
+    printWarning(`Workspace token not obtained: ${toSafeErrorMessage(wsError)}`);
+    printInfo("Run `bigconsole auth login` again once a workspace is available.");
+  }
+}
+async function loginWithClientCredentials(workspaceId) {
+  const config = readConfig();
+  const readline = await import("readline");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const clientId = await new Promise((resolve) => {
+    rl.question("Client ID: ", (a) => resolve(a.trim()));
+  });
+  const out = rl;
+  out._writeToOutput = function maskedWrite(stringToWrite) {
+    if (stringToWrite === `\r
+` || stringToWrite === `
+`) {
+      out.output.write(stringToWrite);
+      return;
+    }
+    out.output.write("*");
+  };
+  const clientSecret = await new Promise((resolve) => {
+    rl.question("Client Secret: ", (a) => {
+      rl.close();
+      resolve(a.trim());
+    });
+  });
+  process.stdout.write(`
+`);
+  if (!clientId || !clientSecret) {
+    printError("Client ID and secret cannot be empty");
+    process.exit(1);
+  }
+  printInfo("Authenticating app...");
+  const result = await clientCredentialsFlow(config.globalEndpoint, clientId, clientSecret);
+  const accessToken = result.accessToken;
+  const expiresAt = Date.now() + result.expiresIn * 1000;
+  let wsToken;
+  let wsTokenExpiresAt;
+  const wsId = workspaceId;
+  let orgId;
+  if (wsId) {
+    try {
+      const workspaces = await fetchWorkspaces(config.globalEndpoint, accessToken);
+      const ws = workspaces.find((w) => w.id === wsId);
+      if (!ws) {
+        printError(`Workspace ${wsId} not found or not accessible to this app.`);
+        process.exit(1);
+      }
+      orgId = ws.organizationId;
+      const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, accessToken, wsId, orgId);
+      wsToken = wsResult.token;
+      wsTokenExpiresAt = new Date(wsResult.expiresAt).getTime();
+      printInfo(`Workspace token issued for: ${ws.name}`);
+    } catch (err) {
+      printError(`Workspace token issuance failed: ${toSafeErrorMessage(err)}`);
+      process.exit(1);
+    }
+  }
+  writeAuth({
+    accessToken,
+    refreshToken: "",
+    expiresAt,
+    workspaceToken: wsToken,
+    workspaceTokenExpiresAt: wsTokenExpiresAt,
+    workspaceId: wsId,
+    organizationId: orgId,
+    authMethod: "client_credentials",
+    clientId,
+    clientSecret
+  });
+  resetClients();
+  printSuccess("App authentication successful");
+}
+// src/commands/cli-config.ts
+function registerCLIConfigCommands(program) {
+  const cli = program.command("cli-config").description("CLI configuration (endpoints, client ID)");
+  cli.command("show").description("Show current CLI configuration").option("-f, --format <format>", "Output format (json, table, yaml)").action((options) => {
+    const config = readConfig();
+    formatAndOutput(options, config, {
+      headers: ["Key", "Value"],
+      rows: Object.entries(config).map(([k, v]) => [k, v == null ? "-" : String(v)])
+    });
+  });
+  cli.command("path").description("Show CLI config file path").action(() => {
+    console.log(getConfigPath());
+  });
+  cli.command("get <key>").description("Get a single config value").action((key) => {
+    try {
+      if (!KNOWN_CONFIG_KEYS.includes(key)) {
+        printError(`Unknown config key: ${key}. Known keys: ${KNOWN_CONFIG_KEYS.join(", ")}`);
+        process.exit(1);
+      }
+      const config = readConfig();
+      const value = config[key];
+      if (value === undefined || value === null) {
+        console.log("-");
+      } else {
+        console.log(String(value));
+      }
+    } catch (error) {
+      handleCommandError(error);
+    }
+  });
+  cli.command("set <key> <value>").description("Set a config value").action((key, value) => {
+    try {
+      if (!KNOWN_CONFIG_KEYS.includes(key)) {
+        printError(`Unknown config key: ${key}. Known keys: ${KNOWN_CONFIG_KEYS.join(", ")}`);
+        process.exit(1);
+      }
+      const config = readConfig();
+      config[key] = value;
+      writeConfig(config);
+      printSuccess(`Set ${key} = ${value} (last updated ${formatDate(new Date().toISOString())})`);
+    } catch (error) {
+      handleCommandError(error);
+    }
+  });
+  cli.command("reset").description("Reset to default CLI configuration").action(() => {
+    try {
+      writeConfig({ ...DEFAULT_CONFIG });
+      printSuccess("CLI configuration reset to defaults");
+    } catch (error) {
+      handleCommandError(error);
+    }
+  });
+}
+// src/commands/workspace.ts
+function registerWorkspaceCommands(program) {
+  const ws = program.command("workspace").description("Workspace selection and info");
+  ws.command("list").description("List workspaces the current user can access").option("-f, --format <format>", "Output format (json, table, yaml)").action(async (o) => {
+    try {
+      requireAuth();
+      await ensureFreshTokens();
+      const auth = readAuth();
+      const config = readConfig();
+      const workspaces = await fetchWorkspaces(config.globalEndpoint, auth.accessToken);
+      formatAndOutput(o, workspaces, {
+        headers: ["ID", "Name", "Slug", "Org ID", "Tenant ID", "Current"],
+        rows: workspaces.map((w) => [
+          truncate(w.id, 14),
+          w.name,
+          w.slug,
+          truncate(w.organizationId, 14),
+          truncate(w.tenantId, 14),
+          auth.workspaceId === w.id ? "*" : ""
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  ws.command("current").description("Show the currently-selected workspace").option("-f, --format <format>", "Output format").action((o) => {
+    const auth = readAuth();
+    if (!auth?.workspaceId) {
+      printError("No workspace selected. Run `bigconsole workspace set <id>` or re-login.");
+      process.exit(1);
+    }
+    formatAndOutput(o, {
+      workspaceId: auth.workspaceId,
+      organizationId: auth.organizationId ?? "-",
+      workspaceTokenExpiresAt: auth.workspaceTokenExpiresAt ? new Date(auth.workspaceTokenExpiresAt).toISOString() : "-"
+    });
+  });
+  ws.command("set").description("Select a workspace and issue a workspace token").argument("<id>", "Workspace ID").action(async (id) => {
+    try {
+      requireAuth();
+      await ensureFreshTokens();
+      const auth = readAuth();
+      const config = readConfig();
+      const workspaces = await fetchWorkspaces(config.globalEndpoint, auth.accessToken);
+      const ws = workspaces.find((w) => w.id === id);
+      if (!ws) {
+        printError(`Workspace ${id} not found or not accessible. Run \`bigconsole workspace list\`.`);
+        process.exit(1);
+      }
+      const result = await issueWorkspaceToken(config.workspaceEndpoint, auth.accessToken, ws.id, ws.organizationId);
+      writeAuth({
+        ...auth,
+        workspaceId: ws.id,
+        organizationId: ws.organizationId,
+        workspaceToken: result.token,
+        workspaceTokenExpiresAt: new Date(result.expiresAt).getTime()
+      });
+      resetClients();
+      printSuccess(`Switched to workspace: ${ws.name} (${ws.id})`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/dashboard.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+function registerDashboardCommands(program) {
+  const dash = program.command("dashboard").description("Dashboard operations");
+  dash.command("list").description("List dashboards in the current workspace").option("--search <term>", "Search by name").option("--category <c>", "Filter by category").option("--visibility <v>", "PRIVATE | WORKSPACE | PUBLIC").option("--include-archived", "Include archived dashboards").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>", "Cursor for next page").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_DASHBOARDS, {
+        first: o.first ?? 25,
+        after: o.after,
+        search: o.search,
+        category: o.category ? o.category.toUpperCase() : undefined,
+        visibility: o.visibility ? o.visibility.toUpperCase() : undefined,
+        includeArchived: o.includeArchived ?? false
+      });
+      const items = d.listDashboards.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Name", "Status", "Visibility", "Category", "Updated"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.name, 30),
+          formatStatus(x.status),
+          x.visibility,
+          x.category,
+          formatDate(x.updatedAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("get").description("Get a dashboard by ID").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_DASHBOARD, {
+        id
+      });
+      if (!d.getDashboard) {
+        printError("Dashboard not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.getDashboard);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("archive").description("Archive a dashboard (soft-delete, can be restored)").argument("<id>").action(async (id) => {
+    try {
+      const d = await execWorkspace(ARCHIVE_DASHBOARD, {
+        id
+      });
+      printSuccess(`Archived: ${d.archiveDashboard.name} (${d.archiveDashboard.id})`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("delete").description("Permanently delete a dashboard").argument("<id>").action(async (id) => {
+    try {
+      await execWorkspace(DELETE_DASHBOARD, { id });
+      printSuccess(`Deleted dashboard ${id}`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("create").description("Create a dashboard").requiredOption("--name <name>", "Dashboard name").requiredOption("--category <cat>", "Category (CUSTOM | EXECUTIVE | FINANCIAL | HR | MARKETING | OPERATIONS | SALES)").option("--description <d>", "Description").option("--visibility <v>", "PRIVATE | WORKSPACE | PUBLIC", "PRIVATE").option("--layout <l>", "GRID | FLEX | TABS", "GRID").option("--no-default-page", "Skip creating the default page").option("--metadata-file <path>", "JSON file with custom metadata").option("--metadata-json <json>", "Inline JSON for custom metadata").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const metadata = loadJsonInput(o.metadataFile, o.metadataJson);
+      const input = {
+        name: o.name,
+        category: o.category.toUpperCase(),
+        description: o.description,
+        visibility: (o.visibility ?? "PRIVATE").toUpperCase(),
+        layout: (o.layout ?? "GRID").toUpperCase(),
+        createDefaultPage: o.defaultPage !== false,
+        metadata
+      };
+      const d = await execWorkspace(CREATE_DASHBOARD, { input });
+      printSuccess(`Created dashboard: ${d.createBigConsoleDashboard.name} (${d.createBigConsoleDashboard.id})`);
+      formatAndOutput(o, d.createBigConsoleDashboard);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("update").description("Update a dashboard").argument("<id>").option("--name <name>").option("--description <d>").option("--category <cat>").option("--visibility <v>", "PRIVATE | WORKSPACE | PUBLIC").option("--layout <l>", "GRID | FLEX | TABS").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const input = { id };
+      if (o.name)
+        input.name = o.name;
+      if (o.description !== undefined)
+        input.description = o.description;
+      if (o.category)
+        input.category = o.category.toUpperCase();
+      if (o.visibility)
+        input.visibility = o.visibility.toUpperCase();
+      if (o.layout)
+        input.layout = o.layout.toUpperCase();
+      const d = await execWorkspace(UPDATE_DASHBOARD, { input });
+      printSuccess(`Updated dashboard ${id}`);
+      formatAndOutput(o, d.updateBigConsoleDashboard);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("import").description("Import a dashboard from a JSON file (dashboard definition)").requiredOption("--file <path>", "Dashboard JSON file produced by `dashboard export`").option("--name <name>", "Override dashboard name").option("--visibility <v>", "Override visibility: PRIVATE | WORKSPACE | PUBLIC").option("--conflict <strategy>", "Conflict resolution: RENAME | REPLACE | FAIL", "RENAME").action(async (o) => {
+    try {
+      const json = readFileSync4(o.file, "utf8");
+      const input = {
+        json,
+        conflictResolution: (o.conflict ?? "RENAME").toUpperCase()
+      };
+      if (o.name)
+        input.name = o.name;
+      if (o.visibility)
+        input.visibility = o.visibility.toUpperCase();
+      const d = await execWorkspace(IMPORT_DASHBOARD, {
+        input
+      });
+      printSuccess(`Imported dashboard: ${d.importDashboard.name} (${d.importDashboard.id})`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dash.command("export").description("Export a dashboard definition as JSON (stdout or --out file)").argument("<id>").option("--out <path>", "Write JSON to file instead of stdout").option("--include-data-refs", "Include data source references", true).option("--include-webhook-mappings", "Include webhook mappings").option("--pretty", "Pretty-print JSON", true).action(async (id, o) => {
+    try {
+      const options = {
+        includeDataSourceRefs: o.includeDataRefs !== false,
+        includeWebhookMappings: o.includeWebhookMappings ?? false,
+        prettyPrint: o.pretty !== false
+      };
+      const d = await execWorkspace(EXPORT_DASHBOARD, {
+        id,
+        options
+      });
+      if (o.out) {
+        writeFileSync3(o.out, d.exportDashboard, "utf8");
+        printSuccess(`Exported to ${o.out}`);
+      } else {
+        const body = process.stdout.isTTY ? sanitizeForTerminal(d.exportDashboard, { preserveNewlines: true }) : d.exportDashboard;
+        process.stdout.write(body);
+        if (!body.endsWith(`
+`))
+          process.stdout.write(`
+`);
+      }
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/widget.ts
+function registerWidgetCommands(program) {
+  const w = program.command("widget").description("Widget operations");
+  w.command("list").description("List widgets on a dashboard page").requiredOption("--page <pageId>", "Dashboard page ID").option("--type <t>", "Filter by widget type (METRIC_CARD, CHART, TABLE, ...)").option("--first <n>", "Page size", (v) => parseInt(v, 10), 50).option("--after <cursor>", "Cursor for next page").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_WIDGETS, {
+        pageId: o.page,
+        first: o.first ?? 50,
+        after: o.after,
+        type: o.type ? o.type.toUpperCase() : undefined
+      });
+      const items = d.listWidgets.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Title", "Type", "DataSink", "Last Refreshed", "Updated"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.title ?? "-", 24),
+          x.type,
+          x.dataSinkId ? truncate(x.dataSinkId, 14) : "-",
+          formatDate(x.lastRefreshedAt),
+          formatDate(x.updatedAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  w.command("get").description("Get a widget by ID (includes full config JSON)").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_WIDGET, { id });
+      if (!d.getWidget) {
+        printError("Widget not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.getWidget);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  w.command("delete").description("Delete a widget").argument("<id>").action(async (id) => {
+    try {
+      await execWorkspace(DELETE_WIDGET, { id });
+      printSuccess(`Deleted widget ${id}`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  w.command("create").description("Create a widget (config is JSON — use --config-file for complex layouts)").requiredOption("--page <id>", "Parent page ID").requiredOption("--type <t>", "Widget type (METRIC_CARD, CHART, TABLE, ...)").option("--title <t>", "Widget title").option("--config-file <path>", "JSON file with widget config").option("--config-json <json>", "Inline JSON config").option("--position-file <path>", "JSON file with position {x,y,width,height}").option("--position-json <json>", "Inline JSON position").option("--datasink <id>", "Bound DataSink ID").option("--parser <id>", "Bound Parser ID").option("--dataset <id>", "Dataset ID within DataSink").option("--cache-ttl <seconds>", "Cache TTL override", (v) => parseInt(v, 10)).option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const config = loadJsonInput(o.configFile, o.configJson);
+      const position = loadJsonInput(o.positionFile, o.positionJson);
+      if (!config) {
+        printError("Widget config is required — provide --config-file or --config-json");
+        process.exit(1);
+      }
+      if (!position) {
+        printError("Position is required — provide --position-file or --position-json");
+        process.exit(1);
+      }
+      const input = {
+        pageId: o.page,
+        type: o.type.toUpperCase(),
+        title: o.title ?? "",
+        config,
+        position
+      };
+      if (o.datasink)
+        input.dataSinkId = o.datasink;
+      if (o.parser)
+        input.parserId = o.parser;
+      if (o.dataset)
+        input.datasetId = o.dataset;
+      if (o.cacheTtl !== undefined)
+        input.cacheTTL = o.cacheTtl;
+      const d = await execWorkspace(CREATE_WIDGET, {
+        input
+      });
+      printSuccess(`Created widget ${d.createBigConsoleWidget.id}`);
+      formatAndOutput(o, d.createBigConsoleWidget);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  w.command("update").description("Update a widget").argument("<id>").option("--config-file <path>", "Replace widget config from JSON file").option("--config-json <json>", "Replace widget config inline").option("--position-file <path>").option("--position-json <json>").option("--datasink <id>").option("--parser <id>").option("--dataset <id>").option("--cache-ttl <seconds>", "", (v) => parseInt(v, 10)).option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const config = loadJsonInput(o.configFile, o.configJson);
+      const position = loadJsonInput(o.positionFile, o.positionJson);
+      const input = { id };
+      if (config !== undefined)
+        input.config = config;
+      if (position !== undefined)
+        input.position = position;
+      if (o.datasink)
+        input.dataSinkId = o.datasink;
+      if (o.parser)
+        input.parserId = o.parser;
+      if (o.dataset)
+        input.datasetId = o.dataset;
+      if (o.cacheTtl !== undefined)
+        input.cacheTTL = o.cacheTtl;
+      const d = await execWorkspace(UPDATE_WIDGET, {
+        input
+      });
+      printSuccess(`Updated widget ${id}`);
+      formatAndOutput(o, d.updateBigConsoleWidget);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/utils/parse.ts
+import { InvalidArgumentError } from "commander";
+function parseVersion(raw) {
+  if (!/^\d+$/.test(raw)) {
+    throw new InvalidArgumentError("must be a whole number, for example 3");
+  }
+  return Number(raw);
+}
+
+// src/commands/datasink.ts
+function registerDataSinkCommands(program) {
+  const ds = program.command("datasink").description("DataSink operations");
+  ds.command("list").description("List DataSinks in the current workspace").option("--search <term>", "Search by name").option("--status <s>", "Filter by status").option("--setup-state <s>", "Filter by setup state").option("--active <bool>", "Filter by isActive (true/false)").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>", "Cursor for next page").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_DATASINKS, {
+        first: o.first ?? 25,
+        after: o.after,
+        search: o.search,
+        status: o.status ? o.status.toUpperCase() : undefined,
+        setupState: o.setupState ? o.setupState.toUpperCase() : undefined,
+        isActive: o.active === undefined ? undefined : o.active.toLowerCase() === "true" || o.active === "1"
+      });
+      const items = d.listDataSinks.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Name", "Key", "Status", "Setup", "Active", "Updated"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.name ?? "-", 24),
+          truncate(x.key, 20),
+          formatStatus(x.status),
+          x.setupState,
+          x.isActive ? "yes" : "no",
+          formatDate(x.updatedAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  ds.command("get").description("Get a DataSink by ID or key").option("--id <id>", "DataSink ID").option("--key <key>", "DataSink key").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      if (!o.id && !o.key) {
+        printError("Provide --id or --key");
+        process.exit(1);
+      }
+      const d = await execWorkspace(GET_DATASINK, {
+        id: o.id,
+        key: o.key
+      });
+      if (!d.getDataSink) {
+        printError("DataSink not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.getDataSink);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  ds.command("data").description("Fetch the current data payload of a DataSink").option("--id <id>", "DataSink ID").option("--key <key>", "DataSink key").option("--path <p>", "JSONPath-like filter (e.g. items[0].value)").option("--force-refresh", "Bypass cache").option("-f, --format <format>", "Output format (json recommended)").action(async (o) => {
+    try {
+      if (!o.id && !o.key) {
+        printError("Provide --id or --key");
+        process.exit(1);
+      }
+      const d = await execWorkspace(GET_DATASINK_DATA, {
+        id: o.id,
+        key: o.key,
+        dataPath: o.path,
+        forceRefresh: o.forceRefresh ?? false
+      });
+      formatAndOutput({ format: o.format ?? "json" }, d.getDataSinkData);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  ds.command("delete").description("Delete a DataSink").argument("<id>").action(async (id) => {
+    try {
+      await execWorkspace(DELETE_DATASINK, { id });
+      printSuccess(`Deleted DataSink ${id}`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  ds.command("create").description("Create a DataSink").requiredOption("--key <key>", "Unique key within workspace (e.g. sales_metrics_q4)").option("--name <name>", "Display name").option("--description <d>", "Description").option("--data-file <path>", "JSON file with initial payload").option("--data-json <json>", "Inline JSON for initial payload").option("--config-file <path>", "JSON file with DataSink config").option("--config-json <json>", "Inline JSON for DataSink config").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const data = loadJsonInput(o.dataFile, o.dataJson);
+      const config = loadJsonInput(o.configFile, o.configJson);
+      const input = { key: o.key };
+      if (o.name)
+        input.name = o.name;
+      if (o.description)
+        input.description = o.description;
+      if (data !== undefined)
+        input.data = data;
+      if (config !== undefined)
+        input.config = config;
+      const d = await execWorkspace(CREATE_DATASINK, {
+        input
+      });
+      printSuccess(`Created DataSink: ${d.createDataSink.key} (${d.createDataSink.id})`);
+      formatAndOutput(o, d.createDataSink);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  ds.command("update").description("Update a DataSink").argument("<id>").option("--name <name>").option("--description <d>").option("--active <bool>", "true / false").option("--version <n>", "Current DataSink version (optimistic lock); fetched automatically when omitted", parseVersion).option("--data-file <path>", "JSON file to replace data payload").option("--data-json <json>", "Inline JSON to replace data payload").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const data = loadJsonInput(o.dataFile, o.dataJson);
+      let version = o.version;
+      if (version === undefined) {
+        const current = await execWorkspace(GET_DATASINK, { id });
+        if (!current.getDataSink || typeof current.getDataSink.version !== "number") {
+          printError(`DataSink not found or has no version: ${id}`);
+          process.exit(1);
+        }
+        version = current.getDataSink.version;
+      }
+      const input = { id, version };
+      if (o.name)
+        input.name = o.name;
+      if (o.description !== undefined)
+        input.description = o.description;
+      if (o.active !== undefined) {
+        input.isActive = o.active.toLowerCase() === "true" || o.active === "1";
+      }
+      if (data !== undefined)
+        input.data = data;
+      const d = await execWorkspace(UPDATE_DATASINK, {
+        input
+      });
+      printSuccess(`Updated DataSink ${id}`);
+      formatAndOutput(o, d.updateDataSink);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/parser.ts
+function registerParserCommands(program) {
+  const p = program.command("parser").description("Parser operations");
+  p.command("list").description("List parsers in the current workspace (scoped to a console)").requiredOption("--console <id>", "Console (dashboard) ID parsers belong to").option("--status <s>", "Filter by status (active, inactive)").option("--type <t>", "Filter by parser type (jq, jsonata, spark)").option("--input <sinkKey>", "Filter by input sink key").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>", "Cursor for next page").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const VALID_STATUSES = new Set(["active", "inactive"]);
+      const VALID_TYPES = new Set(["jq", "jsonata", "spark"]);
+      const filter = { consoleId: o.console };
+      if (o.status) {
+        const s = o.status.toLowerCase();
+        if (!VALID_STATUSES.has(s)) {
+          printError(`Invalid --status "${o.status}". Valid: ${[...VALID_STATUSES].join(", ")}`);
+          process.exit(1);
+        }
+        filter.status = s;
+      }
+      if (o.type) {
+        const t = o.type.toLowerCase();
+        if (!VALID_TYPES.has(t)) {
+          printError(`Invalid --type "${o.type}". Valid: ${[...VALID_TYPES].join(", ")}`);
+          process.exit(1);
+        }
+        filter.type = t;
+      }
+      if (o.input)
+        filter.inputSinkKey = o.input;
+      const d = await execWorkspace(LIST_PARSERS, { first: o.first ?? 25, after: o.after, filter });
+      const items = d.listParsers.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Name", "Type", "Status", "Input", "Output", "Updated"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.name, 24),
+          x.type,
+          formatStatus(x.status),
+          truncate(x.inputSinkKey, 18),
+          truncate(x.outputKey, 18),
+          formatDate(x.updatedAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("get").description("Get a parser by ID (includes the expression body)").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_PARSER, { id });
+      if (!d.parser) {
+        printError("Parser not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.parser);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("delete").description("Delete a parser").argument("<id>").action(async (id) => {
+    try {
+      await execWorkspace(DELETE_PARSER, { id });
+      printSuccess(`Deleted parser ${id}`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("create").description("Create a parser").requiredOption("--name <name>").requiredOption("--console <id>", "Parent dashboard/console ID").requiredOption("--input-key <key>", "DataSink key this parser reads from").requiredOption("--output-key <key>", "Key for parser output (used by widgets)").requiredOption("--type <t>", "Parser type (jq | jsonata | spark)").option("--expression <expr>", "Parser expression (inline)").option("--expression-file <path>", "Parser expression from file").option("--description <d>").option("--output-widget <id>", "Target widget ID (v2.1)").option("--ttl <seconds>", "Cache TTL", (v) => parseInt(v, 10)).option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const expression = loadTextInput(o.expressionFile, o.expression);
+      if (!expression) {
+        printError("Provide --expression or --expression-file");
+        process.exit(1);
+      }
+      const input = {
+        name: o.name,
+        consoleId: o.console,
+        inputSinkKey: o.inputKey,
+        outputKey: o.outputKey,
+        type: o.type.toLowerCase(),
+        expression
+      };
+      if (o.description)
+        input.description = o.description;
+      if (o.outputWidget)
+        input.outputWidgetId = o.outputWidget;
+      if (o.ttl !== undefined)
+        input.ttl = o.ttl;
+      const d = await execWorkspace(CREATE_PARSER, {
+        input
+      });
+      printSuccess(`Created parser: ${d.createParser.name} (${d.createParser.id})`);
+      formatAndOutput(o, d.createParser);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("update").description("Update a parser (requires current version for optimistic concurrency)").argument("<id>").requiredOption("--version <n>", "Current parser version", parseVersion).option("--name <n>").option("--description <d>").option("--input-key <k>").option("--output-key <k>").option("--output-widget <id>").option("--status <s>", "Parser status (active | inactive)").option("--expression <expr>").option("--expression-file <path>").option("--ttl <seconds>", "", (v) => parseInt(v, 10)).option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const expression = loadTextInput(o.expressionFile, o.expression);
+      const input = {};
+      if (o.name)
+        input.name = o.name;
+      if (o.description !== undefined)
+        input.description = o.description;
+      if (o.inputKey)
+        input.inputSinkKey = o.inputKey;
+      if (o.outputKey)
+        input.outputKey = o.outputKey;
+      if (o.outputWidget)
+        input.outputWidgetId = o.outputWidget;
+      if (o.status)
+        input.status = o.status.toLowerCase();
+      if (expression)
+        input.expression = expression;
+      if (o.ttl !== undefined)
+        input.ttl = o.ttl;
+      const d = await execWorkspace(UPDATE_PARSER, {
+        id,
+        version: o.version,
+        input
+      });
+      printSuccess(`Updated parser ${id} (now v${d.updateParser.version})`);
+      formatAndOutput(o, d.updateParser);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/pipeline.ts
+function registerPipelineCommands(program) {
+  const p = program.command("pipeline").description("Pipeline operations");
+  p.command("list").description("List pipelines in the current workspace (scoped to a console)").requiredOption("--console <id>", "Console (dashboard) ID pipelines belong to").option("--status <s>", "Filter by status (active, draft, error, inactive)").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>", "Cursor for next page").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const VALID_STATUSES = new Set(["active", "draft", "error", "inactive"]);
+      const filter = { consoleId: o.console };
+      if (o.status) {
+        const s = o.status.toLowerCase();
+        if (!VALID_STATUSES.has(s)) {
+          printError(`Invalid --status "${o.status}". Valid: ${[...VALID_STATUSES].join(", ")}`);
+          process.exit(1);
+        }
+        filter.status = s;
+      }
+      const d = await execWorkspace(LIST_PIPELINES, { first: o.first ?? 25, after: o.after, filter });
+      const items = d.listPipelines.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Name", "Status", "Version", "Last Executed", "Updated"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.name, 28),
+          formatStatus(x.status),
+          String(x.version),
+          formatDate(x.lastExecutedAt),
+          formatDate(x.updatedAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("get").description("Get a pipeline by ID (includes stages)").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_PIPELINE, { id });
+      if (!d.pipeline) {
+        printError("Pipeline not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.pipeline);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("delete").description("Delete a pipeline").argument("<id>").action(async (id) => {
+    try {
+      await execWorkspace(DELETE_PIPELINE, { id });
+      printSuccess(`Deleted pipeline ${id}`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("create").description("Create a pipeline").requiredOption("--name <name>").requiredOption("--console <id>", "Parent dashboard/console ID").option("--description <d>").option("--status <s>", "Initial status (draft | active | inactive | error)").option("--stages-file <path>", "JSON file with array of CreatePipelineStageInput").option("--stages-json <json>", "Inline JSON array for stages").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const stages = loadJsonInput(o.stagesFile, o.stagesJson);
+      const input = {
+        name: o.name,
+        consoleId: o.console
+      };
+      if (o.description)
+        input.description = o.description;
+      if (o.status)
+        input.status = o.status.toLowerCase();
+      if (stages)
+        input.stages = stages;
+      const d = await execWorkspace(CREATE_PIPELINE, {
+        input
+      });
+      printSuccess(`Created pipeline: ${d.createPipeline.name} (${d.createPipeline.id})`);
+      formatAndOutput(o, d.createPipeline);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("update").description("Update a pipeline (requires current version)").argument("<id>").requiredOption("--version <n>", "Current pipeline version", parseVersion).option("--name <n>").option("--description <d>").option("--status <s>", "Pipeline status (draft | active | inactive | error)").option("--stages-file <path>", "JSON file with stages array to replace existing stages").option("--stages-json <json>", "Inline JSON stages array").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const stages = loadJsonInput(o.stagesFile, o.stagesJson);
+      const input = {};
+      if (o.name)
+        input.name = o.name;
+      if (o.description !== undefined)
+        input.description = o.description;
+      if (o.status)
+        input.status = o.status.toLowerCase();
+      if (stages)
+        input.stages = stages;
+      const d = await execWorkspace(UPDATE_PIPELINE, {
+        id,
+        version: o.version,
+        input
+      });
+      printSuccess(`Updated pipeline ${id} (now v${d.updatePipeline.version})`);
+      formatAndOutput(o, d.updatePipeline);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/workflow.ts
+function registerWorkflowCommands(program) {
+  const wf = program.command("workflow").description("Workflow operations");
+  wf.command("list").description("List workflows linked to BigConsole").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_WORKFLOWS, {});
+      const items = d.workflows;
+      formatAndOutput(o, items, {
+        headers: ["ID", "Name", "Key", "Status", "Execs", "Sinks", "Last Run"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.name, 24),
+          truncate(x.key, 18),
+          formatStatus(x.status),
+          String(x.executionCount),
+          String(x.linkedDataSinkCount),
+          formatDate(x.lastExecutedAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  wf.command("get").description("Get a workflow by ID").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_WORKFLOW, { id });
+      if (!d.workflow) {
+        printError("Workflow not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.workflow);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/drilldown.ts
+function registerDrilldownCommands(program) {
+  const dd = program.command("drilldown").description("Widget drilldown actions");
+  dd.command("list").description("List widget actions (includes drilldowns)").requiredOption("--widget <id>", "Widget ID").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(GET_WIDGET_ACTIONS, { widgetId: o.widget });
+      formatAndOutput(o, d.getWidgetActions, {
+        headers: ["ID", "Widget", "Type", "Label", "Created"],
+        rows: d.getWidgetActions.map((a) => [
+          truncate(a.id, 14),
+          truncate(a.widgetId, 14),
+          a.type,
+          truncate(a.label ?? "-", 24),
+          formatDate(a.createdAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  dd.command("delete").description("Delete the drilldown configuration from a widget").requiredOption("--widget <id>", "Widget ID").action(async (o) => {
+    try {
+      const lookup = await execWorkspace(GET_WIDGET_DRILLDOWN, {
+        id: o.widget
+      });
+      const drilldownId = lookup.getWidget?.drilldown?.id;
+      if (!drilldownId) {
+        throw new Error(`Widget ${o.widget} has no drilldown configuration`);
+      }
+      await execWorkspace(DELETE_WIDGET_DRILLDOWN, { id: drilldownId });
+      printSuccess(`Removed drilldown from widget ${o.widget}`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/share.ts
+function registerShareCommands(program) {
+  const sh = program.command("share").description("Dashboard share management");
+  sh.command("list").description("List shares for a dashboard").requiredOption("--dashboard <id>", "Dashboard ID").option("--active <bool>", "Filter by active status").option("--permission <p>", "Filter by permission (VIEW, EDIT, ...)").option("--recipient-type <t>", "USER | GROUP").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_DASHBOARD_SHARES, {
+        dashboardId: o.dashboard,
+        first: o.first ?? 25,
+        after: o.after,
+        isActive: o.active === undefined ? undefined : o.active.toLowerCase() === "true" || o.active === "1",
+        permission: o.permission ? o.permission.toUpperCase() : undefined,
+        recipientType: o.recipientType ? o.recipientType.toUpperCase() : undefined
+      });
+      const items = d.listDashboardShares.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Dashboard", "Permission", "Active", "Expires", "Created"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.dashboardId, 14),
+          x.permission,
+          x.isActive ? "yes" : "no",
+          formatDate(x.expiresAt),
+          formatDate(x.createdAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/template.ts
+function registerTemplateCommands(program) {
+  const t = program.command("template").description("Dashboard templates");
+  t.command("list").description("List dashboard templates").option("--search <term>").option("--category <c>").option("--featured", "Only featured templates").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_TEMPLATES, {
+        first: o.first ?? 25,
+        after: o.after,
+        category: o.category ? o.category.toUpperCase() : undefined,
+        search: o.search,
+        isFeatured: o.featured ?? undefined
+      });
+      const items = d.listTemplates.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Name", "Category", "Featured", "Status", "Created"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          truncate(x.name, 30),
+          x.category,
+          x.isFeatured ? "*" : "",
+          x.status,
+          formatDate(x.createdAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  t.command("get").description("Get a template by ID").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_TEMPLATE, {
+        id
+      });
+      if (!d.getTemplate) {
+        printError("Template not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.getTemplate);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/commands/prompt.ts
+function registerPromptCommands(program) {
+  const p = program.command("prompt").description("AI-driven dashboard generation");
+  p.command("generate").description("Start a new dashboard generation from a natural-language prompt").requiredOption("--prompt <text>", "The natural-language prompt").option("--config-file <path>", "Optional JSON with generation config").option("--config-json <json>", "Optional inline JSON with generation config").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const extra = loadJsonInput(o.configFile, o.configJson) ?? {};
+      const input = { prompt: o.prompt, ...extra };
+      const d = await execWorkspace(GENERATE_DASHBOARD_FROM_PROMPT, { input });
+      printSuccess(`Generation queued: ${d.generateDashboardFromPrompt.id}`);
+      formatAndOutput(o, d.generateDashboardFromPrompt);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("list").description("List prompt generations").option("--status <s>", "Filter by status").option("--first <n>", "Page size", (v) => parseInt(v, 10), 25).option("--after <cursor>").option("-f, --format <format>", "Output format").action(async (o) => {
+    try {
+      const d = await execWorkspace(LIST_PROMPT_GENERATIONS, {
+        first: o.first ?? 25,
+        after: o.after,
+        status: o.status ? o.status.toUpperCase() : undefined
+      });
+      const items = d.listPromptGenerations.edges.map((e) => e.node);
+      formatAndOutput(o, items, {
+        headers: ["ID", "Status", "Prompt", "Created"],
+        rows: items.map((x) => [
+          truncate(x.id, 14),
+          formatStatus(x.status),
+          truncate(x.prompt, 50),
+          formatDate(x.createdAt)
+        ])
+      });
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("get").description("Get a prompt generation by ID").argument("<id>").option("-f, --format <format>", "Output format").action(async (id, o) => {
+    try {
+      const d = await execWorkspace(GET_PROMPT_GENERATION, { id });
+      if (!d.getPromptGeneration) {
+        printError("Prompt generation not found");
+        process.exit(1);
+      }
+      formatAndOutput(o, d.getPromptGeneration);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+  p.command("cancel").description("Cancel an in-flight prompt generation").argument("<id>").action(async (id) => {
+    try {
+      const d = await execWorkspace(CANCEL_PROMPT_GENERATION, { generationId: id });
+      printSuccess(`Cancelled generation ${id} (status: ${d.cancelPromptGeneration.status})`);
+    } catch (e) {
+      handleCommandError(e);
+    }
+  });
+}
+// src/cli.ts
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = dirname(__filename2);
+var pkg = {
+  name: "@burdenoff/bigconsole-cli",
+  version: "0.0.0-dev"
+};
+try {
+  const packagePath = join3(__dirname2, "../package.json");
+  pkg = JSON.parse(readFileSync5(packagePath, "utf8"));
+} catch {}
+try {
+  const notifier = updateNotifier({
+    pkg,
+    updateCheckInterval: 1000 * 60 * 60 * 24
+  });
+  const argv = process.argv.slice(2);
+  const fmtIndex = argv.findIndex((a) => a === "-f" || a === "--format");
+  const fmt = fmtIndex !== -1 ? argv[fmtIndex + 1]?.toLowerCase() : undefined;
+  const isMachineOutput = fmt === "json" || fmt === "yaml" || fmt === "yml";
+  const isTty = Boolean(process.stdout.isTTY);
+  if (notifier.update && !isMachineOutput && isTty) {
+    const message = `Update available: ${chalk.dim(notifier.update.current)} → ${chalk.green(notifier.update.latest)}
+Run ${chalk.cyan(`bun add -g ${pkg.name}`)} to update`;
+    process.stderr.write(boxen(message, {
+      padding: 1,
+      margin: 1,
+      align: "center",
+      borderColor: "yellow",
+      borderStyle: "round"
+    }) + `
+`);
+  }
+} catch {}
+var firstArg = process.argv[2];
+if (firstArg === "-v" || firstArg === "--version") {
+  process.stdout.write(`${pkg.version}
+`);
+  process.exit(0);
+}
+var program = new Command;
+program.name("bigconsole").description("BigConsole CLI — dashboards, widgets, parsers, and workflows from the terminal").option("-f, --format <format>", "Output format (json, table, yaml)").option("--verbose", "Enable verbose logging").option("--no-color", "Disable colored output");
+program.hook("preAction", (_program, actionCommand) => inheritGlobalFormat(actionCommand));
 registerAuthCommands(program);
 registerCLIConfigCommands(program);
 registerWorkspaceCommands(program);
@@ -73,54 +2929,57 @@ registerDrilldownCommands(program);
 registerShareCommands(program);
 registerTemplateCommands(program);
 registerPromptCommands(program);
-program.addHelpText('after', `
-${chalk.bold('Examples:')}
-  ${chalk.dim('# Authentication')}
-  $ bigconsole auth login                                      ${chalk.dim('# OAuth2 Device Code login')}
-  $ bigconsole auth status                                     ${chalk.dim('# Show auth state')}
-
-  ${chalk.dim('# Workspace selection')}
-  $ bigconsole workspace list                                  ${chalk.dim('# List accessible workspaces')}
-  $ bigconsole workspace set <id>                              ${chalk.dim('# Switch active workspace')}
-
-  ${chalk.dim('# Core domain')}
-  $ bigconsole dashboard list --search sales                   ${chalk.dim('# List dashboards')}
-  $ bigconsole dashboard get <id>                              ${chalk.dim('# Inspect a dashboard')}
-  $ bigconsole widget list --page <pageId>                     ${chalk.dim('# Widgets on a page')}
-  $ bigconsole datasink list                                   ${chalk.dim('# List data sinks')}
-  $ bigconsole datasink data --key orders --force-refresh      ${chalk.dim('# Fetch live payload')}
-  $ bigconsole parser list                                     ${chalk.dim('# List parsers')}
-  $ bigconsole pipeline list                                   ${chalk.dim('# List pipelines')}
-  $ bigconsole workflow list                                   ${chalk.dim('# List workflows')}
-
-  ${chalk.dim('# CLI config')}
+program.addHelpText("after", `
+${chalk.bold("Examples:")}
+  ${chalk.dim("# Authentication")}
+  $ bigconsole auth login                                      ${chalk.dim("# OAuth2 Device Code login")}
+  $ bigconsole auth status                                     ${chalk.dim("# Show auth state")}
+
+  ${chalk.dim("# Workspace selection")}
+  $ bigconsole workspace list                                  ${chalk.dim("# List accessible workspaces")}
+  $ bigconsole workspace set <id>                              ${chalk.dim("# Switch active workspace")}
+
+  ${chalk.dim("# Core domain")}
+  $ bigconsole dashboard list --search sales                   ${chalk.dim("# List dashboards")}
+  $ bigconsole dashboard get <id>                              ${chalk.dim("# Inspect a dashboard")}
+  $ bigconsole widget list --page <pageId>                     ${chalk.dim("# Widgets on a page")}
+  $ bigconsole datasink list                                   ${chalk.dim("# List data sinks")}
+  $ bigconsole datasink data --key orders --force-refresh      ${chalk.dim("# Fetch live payload")}
+  $ bigconsole parser list --console <dashboardId>             ${chalk.dim("# List parsers")}
+  $ bigconsole pipeline list --console <dashboardId>           ${chalk.dim("# List pipelines")}
+  $ bigconsole workflow list                                   ${chalk.dim("# List workflows")}
+
+  ${chalk.dim("# CLI config")}
   $ bigconsole cli-config show
   $ bigconsole cli-config set workspaceEndpoint https://graphqlworkspaces.burdenoff.com/workspaces/graphql
 
-${chalk.bold('Command groups:')}
-  ${chalk.cyan('auth')}        login, logout, status, token, refresh
-  ${chalk.cyan('workspace')}   list, current, set
-  ${chalk.cyan('dashboard')}   list, get, create, update, archive, delete, import, export
-  ${chalk.cyan('widget')}      list, get, create, update, delete
-  ${chalk.cyan('datasink')}    list, get, data, create, update, delete
-  ${chalk.cyan('parser')}      list, get, create, update, delete
-  ${chalk.cyan('pipeline')}    list, get, create, update, delete
-  ${chalk.cyan('workflow')}    list, get
-  ${chalk.cyan('drilldown')}   list, delete
-  ${chalk.cyan('share')}       list
-  ${chalk.cyan('template')}    list, get
-  ${chalk.cyan('prompt')}      generate, list, get, cancel
-  ${chalk.cyan('cli-config')}  show, get, set, path, reset
-
-${chalk.bold('Configuration:')} ${chalk.dim('~/.config/bigconsole-cli/')}
-${chalk.bold('Docs:')} ${chalk.blue('https://docs.bigconsole.com/cli')}
+${chalk.bold("Version:")}
+  $ bigconsole -v | --version                                  ${chalk.dim("# Print the CLI version")}
+
+${chalk.bold("Command groups:")}
+  ${chalk.cyan("auth")}        login, logout, status, token, refresh
+  ${chalk.cyan("workspace")}   list, current, set
+  ${chalk.cyan("dashboard")}   list, get, create, update, archive, delete, import, export
+  ${chalk.cyan("widget")}      list, get, create, update, delete
+  ${chalk.cyan("datasink")}    list, get, data, create, update, delete
+  ${chalk.cyan("parser")}      list, get, create, update, delete
+  ${chalk.cyan("pipeline")}    list, get, create, update, delete
+  ${chalk.cyan("workflow")}    list, get
+  ${chalk.cyan("drilldown")}   list, delete
+  ${chalk.cyan("share")}       list
+  ${chalk.cyan("template")}    list, get
+  ${chalk.cyan("prompt")}      generate, list, get, cancel
+  ${chalk.cyan("cli-config")}  show, get, set, path, reset
+
+${chalk.bold("Configuration:")} ${chalk.dim("~/.config/bigconsole-cli/")}
+${chalk.bold("Docs:")} ${chalk.blue("https://docs.bigconsole.com/cli")}
 `);
-program.on('command:*', () => {
-    console.error(chalk.red(`Invalid command: ${program.args.join(' ')}`));
-    console.log(chalk.dim('See --help for a list of available commands.'));
-    process.exit(1);
+program.on("command:*", () => {
+  console.error(chalk.red(`Invalid command: ${sanitizeForTerminal(program.args.join(" "))}`));
+  console.error(chalk.dim("See --help for a list of available commands."));
+  process.exit(1);
 });
 program.parse();
 if (!process.argv.slice(2).length) {
-    program.outputHelp();
+  program.outputHelp();
 }