@clickraft/cli 0.1.0

package/dist/cli.js

@@ -0,0 +1,3170 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/api/client.ts
+import { request as undiciRequest } from "undici";
+import { z as z2 } from "zod";
+
+// src/auth/redact.ts
+var TOKEN_FIELD_PATTERN = /"(access_token|refresh_token|device_code|user_code|code_verifier|client_secret)"\s*:\s*"[^"]*"/gi;
+var BARE_TOKEN_PATTERN = /\bck_(?:live|dev|test)_[A-Za-z0-9_-]+/gi;
+function redactTokenLikeFields(input) {
+  return input.replace(TOKEN_FIELD_PATTERN, '"$1":"[REDACTED]"').replace(BARE_TOKEN_PATTERN, "[REDACTED]");
+}
+function redactTokenLikeValue(token) {
+  if (!token) return "<empty>";
+  if (token.length <= 12) return "[REDACTED]";
+  return `${token.slice(0, 8)}...[REDACTED]`;
+}
+
+// src/errors/codes.ts
+var LOGIN_HINT = "Run `clickraft login` to authenticate.";
+var RELOGIN_HINT = "Run `clickraft login` to refresh.";
+var EXIT_CODE_MAP = {
+  // --- 37 Phase 8 Q7 codes ----------------------------------------------------
+  AUTH_TOKEN_MISSING: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: "Set `CLICKRAFT_TOKEN` or run `clickraft login`."
+  },
+  AUTH_TOKEN_INVALID: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: "The token is malformed or unknown. Run `clickraft login`."
+  },
+  AUTH_TOKEN_EXPIRED: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: RELOGIN_HINT
+  },
+  AUTH_TOKEN_REVOKED: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: "Token was revoked. Run `clickraft login` to mint a new one."
+  },
+  AUTH_TOKEN_SCOPE_INSUFFICIENT: {
+    exitCode: 4,
+    category: "permission",
+    retryable: false,
+    hint: "This token does not have the required scope. Re-run `clickraft login` selecting the needed scopes."
+  },
+  AUTH_ORG_MISMATCH: {
+    exitCode: 4,
+    category: "permission",
+    retryable: false,
+    hint: "This token's org no longer exists or you have been removed."
+  },
+  AUTH_DEVICE_CODE_PENDING: {
+    exitCode: 0,
+    category: "success",
+    retryable: false,
+    hint: "Continue polling."
+  },
+  AUTH_DEVICE_CODE_EXPIRED: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: "Device code expired. Re-run `clickraft login`."
+  },
+  AUTH_DEVICE_CODE_SLOW_DOWN: {
+    exitCode: 0,
+    category: "success",
+    retryable: false,
+    hint: "Increase polling interval (Retry-After)."
+  },
+  IDEMPOTENCY_KEY_MISSING: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Add `X-Idempotency-Key` header (or `--idempotency-key`)."
+  },
+  IDEMPOTENCY_KEY_CONFLICT: {
+    exitCode: 7,
+    category: "conflict",
+    retryable: false,
+    hint: "Same key was used with a different request body. Use a new key."
+  },
+  PLAN_FEATURE_LOCKED: {
+    exitCode: 4,
+    category: "permission",
+    retryable: false,
+    hint: "API access is not enabled on your plan. Visit billing settings."
+  },
+  PLAN_QUOTA_EXCEEDED: {
+    exitCode: 5,
+    category: "quota",
+    retryable: false,
+    hint: "Daily API quota exhausted. Wait, or upgrade your plan."
+  },
+  INSUFFICIENT_CREDITS: {
+    exitCode: 5,
+    category: "quota",
+    retryable: false,
+    hint: "Top up credits to retry."
+  },
+  CREDIT_DEDUCTION_FAILED: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: true,
+    hint: "Could not charge credits. Retry; no charge was made."
+  },
+  RATE_LIMITED: {
+    exitCode: 5,
+    category: "quota",
+    retryable: true,
+    hint: "Slow down. Honor Retry-After."
+  },
+  INPUT_INVALID_FORMAT: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Check input format and try again."
+  },
+  INPUT_TOO_LONG: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Field exceeded max length."
+  },
+  WORKFLOW_VALIDATION_FAILED: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Run `workflow validate` for the full list of errors."
+  },
+  WORKFLOW_NODE_TYPE_UNKNOWN: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Run `node-type list` for the current set of node types."
+  },
+  WORKFLOW_VERSION_REQUIRED: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: 'Send `If-Match: "<version>"` from the last `workflow get` response.'
+  },
+  WORKFLOW_VERSION_CONFLICT: {
+    exitCode: 7,
+    category: "conflict",
+    retryable: false,
+    hint: "The workflow was updated elsewhere. Re-fetch and retry."
+  },
+  WORKFLOW_NOT_FOUND: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "No workflow with that ID in your org."
+  },
+  NOT_FOUND: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Resource not found."
+  },
+  FORBIDDEN: {
+    exitCode: 4,
+    category: "permission",
+    retryable: false,
+    hint: "Your role does not permit this action."
+  },
+  MODEL_NOT_FOUND: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "Unknown `modelSlug`. Run `brand-model list` for the current set."
+  },
+  PROVIDER_UNAVAILABLE: {
+    exitCode: 6,
+    category: "network",
+    retryable: true,
+    hint: "Provider is temporarily unavailable. Retry shortly."
+  },
+  STORAGE_UPLOAD_FAILED: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: true,
+    hint: "Upload failed mid-stream. Retry."
+  },
+  STORAGE_QUOTA_EXCEEDED: {
+    exitCode: 5,
+    category: "quota",
+    retryable: false,
+    hint: "Org storage quota exceeded. Free space or upgrade."
+  },
+  GEN_CONTENT_REFUSAL: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: false,
+    hint: "The model declined the request via safety policy."
+  },
+  GEN_OUTPUT_SCHEMA_MISMATCH: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: true,
+    hint: "Provider returned malformed output. Full refund issued. Retry."
+  },
+  GEN_EMPTY_OUTPUT: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: true,
+    hint: "Provider returned no usable output. Full refund issued. Retry."
+  },
+  GEN_ITEM_COUNT_MISMATCH: {
+    exitCode: 0,
+    category: "success",
+    retryable: false,
+    hint: "Partial output kept; no refund."
+  },
+  AGENT_FINGERPRINT_REJECTED: {
+    exitCode: 4,
+    category: "permission",
+    retryable: false,
+    hint: "This client identification is not permitted. Contact support."
+  },
+  INTERNAL_ERROR: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: true,
+    hint: "Server error. Retry; if it persists, contact support with the request ID."
+  },
+  CREDENTIALS_LOCKED: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: true,
+    hint: "Another CLI invocation holds the credentials lock. Retry shortly."
+  },
+  CREDENTIALS_PERMISSIONS_LOOSE: {
+    exitCode: 0,
+    category: "success",
+    retryable: false,
+    hint: "Credentials file mode is wider than 0600; continuing."
+  },
+  // --- 5 additional codes introduced by 1A.1 ---------------------------------
+  AUTH_ACCESS_DENIED: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: "You denied the OAuth grant. Re-run `clickraft login` to retry."
+  },
+  AUTH_FLOW_CANCELLED: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: "Authentication was cancelled. Re-run `clickraft login`."
+  },
+  CREDENTIALS_CORRUPT: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: false,
+    hint: "Credentials file is unreadable. Remove it and run `clickraft login`."
+  },
+  CREDENTIALS_NOT_FOUND: {
+    exitCode: 3,
+    category: "auth",
+    retryable: false,
+    hint: LOGIN_HINT
+  },
+  CREDENTIALS_PROFILE_NOT_FOUND: {
+    exitCode: 2,
+    category: "usage",
+    retryable: false,
+    hint: "No such profile. Use `clickraft auth profiles` to list available profiles."
+  },
+  // --- 4 CLI-synthetic codes --------------------------------------------------
+  NETWORK_ERROR: {
+    exitCode: 6,
+    category: "network",
+    retryable: true,
+    hint: "Network connection failed. Check connectivity and retry."
+  },
+  TIMEOUT: {
+    exitCode: 6,
+    category: "network",
+    retryable: true,
+    hint: "Request timed out. Retry; consider increasing the timeout."
+  },
+  PARSE_ERROR: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: false,
+    hint: "Server returned an unexpected response. Contact support with the request ID."
+  },
+  SCHEMA_MISMATCH: {
+    exitCode: 1,
+    category: "runtime",
+    retryable: false,
+    hint: "Server response did not match the expected schema. Update the CLI."
+  }
+};
+var CLI_ONLY_CODES = /* @__PURE__ */ new Set([
+  "NETWORK_ERROR",
+  "TIMEOUT",
+  "PARSE_ERROR",
+  "SCHEMA_MISMATCH"
+]);
+var KNOWN_SERVER_CODES = new Set(
+  Object.keys(EXIT_CODE_MAP).filter((k) => !CLI_ONLY_CODES.has(k))
+);
+function getExitCode(code) {
+  return EXIT_CODE_MAP[code]?.exitCode ?? 1;
+}
+function toEnvelopeCode(code) {
+  return code.startsWith("E_") ? code : `E_${code}`;
+}
+var SIGINT_EXIT_CODE = 130;
+
+// src/api/idempotency.ts
+import { createHash, randomUUID } from "crypto";
+function generateIdempotencyKey() {
+  return randomUUID();
+}
+function generateUploadIdempotencyKey(content, scope) {
+  const hash = createHash("sha256").update(content).digest("hex");
+  return `upload-${scope}-${hash}`;
+}
+
+// src/api/retry.ts
+var DEFAULT_RETRY_OPTIONS = {
+  maxAttempts: 3,
+  baseDelayMs: 200,
+  maxDelayMs: 1e4,
+  jitterFraction: 0.25
+};
+var ABSOLUTE_MAX_RETRY_AFTER_MS = 5 * 60 * 1e3;
+function computeBackoffMs(attempt, baseDelayMs, maxDelayMs, jitterFraction) {
+  const exp = Math.min(baseDelayMs * 2 ** Math.max(0, attempt - 1), maxDelayMs);
+  const jitter = exp * jitterFraction * (Math.random() * 2 - 1);
+  return Math.max(0, Math.round(exp + jitter));
+}
+function decideRetry(params) {
+  const { attempt, options, serverRetryAfterMs, isNetworkError, isRetryable } = params;
+  if (options.signal?.aborted) {
+    return { shouldRetry: false, delayMs: 0, reason: "aborted" };
+  }
+  if (attempt >= options.maxAttempts) {
+    return { shouldRetry: false, delayMs: 0, reason: "max_attempts" };
+  }
+  if (!isNetworkError && !isRetryable) {
+    return { shouldRetry: false, delayMs: 0, reason: "not_retryable" };
+  }
+  if (typeof serverRetryAfterMs === "number" && serverRetryAfterMs >= 0) {
+    let delayMs2 = serverRetryAfterMs;
+    if (delayMs2 > ABSOLUTE_MAX_RETRY_AFTER_MS) {
+      console.warn(`Server Retry-After exceeded ${ABSOLUTE_MAX_RETRY_AFTER_MS}ms; clipping.`);
+      delayMs2 = ABSOLUTE_MAX_RETRY_AFTER_MS;
+    }
+    return { shouldRetry: true, delayMs: delayMs2, reason: "rate_limited" };
+  }
+  const delayMs = computeBackoffMs(
+    attempt,
+    options.baseDelayMs,
+    options.maxDelayMs,
+    options.jitterFraction
+  );
+  return {
+    shouldRetry: true,
+    delayMs,
+    reason: isNetworkError ? "network_failure" : "retryable_error"
+  };
+}
+async function sleep(delayMs, signal) {
+  if (signal?.aborted) {
+    throw signalToAbortError(signal);
+  }
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, delayMs);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signalToAbortError(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function signalToAbortError(signal) {
+  const reason = signal?.reason;
+  if (reason instanceof Error) return reason;
+  const err = new Error("The operation was aborted.");
+  err.name = "AbortError";
+  return err;
+}
+
+// src/api/types.ts
+import { z } from "zod";
+var ServerSuccessSchema = (payload) => z.object({ data: payload }).strict();
+var ServerErrorBodySchema = z.object({
+  error: z.object({
+    code: z.string().min(1),
+    message: z.string(),
+    correlationId: z.string().optional(),
+    retryAfter: z.number().int().nonnegative().optional(),
+    details: z.unknown().optional()
+  }).strict()
+}).strict();
+
+// src/api/client.ts
+var ApiError = class extends Error {
+  code;
+  meta;
+  cause;
+  constructor(code, message, meta, cause) {
+    super(message);
+    this.name = "ApiError";
+    this.code = code;
+    this.meta = meta;
+    this.cause = cause;
+  }
+};
+var REDACT_BODY_LIMIT = 1024;
+var REDACT_INPUT_CAP = 100 * 1024;
+var DEFAULT_USER_AGENT = "clickraft-cli";
+var ApiClient = class {
+  options;
+  retryDefaults;
+  constructor(options) {
+    this.options = options;
+    this.retryDefaults = {
+      ...DEFAULT_RETRY_OPTIONS,
+      ...options.retryDefaults
+    };
+  }
+  // Issues a request with built-in retry, Zod validation, and token redaction.
+  //
+  // Non-GET requests get an auto-generated UUIDv4 `X-Idempotency-Key` per
+  // Phase 8 Q8 of the wave-1 investigation. The key is computed once and
+  // reused across every retry attempt so the server can deduplicate. Callers
+  // may pass `opts.idempotencyKey` to override the default — the upload
+  // command uses this to derive the key from the content's SHA-256.
+  async request(opts) {
+    const retry = {
+      ...this.retryDefaults,
+      ...opts.retry
+    };
+    const signal = composeSignals([this.options.signal, opts.signal, retry.signal]);
+    const url = buildUrl(this.options.apiBaseUrl, opts.path, opts.query);
+    const effectiveIdempotencyKey = opts.method === "GET" ? opts.idempotencyKey : opts.idempotencyKey ?? generateIdempotencyKey();
+    const headers = this.buildHeaders({ ...opts, idempotencyKey: effectiveIdempotencyKey });
+    const bodyText = serializeBody(opts);
+    let attempt = 0;
+    let lastError;
+    while (attempt < retry.maxAttempts) {
+      attempt += 1;
+      if (signal.aborted) {
+        throw toAbortApiError(signal);
+      }
+      try {
+        return await this.singleAttempt({
+          url,
+          method: opts.method,
+          headers,
+          bodyText,
+          signal,
+          responseSchema: opts.responseSchema
+        });
+      } catch (err) {
+        if (!(err instanceof ApiError)) throw err;
+        lastError = err;
+        const isNetworkError = err.code === "NETWORK_ERROR";
+        const isRetryable = err.meta.retryable;
+        const decision = decideRetry({
+          attempt,
+          options: { ...retry, signal },
+          serverRetryAfterMs: err.meta.retryAfterMs,
+          isNetworkError,
+          isRetryable
+        });
+        if (!decision.shouldRetry) throw err;
+        try {
+          await sleep(decision.delayMs, signal);
+        } catch (sleepErr) {
+          throw toAbortApiError(signal, sleepErr);
+        }
+      }
+    }
+    throw lastError ?? new ApiError("INTERNAL_ERROR", "Retry loop terminated unexpectedly.", {
+      retryable: false
+    });
+  }
+  buildHeaders(opts) {
+    const h = {
+      accept: "application/json",
+      "user-agent": this.options.userAgent ?? DEFAULT_USER_AGENT
+    };
+    if (this.options.accessToken) {
+      h.authorization = `Bearer ${this.options.accessToken}`;
+    }
+    if (opts.body !== void 0 && opts.method !== "GET" && opts.method !== "DELETE") {
+      h["content-type"] = "application/json";
+    }
+    if (opts.idempotencyKey) {
+      h["x-idempotency-key"] = opts.idempotencyKey;
+    }
+    if (opts.headers) {
+      for (const [k, v] of Object.entries(opts.headers)) {
+        h[k.toLowerCase()] = v;
+      }
+    }
+    return h;
+  }
+  async singleAttempt(args) {
+    let response;
+    try {
+      response = await undiciRequest(args.url, {
+        method: args.method,
+        headers: args.headers,
+        body: args.bodyText,
+        signal: args.signal,
+        dispatcher: this.options.dispatcher
+      });
+    } catch (err) {
+      if (isAbortError(err)) {
+        throw toAbortApiError(args.signal, err);
+      }
+      throw new ApiError(
+        "NETWORK_ERROR",
+        `Network request failed: ${errorMessage(err)}`,
+        { retryable: true },
+        err
+      );
+    }
+    const { statusCode, headers: responseHeaders, body } = response;
+    let bodyText;
+    try {
+      bodyText = await body.text();
+    } catch (err) {
+      if (isAbortError(err)) {
+        throw toAbortApiError(args.signal, err);
+      }
+      throw new ApiError(
+        "NETWORK_ERROR",
+        `Failed to read response body: ${errorMessage(err)}`,
+        { status: statusCode, retryable: true },
+        err
+      );
+    }
+    const requestId = pickHeader(responseHeaders, "x-correlation-id");
+    if (statusCode >= 200 && statusCode < 300) {
+      return parseSuccessBody({
+        bodyText,
+        statusCode,
+        requestId,
+        responseSchema: args.responseSchema
+      });
+    }
+    throw parseErrorBody({
+      bodyText,
+      statusCode,
+      requestId,
+      retryAfterHeader: pickHeader(responseHeaders, "retry-after")
+    });
+  }
+};
+function parseSuccessBody(args) {
+  let parsed;
+  try {
+    parsed = JSON.parse(args.bodyText);
+  } catch (err) {
+    throw new ApiError(
+      "PARSE_ERROR",
+      "Server returned a non-JSON response.",
+      {
+        status: args.statusCode,
+        requestId: args.requestId,
+        retryable: false,
+        redactedBody: redactAndTruncate(args.bodyText)
+      },
+      err
+    );
+  }
+  const envelope = ServerSuccessSchema(args.responseSchema ?? z2.unknown()).safeParse(parsed);
+  if (!envelope.success) {
+    throw new ApiError("SCHEMA_MISMATCH", "Server response did not match the expected schema.", {
+      status: args.statusCode,
+      requestId: args.requestId,
+      retryable: false,
+      redactedBody: redactAndTruncate(args.bodyText)
+    });
+  }
+  return envelope.data.data;
+}
+function parseErrorBody(args) {
+  const redactedBody = redactAndTruncate(args.bodyText);
+  let parsed;
+  try {
+    parsed = JSON.parse(args.bodyText);
+  } catch {
+    return new ApiError(
+      "PARSE_ERROR",
+      `Server returned a ${args.statusCode} response with a non-JSON body.`,
+      {
+        status: args.statusCode,
+        requestId: args.requestId,
+        retryable: args.statusCode >= 500,
+        redactedBody
+      }
+    );
+  }
+  const envelope = ServerErrorBodySchema.safeParse(parsed);
+  if (!envelope.success) {
+    return new ApiError(
+      "PARSE_ERROR",
+      `Server returned ${args.statusCode} but body did not match the error envelope.`,
+      {
+        status: args.statusCode,
+        requestId: args.requestId,
+        retryable: args.statusCode >= 500,
+        redactedBody
+      }
+    );
+  }
+  return apiErrorFromServerBody({
+    body: envelope.data,
+    statusCode: args.statusCode,
+    requestId: args.requestId,
+    retryAfterHeader: args.retryAfterHeader,
+    redactedBody
+  });
+}
+function apiErrorFromServerBody(args) {
+  const { error } = args.body;
+  let code;
+  let safeMessage;
+  if (KNOWN_SERVER_CODES.has(error.code)) {
+    code = error.code;
+    safeMessage = redactTokenLikeFields(error.message);
+  } else {
+    const redactedRawCode = redactTokenLikeFields(error.code);
+    console.warn(`Unknown server error code: ${redactedRawCode}. Treating as INTERNAL_ERROR.`);
+    code = "INTERNAL_ERROR";
+    safeMessage = `Unknown server error code: ${redactedRawCode}.`;
+  }
+  const mapping = EXIT_CODE_MAP[code];
+  const retryable = mapping?.retryable ?? (args.statusCode >= 500 || args.statusCode === 429);
+  const retryAfterMs = typeof error.retryAfter === "number" ? error.retryAfter * 1e3 : parseRetryAfterHeader(args.retryAfterHeader);
+  return new ApiError(code, safeMessage, {
+    status: args.statusCode,
+    requestId: error.correlationId ?? args.requestId,
+    retryable,
+    retryAfterMs,
+    redactedBody: args.redactedBody
+  });
+}
+function parseRetryAfterHeader(headerValue) {
+  if (!headerValue) return void 0;
+  const trimmed = headerValue.trim();
+  if (/^\d+$/.test(trimmed)) {
+    return Number.parseInt(trimmed, 10) * 1e3;
+  }
+  if (/[A-Za-z]/.test(trimmed)) {
+    const parsed = Date.parse(trimmed);
+    if (!Number.isNaN(parsed)) {
+      return Math.max(0, parsed - Date.now());
+    }
+  }
+  return void 0;
+}
+function buildUrl(baseUrl, path, query) {
+  const base = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+  const relative = path.startsWith("/") ? path.slice(1) : path;
+  const url = new URL(relative, base);
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value === void 0) continue;
+      url.searchParams.append(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function serializeBody(opts) {
+  if (opts.body === void 0) return void 0;
+  if (opts.method === "GET") return void 0;
+  return JSON.stringify(opts.body);
+}
+function composeSignals(signals) {
+  const present = signals.filter((s) => s !== void 0);
+  if (present.length === 0) return new AbortController().signal;
+  if (present.length === 1) return present[0];
+  const any = AbortSignal.any;
+  if (typeof any === "function") return any(present);
+  const ctrl = new AbortController();
+  for (const s of present) {
+    if (s.aborted) {
+      ctrl.abort(s.reason);
+      break;
+    }
+    s.addEventListener("abort", () => ctrl.abort(s.reason), { once: true });
+  }
+  return ctrl.signal;
+}
+function pickHeader(headers, name) {
+  const value = headers[name] ?? headers[name.toLowerCase()];
+  if (Array.isArray(value)) return value[0];
+  return value;
+}
+function redactAndTruncate(body) {
+  const input = body.length > REDACT_INPUT_CAP ? body.slice(0, REDACT_INPUT_CAP) : body;
+  const redacted = redactTokenLikeFields(input);
+  return redacted.length > REDACT_BODY_LIMIT ? `${redacted.slice(0, REDACT_BODY_LIMIT)}\u2026` : redacted;
+}
+function isAbortError(err) {
+  if (!(err instanceof Error)) return false;
+  return err.name === "AbortError" || /aborted/i.test(err.message);
+}
+function toAbortApiError(signal, cause) {
+  const reasonMessage = signal.reason instanceof Error ? signal.reason.message : "Request was aborted.";
+  return new ApiError("TIMEOUT", reasonMessage, { retryable: true }, cause);
+}
+function errorMessage(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+
+// src/auth/errors.ts
+var AuthError = class extends Error {
+  code;
+  cause;
+  constructor(code, message, cause) {
+    super(message);
+    this.name = "AuthError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+var CredentialsError = class extends Error {
+  code;
+  cause;
+  constructor(code, message, cause) {
+    super(message);
+    this.name = "CredentialsError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+
+// src/api/envelope.ts
+function wrapSuccess(data, ctx) {
+  const meta = {
+    command: ctx.command,
+    version: ctx.version,
+    duration_ms: Math.max(0, Date.now() - ctx.startMs)
+  };
+  if (ctx.requestId) meta.request_id = ctx.requestId;
+  if (ctx.nextCursor) meta.next_cursor = ctx.nextCursor;
+  return { ok: true, data, error: null, meta };
+}
+function wrapError(err, ctx) {
+  const payload = errorToEnvelopePayload(err);
+  const meta = {
+    command: ctx.command,
+    version: ctx.version,
+    duration_ms: Math.max(0, Date.now() - ctx.startMs)
+  };
+  if (payload.request_id ?? ctx.requestId) {
+    meta.request_id = payload.request_id ?? ctx.requestId;
+  }
+  return { ok: false, data: null, error: payload, meta };
+}
+function errorToEnvelopePayload(err) {
+  if (err instanceof ApiError) {
+    return buildPayload({
+      code: err.code,
+      message: err.message,
+      retryable: err.meta.retryable,
+      retryAfterMs: err.meta.retryAfterMs,
+      requestId: err.meta.requestId
+    });
+  }
+  if (err instanceof AuthError || err instanceof CredentialsError) {
+    const code = err.code;
+    const mapping = EXIT_CODE_MAP[code];
+    return buildPayload({
+      code,
+      message: err.message,
+      retryable: mapping?.retryable ?? false
+    });
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return buildPayload({
+    code: "INTERNAL_ERROR",
+    message,
+    retryable: false
+  });
+}
+function buildPayload(args) {
+  const mapping = EXIT_CODE_MAP[args.code];
+  const payload = {
+    code: toEnvelopeCode(args.code),
+    message: args.message,
+    retryable: args.retryable
+  };
+  if (typeof args.retryAfterMs === "number") payload.retry_after_ms = args.retryAfterMs;
+  if (args.requestId) payload.request_id = args.requestId;
+  if (mapping?.hint) payload.hint = mapping.hint;
+  return payload;
+}
+
+// src/schemas/jobs.ts
+import { z as z3 } from "zod";
+var GenerateCreateRequestSchema = z3.object({
+  modelSlug: z3.string().min(1).max(100),
+  input: z3.object({
+    prompt: z3.string().max(1e4).optional(),
+    referenceImageUrl: z3.string().url().optional(),
+    referenceImages: z3.array(z3.string().url()).max(8).optional(),
+    aspectRatio: z3.string().regex(/^\d+:\d+$/).optional(),
+    resolution: z3.string().regex(/^\d+x\d+$/).optional(),
+    durationSeconds: z3.number().int().min(1).max(60).optional(),
+    providerParams: z3.record(z3.string(), z3.unknown()).optional()
+  }).strict(),
+  options: z3.object({
+    workflowId: z3.string().uuid().optional(),
+    nodeId: z3.string().optional()
+  }).strict().optional()
+}).strict();
+var GenerateCreateResponseSchema = z3.object({
+  jobId: z3.string().uuid(),
+  status: z3.enum(["queued", "processing", "completed", "failed"]),
+  estimatedSeconds: z3.number().int().nonnegative(),
+  creditsCharged: z3.number().int().nonnegative()
+}).strict();
+var GenerationStatusSchema = z3.enum([
+  "queued",
+  "processing",
+  "uploading",
+  "completed",
+  "failed",
+  "cancelled"
+]);
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "cancelled"
+]);
+function isTerminalStatus(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+var GenerationResultSchema = z3.object({
+  jobId: z3.string().uuid(),
+  status: GenerationStatusSchema,
+  modelSlug: z3.string(),
+  resultUrl: z3.string().url().nullable(),
+  thumbnailUrl: z3.string().url().nullable(),
+  errorCode: z3.string().nullable(),
+  errorMessage: z3.string().nullable(),
+  creditsCharged: z3.number().int().nonnegative(),
+  creditsRefunded: z3.boolean(),
+  startedAt: z3.string().datetime().nullable(),
+  completedAt: z3.string().datetime().nullable()
+}).strict();
+
+// src/commands/upload.ts
+import { createHash as createHash2 } from "crypto";
+import { readFile as readFile2, stat as stat2 } from "fs/promises";
+import { basename } from "path";
+import { request as undiciRequest2 } from "undici";
+
+// src/auth/credentials.ts
+import {
+  access,
+  chmod,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import { dirname } from "path";
+import * as lockfile from "proper-lockfile";
+
+// src/config/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+var CREDENTIALS_FILE = "credentials.json";
+var APP_DIR = "clickraft";
+function getConfigDir(ctx = {}) {
+  const env = ctx.env ?? process.env;
+  const platform = ctx.platform ?? process.platform;
+  const home = ctx.home ?? homedir();
+  const xdg = env.XDG_CONFIG_HOME;
+  if (xdg && xdg.length > 0) {
+    return join(xdg, APP_DIR);
+  }
+  if (platform === "win32") {
+    const appData = env.APPDATA;
+    if (appData && appData.length > 0) {
+      return join(appData, APP_DIR);
+    }
+    return join(home, "AppData", "Roaming", APP_DIR);
+  }
+  return join(home, ".config", APP_DIR);
+}
+function getCredentialsPath(ctx = {}) {
+  return join(getConfigDir(ctx), CREDENTIALS_FILE);
+}
+
+// src/auth/types.ts
+import { z as z4 } from "zod";
+var DeviceAuthorizationRequestSchema = z4.object({
+  client_id: z4.string(),
+  scope: z4.string()
+});
+var DeviceAuthorizationResponseSchema = z4.object({
+  device_code: z4.string(),
+  user_code: z4.string().regex(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/),
+  verification_uri: z4.string().url(),
+  verification_uri_complete: z4.string().url().optional(),
+  expires_in: z4.number().int().positive(),
+  interval: z4.number().int().positive().default(5)
+});
+var DeviceTokenPollRequestSchema = z4.object({
+  client_id: z4.string(),
+  device_code: z4.string(),
+  grant_type: z4.literal("urn:ietf:params:oauth:grant-type:device_code")
+});
+var TokenResponseSchema = z4.object({
+  access_token: z4.string(),
+  token_type: z4.literal("Bearer"),
+  expires_in: z4.number().int().positive(),
+  scope: z4.string()
+});
+var DeviceTokenPollErrorCodeSchema = z4.enum([
+  "authorization_pending",
+  "slow_down",
+  "access_denied",
+  "expired_token",
+  "invalid_client",
+  "invalid_grant",
+  "unauthorized_client",
+  "unsupported_grant_type",
+  "invalid_scope"
+]);
+var DeviceTokenPollErrorSchema = z4.object({
+  error: DeviceTokenPollErrorCodeSchema,
+  error_description: z4.string().optional()
+});
+var CredentialsProfileSchema = z4.object({
+  apiBaseUrl: z4.string().url(),
+  accessToken: z4.string(),
+  tokenType: z4.literal("Bearer"),
+  tokenPrefix: z4.string(),
+  organizationId: z4.string().uuid(),
+  organizationSlug: z4.string(),
+  userId: z4.string().uuid(),
+  scopes: z4.array(z4.string()),
+  expiresAt: z4.string().datetime(),
+  issuedAt: z4.string().datetime(),
+  clientId: z4.string()
+}).strict();
+var CredentialsFileSchema = z4.object({
+  version: z4.literal(1),
+  defaultProfile: z4.string(),
+  profiles: z4.record(z4.string(), CredentialsProfileSchema)
+}).strict();
+
+// src/auth/credentials.ts
+var LOCK_OPTS = {
+  retries: { retries: 10, factor: 1.5, minTimeout: 100, maxTimeout: 500 },
+  realpath: false,
+  stale: 5e3,
+  update: 2e3
+};
+var IS_WINDOWS = process.platform === "win32";
+async function readCredentials(path) {
+  const target = path ?? getCredentialsPath();
+  try {
+    await access(target);
+  } catch {
+    return null;
+  }
+  if (!IS_WINDOWS) {
+    try {
+      const s = await stat(target);
+      if ((s.mode & 63) !== 0) {
+        const modeStr = (s.mode & 511).toString(8).padStart(3, "0");
+        console.warn(
+          `[clickraft] credentials file at ${target} has loose permissions (mode ${modeStr}). Run \`chmod 600 ${target}\` to restrict it.`
+        );
+      }
+    } catch {
+    }
+  }
+  return parseCredentialsFile(await readFile(target, "utf8"), target);
+}
+async function setProfile(name, profile, path) {
+  const target = path ?? getCredentialsPath();
+  const validatedProfile = validateProfile(profile);
+  await withLock(target, async () => {
+    const current = await readUnderLock(target) ?? {
+      version: 1,
+      defaultProfile: name,
+      profiles: {}
+    };
+    current.profiles[name] = validatedProfile;
+    await writeAtomic(target, serialize(current));
+  });
+}
+async function removeProfile(name, path) {
+  const target = path ?? getCredentialsPath();
+  await withLock(target, async () => {
+    const current = await readUnderLock(target);
+    if (!current) {
+      throw new CredentialsError(
+        "CREDENTIALS_NOT_FOUND",
+        `No credentials file at ${target}; nothing to remove.`
+      );
+    }
+    if (!(name in current.profiles)) {
+      throw new CredentialsError(
+        "CREDENTIALS_PROFILE_NOT_FOUND",
+        `Profile "${name}" not found in credentials file.`
+      );
+    }
+    delete current.profiles[name];
+    if (current.defaultProfile === name) {
+      const remaining = Object.keys(current.profiles);
+      current.defaultProfile = remaining[0] ?? "";
+    }
+    await writeAtomic(target, serialize(current));
+  });
+}
+async function deleteCredentials(path) {
+  const target = path ?? getCredentialsPath();
+  await withLock(target, async () => {
+    try {
+      await rm(target);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  });
+}
+async function withLock(target, fn) {
+  await ensureDir(dirname(target));
+  let release;
+  try {
+    release = await lockfile.lock(target, LOCK_OPTS);
+  } catch (err) {
+    throw new CredentialsError(
+      "CREDENTIALS_LOCKED",
+      `Failed to acquire exclusive lock on ${target}. Another clickraft process may be holding it; retry shortly.`,
+      err
+    );
+  }
+  try {
+    return await fn();
+  } finally {
+    try {
+      await release();
+    } catch {
+    }
+  }
+}
+async function readUnderLock(target) {
+  try {
+    await access(target);
+  } catch {
+    return null;
+  }
+  return parseCredentialsFile(await readFile(target, "utf8"), target);
+}
+function validateProfile(profile) {
+  const result = CredentialsProfileSchema.safeParse(profile);
+  if (!result.success) {
+    throw new CredentialsError(
+      "CREDENTIALS_CORRUPT",
+      "Refusing to write credentials profile: input failed schema validation.",
+      result.error
+    );
+  }
+  return result.data;
+}
+function parseCredentialsFile(raw, target) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new CredentialsError(
+      "CREDENTIALS_CORRUPT",
+      `credentials file at ${target} is not valid JSON. Run \`clickraft login\` to re-authenticate.`,
+      err
+    );
+  }
+  const result = CredentialsFileSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new CredentialsError(
+      "CREDENTIALS_CORRUPT",
+      `credentials file at ${target} has an unexpected shape. Run \`clickraft login\` to re-authenticate.`,
+      result.error
+    );
+  }
+  return result.data;
+}
+async function ensureDir(dir) {
+  const opts = IS_WINDOWS ? { recursive: true } : { recursive: true, mode: 448 };
+  await mkdir(dir, opts);
+}
+async function writeAtomic(target, payload) {
+  const tmp = `${target}.tmp`;
+  const writeOpts = IS_WINDOWS ? { encoding: "utf8" } : { encoding: "utf8", mode: 384 };
+  await writeFile(tmp, payload, writeOpts);
+  try {
+    if (!IS_WINDOWS) {
+      await chmod(tmp, 384);
+    }
+    await rename(tmp, target);
+  } catch (err) {
+    try {
+      await unlink(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function serialize(file) {
+  return JSON.stringify(file, null, 2) + "\n";
+}
+
+// src/config/loader.ts
+var DEFAULT_API_BASE_URL = "https://clickraft.ai/api/agents/v1";
+var DEFAULT_PROFILE_NAME = "default";
+var TOKEN_ENV_VAR = "CLICKRAFT_TOKEN";
+var PROFILE_ENV_VAR = "CLICKRAFT_PROFILE";
+var API_BASE_URL_ENV_VAR = "CLICKRAFT_API_BASE_URL";
+var TELEMETRY_DISABLE_ENV_VAR = "CLICKRAFT_DISABLE_TELEMETRY";
+async function loadConfig(options = {}) {
+  const env = options.env ?? process.env;
+  const flagToken = trim(options.flagToken);
+  const envToken = trim(env[TOKEN_ENV_VAR]);
+  const flagProfile = trim(options.flagProfile);
+  const envProfile = trim(env[PROFILE_ENV_VAR]);
+  const flagApiBaseUrl = trim(options.flagApiBaseUrl);
+  const envApiBaseUrl = trim(env[API_BASE_URL_ENV_VAR]);
+  const profileName = flagProfile ?? envProfile;
+  const tokenFromFlagOrEnv = flagToken ?? envToken;
+  const apiBaseFromFlagOrEnv = flagApiBaseUrl ?? envApiBaseUrl;
+  const needsFile = !tokenFromFlagOrEnv || !apiBaseFromFlagOrEnv || !profileName;
+  let fileProfileName;
+  let fileAccessToken;
+  let fileApiBaseUrl;
+  if (needsFile) {
+    const path = options.credentialsPath ?? getCredentialsPath();
+    const file = await readCredentials(path);
+    if (file) {
+      const resolvedName = profileName ?? file.defaultProfile ?? DEFAULT_PROFILE_NAME;
+      fileProfileName = file.defaultProfile;
+      const profile = file.profiles[resolvedName];
+      if (profile) {
+        fileAccessToken = profile.accessToken;
+        fileApiBaseUrl = profile.apiBaseUrl;
+      }
+    }
+  }
+  return {
+    accessToken: tokenFromFlagOrEnv ?? fileAccessToken ?? null,
+    profileName: profileName ?? fileProfileName ?? DEFAULT_PROFILE_NAME,
+    apiBaseUrl: apiBaseFromFlagOrEnv ?? fileApiBaseUrl ?? DEFAULT_API_BASE_URL
+  };
+}
+function trim(value) {
+  if (value === void 0) return void 0;
+  const t = value.trim();
+  return t.length === 0 ? void 0 : t;
+}
+
+// src/schemas/assets.ts
+import { z as z5 } from "zod";
+var MAX_UPLOAD_SIZE_BYTES = 15 * 1024 * 1024;
+var UploadRequestSchema = z5.object({
+  filename: z5.string().min(1).max(255),
+  contentType: z5.string().regex(/^[\w-]+\/[\w+.-]+$/),
+  sizeBytes: z5.number().int().positive().max(MAX_UPLOAD_SIZE_BYTES),
+  contentHash: z5.string().regex(/^sha256:[0-9a-f]{64}$/)
+}).strict();
+var UploadResponseSchema = z5.object({
+  assetId: z5.string().uuid(),
+  uploadUrl: z5.string().url(),
+  publicUrl: z5.string().url(),
+  deduplicated: z5.boolean()
+}).strict();
+
+// src/commands/upload.ts
+var DEFAULT_UPLOAD_SCOPE = "user-uploads";
+async function uploadFile(opts) {
+  const scope = opts.scope ?? DEFAULT_UPLOAD_SCOPE;
+  const size = await safeStatSize(opts.filePath);
+  validateSize(size);
+  const content = await safeReadFile(opts.filePath);
+  const contentType = detectContentType(opts.filePath, content);
+  const sha = sha256Hex(content);
+  const contentHash = `sha256:${sha}`;
+  const filename = basename(opts.filePath);
+  const idempotencyKey = generateUploadIdempotencyKey(content, scope);
+  const client = opts.client ?? await buildClient(opts);
+  const response = await postAssetMetadata({
+    client,
+    filename,
+    contentType,
+    sizeBytes: content.length,
+    contentHash,
+    idempotencyKey,
+    signal: opts.signal
+  });
+  if (!response.deduplicated) {
+    const first = await tryPut({
+      uploadUrl: response.uploadUrl,
+      content,
+      contentType,
+      signal: opts.signal,
+      dispatcher: opts.putDispatcher
+    });
+    if (!first.ok) {
+      if (first.kind === "fatal") {
+        throw new ApiError(
+          "STORAGE_UPLOAD_FAILED",
+          `Upload to signed URL failed for ${filename} (HTTP ${first.status ?? "unknown"}).`,
+          { retryable: false }
+        );
+      }
+      const retry = await tryPut({
+        uploadUrl: response.uploadUrl,
+        content,
+        contentType,
+        signal: opts.signal,
+        dispatcher: opts.putDispatcher
+      });
+      if (!retry.ok) {
+        throw new ApiError(
+          "STORAGE_UPLOAD_FAILED",
+          `Upload to signed URL failed for ${filename} after one retry.`,
+          { retryable: true }
+        );
+      }
+    }
+  }
+  return {
+    assetId: response.assetId,
+    publicUrl: response.publicUrl,
+    deduplicated: response.deduplicated,
+    bytes: content.length,
+    contentHash
+  };
+}
+async function buildClient(opts) {
+  const cfg = await loadConfig({
+    flagProfile: opts.profile,
+    flagApiBaseUrl: opts.apiBaseUrl,
+    flagToken: opts.token
+  });
+  return new ApiClient({
+    apiBaseUrl: cfg.apiBaseUrl,
+    accessToken: cfg.accessToken,
+    signal: opts.signal
+  });
+}
+async function postAssetMetadata(args) {
+  return args.client.request({
+    method: "POST",
+    path: "/api/agents/v1/assets",
+    body: {
+      filename: args.filename,
+      contentType: args.contentType,
+      sizeBytes: args.sizeBytes,
+      contentHash: args.contentHash
+    },
+    idempotencyKey: args.idempotencyKey,
+    responseSchema: UploadResponseSchema,
+    signal: args.signal
+  });
+}
+async function tryPut(args) {
+  try {
+    const response = await undiciRequest2(args.uploadUrl, {
+      method: "PUT",
+      body: args.content,
+      headers: {
+        "content-type": args.contentType,
+        "content-length": String(args.content.length)
+      },
+      signal: args.signal,
+      dispatcher: args.dispatcher
+    });
+    await response.body.text();
+    const status = response.statusCode;
+    if (status >= 200 && status < 300) return { ok: true };
+    if (status >= 400 && status < 500) return { ok: false, kind: "fatal", status };
+    return { ok: false, kind: "retryable", status };
+  } catch {
+    return { ok: false, kind: "retryable" };
+  }
+}
+async function safeStatSize(filePath) {
+  let stats;
+  try {
+    stats = await stat2(filePath);
+  } catch (err) {
+    throw toFsApiError(err, filePath);
+  }
+  if (stats.isDirectory()) {
+    throw new ApiError("INPUT_INVALID_FORMAT", `Expected a file, got a directory: ${filePath}`, {
+      retryable: false
+    });
+  }
+  if (!stats.isFile()) {
+    throw new ApiError("INPUT_INVALID_FORMAT", `Expected a regular file: ${filePath}`, {
+      retryable: false
+    });
+  }
+  return stats.size;
+}
+async function safeReadFile(filePath) {
+  try {
+    return await readFile2(filePath);
+  } catch (err) {
+    throw toFsApiError(err, filePath);
+  }
+}
+function toFsApiError(err, filePath) {
+  if (err instanceof Error && "code" in err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      return new ApiError("INPUT_INVALID_FORMAT", `File not found: ${filePath}`, {
+        retryable: false
+      });
+    }
+    if (code === "EISDIR") {
+      return new ApiError("INPUT_INVALID_FORMAT", `Expected a file, got a directory: ${filePath}`, {
+        retryable: false
+      });
+    }
+    if (code === "EACCES" || code === "EPERM") {
+      return new ApiError("INPUT_INVALID_FORMAT", `Permission denied: ${filePath}`, {
+        retryable: false
+      });
+    }
+  }
+  return err;
+}
+function validateSize(bytes) {
+  if (bytes === 0) {
+    throw new ApiError("INPUT_INVALID_FORMAT", "Refusing to upload an empty file.", {
+      retryable: false
+    });
+  }
+  if (bytes > MAX_UPLOAD_SIZE_BYTES) {
+    throw new ApiError(
+      "INPUT_INVALID_FORMAT",
+      `File is ${bytes} bytes; the upload endpoint caps at ${MAX_UPLOAD_SIZE_BYTES} bytes.`,
+      { retryable: false }
+    );
+  }
+}
+function sha256Hex(content) {
+  return createHash2("sha256").update(content).digest("hex");
+}
+var MAGIC_NUMBERS = [
+  { contentType: "image/png", prefix: [137, 80, 78, 71, 13, 10, 26, 10] },
+  { contentType: "image/jpeg", prefix: [255, 216, 255] },
+  { contentType: "image/webp", prefix: [82, 73, 70, 70] }
+  // also matches WAV — disambiguated below
+];
+var EXTENSION_FALLBACK = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  mp4: "video/mp4",
+  mov: "video/quicktime",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  json: "application/json"
+};
+function detectContentType(filePath, content) {
+  if (content.length >= 6) {
+    const head = content.subarray(0, 6).toString("ascii");
+    if (head === "GIF87a" || head === "GIF89a") return "image/gif";
+  }
+  if (content.length >= 12 && content.subarray(4, 8).toString("ascii") === "ftyp") {
+    return "video/mp4";
+  }
+  for (const { contentType, prefix } of MAGIC_NUMBERS) {
+    if (matchesPrefix(content, prefix)) {
+      if (contentType === "image/webp") {
+        const formatId = content.subarray(8, 12).toString("ascii");
+        if (formatId === "WEBP") return "image/webp";
+        if (formatId === "WAVE") return "audio/wav";
+        break;
+      }
+      return contentType;
+    }
+  }
+  const ext = filePath.toLowerCase().split(".").pop();
+  if (ext && EXTENSION_FALLBACK[ext]) {
+    return EXTENSION_FALLBACK[ext];
+  }
+  return "application/octet-stream";
+}
+function matchesPrefix(content, prefix) {
+  if (content.length < prefix.length) return false;
+  for (let i = 0; i < prefix.length; i++) {
+    if (content[i] !== prefix[i]) return false;
+  }
+  return true;
+}
+
+// src/commands/generate/internal.ts
+async function buildGenerateClient(opts) {
+  const cfg = await loadConfig({
+    flagProfile: opts.profile,
+    flagApiBaseUrl: opts.apiBaseUrl,
+    flagToken: opts.token
+  });
+  return new ApiClient({
+    apiBaseUrl: cfg.apiBaseUrl,
+    accessToken: cfg.accessToken,
+    signal: opts.signal
+  });
+}
+function isUrlLike(value) {
+  return value.startsWith("http://") || value.startsWith("https://");
+}
+
+// src/cli/long-poll.ts
+async function longPoll(opts) {
+  const now = opts.now ?? Date.now;
+  const started = now();
+  for (; ; ) {
+    if (opts.signal?.aborted) {
+      throw new ApiError("TIMEOUT", "Wait was aborted.", { retryable: true });
+    }
+    const elapsedBefore = now() - started;
+    if (elapsedBefore >= opts.timeoutMs) {
+      throw new ApiError(
+        "TIMEOUT",
+        `Wait exceeded ${opts.timeoutMs}ms without reaching a terminal state.`,
+        { retryable: true }
+      );
+    }
+    const remainingMs = opts.timeoutMs - elapsedBefore;
+    const iterationSignal = composeIterationSignal(opts.signal, remainingMs);
+    let result;
+    try {
+      result = await opts.fetcher({ signal: iterationSignal });
+    } catch (err) {
+      if (opts.signal?.aborted || now() - started >= opts.timeoutMs) {
+        throw new ApiError(
+          "TIMEOUT",
+          `Wait exceeded ${opts.timeoutMs}ms without reaching a terminal state.`,
+          { retryable: true }
+        );
+      }
+      throw err;
+    }
+    if (opts.signal?.aborted) {
+      throw new ApiError("TIMEOUT", "Wait was aborted.", { retryable: true });
+    }
+    const elapsedAfter = now() - started;
+    if (elapsedAfter >= opts.timeoutMs) {
+      throw new ApiError(
+        "TIMEOUT",
+        `Wait exceeded ${opts.timeoutMs}ms without reaching a terminal state.`,
+        { retryable: true }
+      );
+    }
+    if (opts.isTerminal(result)) {
+      return result;
+    }
+  }
+}
+function composeIterationSignal(userSignal, remainingMs) {
+  const deadlineSignal = AbortSignal.timeout(Math.max(remainingMs, 0));
+  return userSignal ? AbortSignal.any([userSignal, deadlineSignal]) : deadlineSignal;
+}
+
+// src/commands/generate/get.ts
+async function generateGet(opts) {
+  const client = opts.client ?? await buildGenerateClient(opts);
+  return client.request({
+    method: "GET",
+    path: `/api/agents/v1/jobs/${encodeURIComponent(opts.jobId)}`,
+    query: opts.waitSeconds && opts.waitSeconds > 0 ? { wait: opts.waitSeconds } : void 0,
+    responseSchema: GenerationResultSchema,
+    signal: opts.signal
+  });
+}
+
+// src/commands/generate/wait.ts
+var DEFAULT_WAIT_TIMEOUT_SECONDS = 120;
+var SERVER_LONG_POLL_SECONDS = 30;
+async function generateWait(opts) {
+  const client = opts.client ?? await buildGenerateClient(opts);
+  const timeoutSeconds = opts.timeoutSeconds ?? DEFAULT_WAIT_TIMEOUT_SECONDS;
+  return longPoll({
+    // Forward the iteration signal so the in-flight server hold is aborted
+    // as soon as the overall deadline expires — otherwise `--timeout 1` would
+    // still block for the full 30s server long-poll round.
+    fetcher: (args) => generateGet({
+      jobId: opts.jobId,
+      waitSeconds: SERVER_LONG_POLL_SECONDS,
+      client,
+      signal: args?.signal
+    }),
+    isTerminal: (r) => isTerminalStatus(r.status),
+    timeoutMs: timeoutSeconds * 1e3,
+    signal: opts.signal
+  });
+}
+
+// src/commands/generate/create.ts
+var PREFLIGHT_PLACEHOLDER_URL = "https://placeholder.invalid/pending-upload";
+async function generateCreate(opts) {
+  const client = opts.client ?? await buildGenerateClient(opts);
+  const preflightRefs = (opts.referenceImages ?? []).map(
+    (v) => isUrlLike(v) ? v : PREFLIGHT_PLACEHOLDER_URL
+  );
+  buildRequestBody({ ...opts, referenceImages: preflightRefs });
+  const referenceImages = await resolveReferenceImages({
+    items: opts.referenceImages ?? [],
+    client,
+    signal: opts.signal
+  });
+  const body = buildRequestBody({ ...opts, referenceImages });
+  const created = await client.request({
+    method: "POST",
+    path: "/api/agents/v1/jobs",
+    body,
+    responseSchema: GenerateCreateResponseSchema,
+    signal: opts.signal
+  });
+  const wait = opts.wait ?? true;
+  if (!wait) {
+    return projectCreateToResult(created, opts.modelSlug);
+  }
+  return generateWait({
+    jobId: created.jobId,
+    timeoutSeconds: opts.timeoutSeconds ?? DEFAULT_WAIT_TIMEOUT_SECONDS,
+    client,
+    signal: opts.signal
+  });
+}
+async function resolveReferenceImages(args) {
+  const out = [];
+  for (const item of args.items) {
+    if (isUrlLike(item)) {
+      out.push(item);
+      continue;
+    }
+    const uploaded = await uploadFile({
+      filePath: item,
+      scope: DEFAULT_UPLOAD_SCOPE,
+      client: args.client,
+      signal: args.signal
+    });
+    out.push(uploaded.publicUrl);
+  }
+  return out;
+}
+function buildRequestBody(args) {
+  const input = {};
+  if (args.prompt !== void 0) input.prompt = args.prompt;
+  if (args.referenceImages.length === 1) {
+    input.referenceImageUrl = args.referenceImages[0];
+  } else if (args.referenceImages.length > 1) {
+    input.referenceImages = args.referenceImages;
+  }
+  if (args.aspectRatio !== void 0) input.aspectRatio = args.aspectRatio;
+  if (args.resolution !== void 0) input.resolution = args.resolution;
+  if (args.durationSeconds !== void 0) input.durationSeconds = args.durationSeconds;
+  if (args.brandModel !== void 0) input.providerParams = { brandModelId: args.brandModel };
+  const body = {
+    modelSlug: args.modelSlug,
+    input
+  };
+  if (args.workflowId !== void 0 || args.nodeId !== void 0) {
+    const options = {};
+    if (args.workflowId !== void 0) options.workflowId = args.workflowId;
+    if (args.nodeId !== void 0) options.nodeId = args.nodeId;
+    body.options = options;
+  }
+  const parsed = GenerateCreateRequestSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new ApiError(
+      "INPUT_INVALID_FORMAT",
+      `Invalid generate create request: ${parsed.error.message}`,
+      { retryable: false }
+    );
+  }
+  return parsed.data;
+}
+function projectCreateToResult(response, modelSlug) {
+  return {
+    jobId: response.jobId,
+    status: response.status,
+    modelSlug,
+    resultUrl: null,
+    thumbnailUrl: null,
+    errorCode: null,
+    errorMessage: null,
+    creditsCharged: response.creditsCharged,
+    creditsRefunded: false,
+    startedAt: null,
+    completedAt: null
+  };
+}
+
+// src/auth/device-flow.ts
+import { setTimeout as delay } from "timers/promises";
+import { request } from "undici";
+var GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+async function runDeviceFlow(opts) {
+  throwIfCancelled(opts.signal);
+  const authResp = await requestDeviceAuthorization(opts);
+  const deadlineMs = Date.now() + authResp.expires_in * 1e3;
+  opts.onUserCode?.({
+    userCode: authResp.user_code,
+    verificationUri: authResp.verification_uri,
+    verificationUriComplete: authResp.verification_uri_complete ?? authResp.verification_uri,
+    expiresAt: new Date(deadlineMs)
+  });
+  let intervalSeconds = authResp.interval;
+  let iteration = 0;
+  let consecutiveNetworkFailures = 0;
+  const MAX_CONSECUTIVE_NETWORK_FAILURES = 5;
+  while (true) {
+    const sleepMs = Math.min(intervalSeconds * 1e3, deadlineMs - Date.now());
+    if (sleepMs <= 0) {
+      throw new AuthError(
+        "AUTH_DEVICE_CODE_EXPIRED",
+        `Device authorization expired after ${authResp.expires_in}s. Run \`clickraft login\` again.`
+      );
+    }
+    await abortableSleep(sleepMs, opts.signal);
+    throwIfCancelled(opts.signal);
+    if (Date.now() >= deadlineMs) {
+      throw new AuthError(
+        "AUTH_DEVICE_CODE_EXPIRED",
+        `Device authorization expired after ${authResp.expires_in}s. Run \`clickraft login\` again.`
+      );
+    }
+    iteration += 1;
+    const result = await pollToken({
+      apiBaseUrl: opts.apiBaseUrl,
+      clientId: opts.clientId,
+      deviceCode: authResp.device_code,
+      signal: opts.signal
+    });
+    if (result.kind === "success") {
+      return result.token;
+    }
+    if (result.kind === "pending") {
+      consecutiveNetworkFailures = 0;
+      opts.onPoll?.({ iteration, intervalSeconds, status: "pending" });
+      continue;
+    }
+    if (result.kind === "slow_down") {
+      consecutiveNetworkFailures = 0;
+      intervalSeconds *= 2;
+      opts.onPoll?.({ iteration, intervalSeconds, status: "slow_down" });
+      continue;
+    }
+    if (result.kind === "network_error") {
+      consecutiveNetworkFailures += 1;
+      if (consecutiveNetworkFailures >= MAX_CONSECUTIVE_NETWORK_FAILURES) {
+        throw new ApiError(
+          "NETWORK_ERROR",
+          `Network repeatedly failed during polling (${MAX_CONSECUTIVE_NETWORK_FAILURES} consecutive errors).`,
+          { retryable: true },
+          result.cause
+        );
+      }
+      intervalSeconds *= 2;
+      opts.onPoll?.({ iteration, intervalSeconds, status: "slow_down" });
+      continue;
+    }
+    throw result.error;
+  }
+}
+async function requestDeviceAuthorization(opts) {
+  const body = new URLSearchParams({ client_id: opts.clientId, scope: opts.scope }).toString();
+  let resp;
+  try {
+    resp = await request(`${opts.apiBaseUrl}/oauth/device-authorization`, {
+      method: "POST",
+      headers: { "content-type": FORM_CONTENT_TYPE },
+      body,
+      signal: opts.signal
+    });
+  } catch (err) {
+    if (isAbortError2(err) || opts.signal?.aborted) {
+      throw new AuthError(
+        "AUTH_FLOW_CANCELLED",
+        "Device flow cancelled during authorization request.",
+        err
+      );
+    }
+    throw new ApiError(
+      "NETWORK_ERROR",
+      `Network error contacting authorization endpoint: ${err.message}`,
+      { retryable: true },
+      err
+    );
+  }
+  const text = await resp.body.text();
+  if (resp.statusCode !== 200) {
+    const redacted = redactTokenLikeFields(truncate(text));
+    throw new AuthError(
+      "AUTH_TOKEN_INVALID",
+      `Authorization endpoint returned HTTP ${resp.statusCode}: ${redacted}`,
+      {
+        status: resp.statusCode,
+        redactedBody: redactTokenLikeFields(text),
+        headers: safeHeaders(resp.headers)
+      }
+    );
+  }
+  const parsed = parseJson(text, "authorization");
+  const validated = DeviceAuthorizationResponseSchema.safeParse(parsed);
+  if (!validated.success) {
+    throw new AuthError(
+      "AUTH_TOKEN_INVALID",
+      "Authorization endpoint response failed schema validation.",
+      validated.error
+    );
+  }
+  return validated.data;
+}
+var TRANSIENT_NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EAI_AGAIN",
+  "UND_ERR_SOCKET",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT"
+]);
+function isTransientNetworkError(err) {
+  const code = err.code;
+  return typeof code === "string" && TRANSIENT_NETWORK_CODES.has(code);
+}
+async function pollToken(args) {
+  const body = new URLSearchParams({
+    client_id: args.clientId,
+    device_code: args.deviceCode,
+    grant_type: GRANT_TYPE
+  }).toString();
+  let resp;
+  try {
+    resp = await request(`${args.apiBaseUrl}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": FORM_CONTENT_TYPE },
+      body,
+      signal: args.signal
+    });
+  } catch (err) {
+    if (isAbortError2(err) || args.signal?.aborted) {
+      return {
+        kind: "error",
+        error: new AuthError("AUTH_FLOW_CANCELLED", "Device flow cancelled mid-poll.", err)
+      };
+    }
+    if (isTransientNetworkError(err)) {
+      return { kind: "network_error", cause: err };
+    }
+    return {
+      kind: "error",
+      error: new ApiError(
+        "NETWORK_ERROR",
+        `Network error contacting token endpoint: ${err.message}`,
+        { retryable: true },
+        err
+      )
+    };
+  }
+  const text = await resp.body.text();
+  if (resp.statusCode === 200) {
+    return parseTokenSuccess(text);
+  }
+  if (resp.statusCode === 400) {
+    return parseTokenError(text);
+  }
+  return {
+    kind: "error",
+    error: new AuthError(
+      "AUTH_TOKEN_INVALID",
+      `Token endpoint returned unexpected HTTP ${resp.statusCode}: ${redactTokenLikeFields(truncate(text))}`,
+      {
+        status: resp.statusCode,
+        redactedBody: redactTokenLikeFields(text),
+        headers: safeHeaders(resp.headers)
+      }
+    )
+  };
+}
+function parseTokenSuccess(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    return {
+      kind: "error",
+      error: new AuthError("AUTH_TOKEN_INVALID", "Token endpoint returned invalid JSON.", err)
+    };
+  }
+  const validated = TokenResponseSchema.safeParse(parsed);
+  if (!validated.success) {
+    return {
+      kind: "error",
+      error: new AuthError(
+        "AUTH_TOKEN_INVALID",
+        "Token endpoint success response failed schema validation.",
+        validated.error
+      )
+    };
+  }
+  return { kind: "success", token: validated.data };
+}
+function parseTokenError(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    return {
+      kind: "error",
+      error: new AuthError("AUTH_TOKEN_INVALID", "Token error response was not valid JSON.", err)
+    };
+  }
+  const validated = DeviceTokenPollErrorSchema.safeParse(parsed);
+  if (!validated.success) {
+    return {
+      kind: "error",
+      error: new AuthError(
+        "AUTH_TOKEN_INVALID",
+        "Token error response failed schema validation.",
+        validated.error
+      )
+    };
+  }
+  const { error, error_description } = validated.data;
+  switch (error) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "access_denied":
+      return {
+        kind: "error",
+        error: new AuthError(
+          "AUTH_ACCESS_DENIED",
+          error_description ?? "User denied the device authorization request."
+        )
+      };
+    case "expired_token":
+      return {
+        kind: "error",
+        error: new AuthError(
+          "AUTH_DEVICE_CODE_EXPIRED",
+          error_description ?? "Device code has expired. Run `clickraft login` again."
+        )
+      };
+    default:
+      return {
+        kind: "error",
+        error: new AuthError(
+          "AUTH_TOKEN_INVALID",
+          `Token endpoint returned error: ${error}${error_description ? ` (${error_description})` : ""}`
+        )
+      };
+  }
+}
+async function abortableSleep(ms, signal) {
+  try {
+    await delay(ms, void 0, { signal });
+  } catch (err) {
+    if (isAbortError2(err)) {
+      throw new AuthError("AUTH_FLOW_CANCELLED", "Device flow cancelled while waiting.", err);
+    }
+    throw err;
+  }
+}
+function throwIfCancelled(signal) {
+  if (signal?.aborted) {
+    throw new AuthError("AUTH_FLOW_CANCELLED", "Device flow cancelled.");
+  }
+}
+function isAbortError2(err) {
+  if (err instanceof Error) {
+    if (err.name === "AbortError") return true;
+    if (err.code === "ABORT_ERR") return true;
+  }
+  return false;
+}
+function parseJson(text, label) {
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new AuthError(
+      "AUTH_TOKEN_INVALID",
+      `${label} endpoint returned invalid JSON: ${redactTokenLikeFields(truncate(text))}`,
+      err
+    );
+  }
+}
+function truncate(text, max = 200) {
+  return text.length > max ? `${text.slice(0, max)}...` : text;
+}
+function safeHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+
+// src/commands/login.ts
+var PLACEHOLDER_UUID = "00000000-0000-0000-0000-000000000000";
+var PLACEHOLDER_ORG_SLUG = "unknown";
+var CLIENT_ID = "clickraft-cli";
+var DEFAULT_SCOPES = [
+  "templates:read",
+  "generations:write",
+  "generations:read",
+  "workflows:write",
+  "workflows:read",
+  "brand-models:read",
+  "assets:write",
+  "balance:read"
+];
+async function login(options) {
+  const config = await loadConfig({
+    flagProfile: options.profile,
+    flagApiBaseUrl: options.apiBaseUrl,
+    credentialsPath: options.credentialsPath
+  });
+  const profileName = config.profileName || DEFAULT_PROFILE_NAME;
+  const apiBaseUrl = options.apiBaseUrl ?? config.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+  if (!options.forceReauth) {
+    const existing = await readCredentials(options.credentialsPath);
+    const profile2 = existing?.profiles[profileName];
+    if (profile2 && !isExpired(profile2.expiresAt)) {
+      throw new AuthError(
+        "AUTH_TOKEN_INVALID",
+        `Profile "${profileName}" is already logged in (token valid until ${profile2.expiresAt}). Pass --force-reauth to mint a new token.`
+      );
+    }
+  }
+  const scope = options.scope?.trim() || DEFAULT_SCOPES.join(" ");
+  const flow = options.runDeviceFlow ?? runDeviceFlow;
+  const token = await flow({
+    apiBaseUrl,
+    clientId: CLIENT_ID,
+    scope,
+    onUserCode: options.onUserCode,
+    onPoll: options.onPoll,
+    signal: options.signal
+  });
+  const profile = buildCredentialsProfile({ token, apiBaseUrl });
+  await setProfile(profileName, profile, options.credentialsPath);
+  return {
+    profileName,
+    tokenPrefix: profile.tokenPrefix,
+    expiresAt: profile.expiresAt,
+    scopes: profile.scopes,
+    identityKnown: false,
+    organizationId: profile.organizationId,
+    organizationSlug: profile.organizationSlug,
+    userId: profile.userId
+  };
+}
+function buildCredentialsProfile(args) {
+  const now = Date.now();
+  const issuedAt = new Date(now).toISOString();
+  const expiresAt = new Date(now + args.token.expires_in * 1e3).toISOString();
+  const tokenPrefix = args.token.access_token.slice(0, 12);
+  const scopes = args.token.scope.split(/\s+/).filter(Boolean);
+  return {
+    apiBaseUrl: args.apiBaseUrl,
+    accessToken: args.token.access_token,
+    tokenType: args.token.token_type,
+    tokenPrefix,
+    organizationId: PLACEHOLDER_UUID,
+    organizationSlug: PLACEHOLDER_ORG_SLUG,
+    userId: PLACEHOLDER_UUID,
+    scopes,
+    expiresAt,
+    issuedAt,
+    clientId: CLIENT_ID
+  };
+}
+function isExpired(expiresAt) {
+  const t = Date.parse(expiresAt);
+  if (Number.isNaN(t)) return true;
+  return t <= Date.now();
+}
+
+// src/commands/logout.ts
+async function logout(options) {
+  if (options.all) {
+    await deleteCredentials(options.credentialsPath);
+    return { profilesRemoved: ["*"], serverRevoked: false };
+  }
+  const config = await loadConfig({
+    flagProfile: options.profile,
+    credentialsPath: options.credentialsPath
+  });
+  const profileName = config.profileName || DEFAULT_PROFILE_NAME;
+  const file = await readCredentials(options.credentialsPath);
+  const profile = file?.profiles[profileName];
+  if (!profile) {
+    throw new CredentialsError(
+      "CREDENTIALS_PROFILE_NOT_FOUND",
+      `Profile "${profileName}" not found. Use \`clickraft logout --all\` to clear all credentials.`
+    );
+  }
+  let serverRevoked = false;
+  let revokeFailureMessage;
+  if (options.revoke) {
+    const factory = options.apiClientFactory ?? ((apiBaseUrl, accessToken) => new ApiClient({ apiBaseUrl, accessToken, signal: options.signal }));
+    const client = factory(profile.apiBaseUrl, profile.accessToken);
+    try {
+      await client.request({
+        method: "POST",
+        path: "/oauth/revoke",
+        body: { token: profile.accessToken }
+      });
+      serverRevoked = true;
+    } catch (err) {
+      revokeFailureMessage = formatRevokeFailure(err, profile.accessToken);
+      const sink = options.warn ?? ((line) => process.stderr.write(`${line}
+`));
+      sink(revokeFailureMessage);
+    }
+  }
+  await removeProfile(profileName, options.credentialsPath);
+  return {
+    profilesRemoved: [profileName],
+    serverRevoked,
+    ...revokeFailureMessage ? { revokeFailureMessage } : {}
+  };
+}
+function formatRevokeFailure(err, token) {
+  const reason = redactTokenLikeFields(err instanceof Error ? err.message : String(err));
+  return `warning: server-side revoke failed (${reason}). Local profile removed; token ${redactTokenLikeValue(token)} remains server-valid until expiry.`;
+}
+
+// src/telemetry/detect.ts
+var AGENT_SIGNALS = [
+  { envVar: "CLAUDE_CODE_SESSION_ID", agent: "claude-code" },
+  { envVar: "CLAUDECODE", agent: "claude-code" },
+  { envVar: "CURSOR_SESSION", agent: "cursor" },
+  { envVar: "CURSOR_TRACE_ID", agent: "cursor" },
+  { envVar: "OPENAI_CODEX_ENV", agent: "codex" },
+  { envVar: "CODEX_CLI", agent: "codex" },
+  { envVar: "CI", agent: "ci" }
+];
+function detectAgents(env = process.env) {
+  const detected = /* @__PURE__ */ new Set();
+  const signals = {};
+  for (const { envVar, agent } of AGENT_SIGNALS) {
+    const value = env[envVar];
+    if (value !== void 0 && value !== "" && value !== "0") {
+      detected.add(agent);
+      signals[envVar] = agent;
+    }
+  }
+  return { detected: [...detected].sort(), signals };
+}
+
+// src/commands/telemetry/inspect.ts
+function inspectTelemetry(options = {}) {
+  const env = options.env ?? process.env;
+  const optedOut = env[TELEMETRY_DISABLE_ENV_VAR] === "1" || env.DO_NOT_TRACK === "1";
+  const agents = detectAgents(env);
+  const crashSdkShipped = false;
+  const productSdkShipped = false;
+  return {
+    crashReports: {
+      enabled: false,
+      // SDK not shipped → not enabled regardless of opt-out flags
+      reason: optedOut ? "env-disabled" : "default",
+      sdkShipped: crashSdkShipped
+    },
+    productAnalytics: {
+      enabled: false,
+      reason: "opt-in-pending",
+      sdkShipped: productSdkShipped
+    },
+    agentDetection: {
+      enabled: agents.detected.length > 0,
+      signals: agents.signals,
+      detected: agents.detected
+    },
+    envOverrides: {
+      CLICKRAFT_DISABLE_TELEMETRY: env[TELEMETRY_DISABLE_ENV_VAR] === "1",
+      DO_NOT_TRACK: env.DO_NOT_TRACK === "1"
+    },
+    payloadShape: {
+      crashReports: {
+        event: "unhandled_exception",
+        error_type: "string",
+        error_message: "string (token-redacted)",
+        stack_redacted: "string",
+        cli_version: "string",
+        node_version: "string",
+        platform: "string",
+        agents_detected: "string[]"
+      },
+      productAnalytics: {
+        event: "command_completed",
+        command: 'string (e.g. "tokens.list")',
+        exit_code: "number",
+        duration_ms: "number",
+        cli_version: "string",
+        agents_detected: "string[]"
+      }
+    }
+  };
+}
+
+// src/commands/tokens/list.ts
+import { z as z6 } from "zod";
+var TokenRowSchema = z6.object({
+  id: z6.string(),
+  prefix: z6.string(),
+  name: z6.string().nullable(),
+  scopes: z6.array(z6.string()),
+  last_used_at: z6.string().nullable(),
+  expires_at: z6.string(),
+  created_at: z6.string()
+}).strict();
+var TokensListResponseSchema = z6.object({
+  items: z6.array(TokenRowSchema)
+}).strict();
+async function listTokens(options) {
+  const config = await loadConfig({
+    flagProfile: options.profile,
+    credentialsPath: options.credentialsPath
+  });
+  if (!config.accessToken) {
+    throw new AuthError("AUTH_TOKEN_MISSING", `Not authenticated. Run \`clickraft login\` first.`);
+  }
+  const factory = options.apiClientFactory ?? ((apiBaseUrl, accessToken) => new ApiClient({ apiBaseUrl, accessToken, signal: options.signal }));
+  const client = factory(config.apiBaseUrl, config.accessToken);
+  const data = await client.request({
+    method: "GET",
+    path: "/tokens",
+    responseSchema: TokensListResponseSchema,
+    signal: options.signal
+  });
+  return data.items;
+}
+
+// src/errors/format.ts
+var FALLBACK_HINT = "See `clickraft --help` or contact support.";
+function formatHumanError(err) {
+  const view = errorToView(err);
+  return [
+    `Error: ${view.message}`,
+    `Code: ${view.code}`,
+    `Try: ${view.hint}`,
+    `Request ID: ${view.requestId ?? "n/a"}`
+  ].join("\n");
+}
+function formatJsonError(err, ctx) {
+  return JSON.stringify(wrapError(err, ctx));
+}
+function errorToView(err) {
+  if (err instanceof ApiError) {
+    return {
+      code: toEnvelopeCode(err.code),
+      message: err.message,
+      hint: EXIT_CODE_MAP[err.code]?.hint ?? FALLBACK_HINT,
+      requestId: err.meta.requestId
+    };
+  }
+  if (err instanceof AuthError || err instanceof CredentialsError) {
+    const code = err.code;
+    return {
+      code: toEnvelopeCode(code),
+      message: err.message,
+      hint: EXIT_CODE_MAP[code]?.hint ?? FALLBACK_HINT
+    };
+  }
+  return {
+    code: toEnvelopeCode("INTERNAL_ERROR"),
+    message: err instanceof Error ? err.message : String(err),
+    hint: FALLBACK_HINT
+  };
+}
+
+// src/cli/args.ts
+var ArgError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ArgError";
+  }
+};
+function parseArgs(argv, spec) {
+  const result = {
+    positional: [],
+    string: {},
+    boolean: {},
+    array: {}
+  };
+  const stringFlags = new Set(spec.string ?? []);
+  const booleanFlags = new Set(spec.boolean ?? []);
+  const arrayFlags = new Set(spec.array ?? []);
+  const aliases = spec.aliases ?? {};
+  let i = 0;
+  let stopFlags = false;
+  while (i < argv.length) {
+    const raw = argv[i];
+    if (raw === void 0) {
+      i += 1;
+      continue;
+    }
+    if (stopFlags) {
+      result.positional.push(raw);
+      i += 1;
+      continue;
+    }
+    if (raw === "--") {
+      stopFlags = true;
+      i += 1;
+      continue;
+    }
+    if (!raw.startsWith("--")) {
+      result.positional.push(raw);
+      i += 1;
+      continue;
+    }
+    const eqIdx = raw.indexOf("=");
+    const flagToken = eqIdx >= 0 ? raw.slice(2, eqIdx) : raw.slice(2);
+    const inlineValue = eqIdx >= 0 ? raw.slice(eqIdx + 1) : void 0;
+    const canonical = resolveCanonical(flagToken, { booleanFlags, aliases });
+    if (booleanFlags.has(canonical)) {
+      if (inlineValue !== void 0) {
+        result.boolean[canonical] = parseBool(inlineValue);
+      } else if (flagToken.startsWith("no-") && booleanFlags.has(flagToken.slice(3))) {
+        result.boolean[flagToken.slice(3)] = false;
+      } else {
+        result.boolean[canonical] = true;
+      }
+      i += 1;
+      continue;
+    }
+    if (stringFlags.has(canonical) || arrayFlags.has(canonical)) {
+      let value;
+      if (inlineValue !== void 0) {
+        value = inlineValue;
+      } else {
+        const next = argv[i + 1];
+        if (next === void 0 || next.startsWith("--")) {
+          throw new ArgError(`Flag --${canonical} requires a value.`);
+        }
+        value = next;
+        i += 1;
+      }
+      if (arrayFlags.has(canonical)) {
+        const existing = result.array[canonical] ?? [];
+        existing.push(value);
+        result.array[canonical] = existing;
+      } else {
+        result.string[canonical] = value;
+      }
+      i += 1;
+      continue;
+    }
+    throw new ArgError(`Unknown flag --${flagToken}`);
+  }
+  return result;
+}
+function resolveCanonical(flagToken, ctx) {
+  if (ctx.aliases[flagToken]) return ctx.aliases[flagToken];
+  if (flagToken.startsWith("no-") && ctx.booleanFlags.has(flagToken.slice(3))) {
+    return flagToken.slice(3);
+  }
+  return flagToken;
+}
+function parseBool(value) {
+  if (value === "true" || value === "1") return true;
+  if (value === "false" || value === "0") return false;
+  throw new ArgError(`Expected boolean value (true/false), got "${value}".`);
+}
+
+// src/cli/parse-args.ts
+var SHORT_ALIASES = {
+  h: "help",
+  v: "version"
+};
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["profile", "api-base-url", "scope", "token"]);
+function parseArgs2(argv) {
+  const flags = {};
+  const positional = [];
+  const command = [];
+  let commandLocked = false;
+  let i = 0;
+  while (i < argv.length) {
+    const raw = argv[i];
+    if (raw === "--") {
+      for (let j = i + 1; j < argv.length; j += 1) positional.push(argv[j]);
+      break;
+    }
+    if (raw.startsWith("--")) {
+      const eq = raw.indexOf("=");
+      const name = eq === -1 ? raw.slice(2) : raw.slice(2, eq);
+      const inline = eq === -1 ? void 0 : raw.slice(eq + 1);
+      if (name.startsWith("no-")) {
+        flags[name.slice(3)] = false;
+        i += 1;
+        commandLocked = true;
+        continue;
+      }
+      if (VALUE_FLAGS.has(name)) {
+        if (inline !== void 0) {
+          flags[name] = inline;
+        } else {
+          const next = argv[i + 1];
+          if (next === void 0 || next.startsWith("-")) {
+            flags[name] = true;
+          } else {
+            flags[name] = next;
+            i += 1;
+          }
+        }
+      } else {
+        flags[name] = inline ?? true;
+      }
+      i += 1;
+      commandLocked = true;
+      continue;
+    }
+    if (raw.startsWith("-") && raw.length > 1) {
+      const short = raw.slice(1);
+      const aliased = SHORT_ALIASES[short];
+      if (aliased) {
+        flags[aliased] = true;
+        i += 1;
+        commandLocked = true;
+        continue;
+      }
+      positional.push(raw);
+      i += 1;
+      commandLocked = true;
+      continue;
+    }
+    if (!commandLocked) {
+      command.push(raw);
+    } else {
+      positional.push(raw);
+    }
+    i += 1;
+  }
+  return { command, flags, positional };
+}
+
+// src/cli/progress.ts
+import { spawn } from "child_process";
+function renderUserCodePrompt(info, stream = process.stderr) {
+  const lines = [
+    "",
+    "To complete login, visit:",
+    `  ${info.verificationUriComplete}`,
+    "",
+    `And enter the code:  ${info.userCode}`,
+    `Code expires at:     ${info.expiresAt.toISOString()}`,
+    ""
+  ];
+  stream.write(lines.join("\n"));
+}
+function openBrowser(url) {
+  if (!process.stderr.isTTY) return false;
+  const command = pickBrowserCommand();
+  if (!command) return false;
+  try {
+    const child = spawn(command.bin, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pickBrowserCommand() {
+  if (process.platform === "darwin") return { bin: "open", args: [] };
+  if (process.platform === "win32") return { bin: "cmd", args: ["/c", "start", ""] };
+  if (process.platform === "linux") return { bin: "xdg-open", args: [] };
+  return void 0;
+}
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var SPINNER_INTERVAL_MS = 80;
+function startPollingSpinner(label = "Waiting for authorization\u2026", stream = process.stderr) {
+  if (!stream.isTTY) {
+    return { stop() {
+    } };
+  }
+  let frame = 0;
+  const handle = setInterval(() => {
+    stream.write(`\r${SPINNER_FRAMES[frame]} ${label}`);
+    frame = (frame + 1) % SPINNER_FRAMES.length;
+  }, SPINNER_INTERVAL_MS);
+  return {
+    stop() {
+      clearInterval(handle);
+      stream.write(`\r${" ".repeat(label.length + 4)}\r`);
+    }
+  };
+}
+
+// src/cli/render.ts
+function renderLoginResult(result, out) {
+  const expiresHuman = formatExpiresAt(result.expiresAt);
+  const lines = [
+    `\u2713 Logged in (profile: ${result.profileName}).`,
+    `  Token prefix: ${result.tokenPrefix}`,
+    `  Expires:      ${expiresHuman}`,
+    `  Scopes:       ${result.scopes.join(" ")}`
+  ];
+  if (!result.identityKnown) {
+    lines.push(
+      `  Note:         Identity not populated (Wave 1 server-response gap, see PR description).`
+    );
+  }
+  out.write(lines.join("\n") + "\n");
+}
+function renderLogoutResult(result, out) {
+  if (result.profilesRemoved[0] === "*") {
+    out.write("\u2713 Removed all profiles.\n");
+    return;
+  }
+  const name = result.profilesRemoved[0] ?? "(unknown)";
+  if (result.serverRevoked) {
+    out.write(`\u2713 Logged out of profile "${name}" (server-side token revoked).
+`);
+  } else if (result.revokeFailureMessage) {
+    out.write(`\u2713 Logged out of profile "${name}" locally; server-side revoke failed.
+`);
+  } else {
+    out.write(`\u2713 Logged out of profile "${name}" (local only).
+`);
+  }
+}
+function renderTokensList(rows, out) {
+  if (rows.length === 0) {
+    out.write("No tokens.\n");
+    return;
+  }
+  const headers = ["PREFIX", "NAME", "SCOPES", "LAST USED", "EXPIRES"];
+  const data = rows.map((row) => [
+    row.prefix,
+    row.name ?? "\u2014",
+    row.scopes.join(",") || "\u2014",
+    row.last_used_at ?? "never",
+    row.expires_at
+  ]);
+  const widths = headers.map(
+    (header, i) => Math.max(header.length, ...data.map((cells) => cells[i].length))
+  );
+  const padRow = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd();
+  out.write(padRow(headers) + "\n");
+  for (const cells of data) out.write(padRow(cells) + "\n");
+}
+function renderTelemetryState(state, out) {
+  const crash = state.crashReports;
+  const product = state.productAnalytics;
+  const agents = state.agentDetection;
+  const lines = [
+    "Telemetry state:",
+    "",
+    `  Crash reports:      ${crash.enabled ? "ON" : "OFF"} (${crash.reason}${crash.sdkShipped ? "" : ", SDK not shipped"})`,
+    `  Product analytics:  ${product.enabled ? "ON" : "OFF"} (${product.reason}${product.sdkShipped ? "" : ", SDK not shipped"})`,
+    `  Agent detection:    ${agents.enabled ? "ON" : "OFF"}`,
+    `  Detected agents:    ${agents.detected.length === 0 ? "(none)" : agents.detected.join(", ")}`,
+    "",
+    "Env overrides:",
+    `  CLICKRAFT_DISABLE_TELEMETRY=${state.envOverrides.CLICKRAFT_DISABLE_TELEMETRY ? "1" : "0"}`,
+    `  DO_NOT_TRACK=${state.envOverrides.DO_NOT_TRACK ? "1" : "0"}`,
+    "",
+    "Payload shape (illustrative \u2014 no data is currently sent):",
+    `  ${JSON.stringify(state.payloadShape, null, 2).split("\n").join("\n  ")}`
+  ];
+  out.write(lines.join("\n") + "\n");
+}
+function formatExpiresAt(iso) {
+  const ms = Date.parse(iso);
+  if (Number.isNaN(ms)) return iso;
+  const date = new Date(ms);
+  const days = Math.round((ms - Date.now()) / (24 * 60 * 60 * 1e3));
+  return `${date.toISOString()} (~${days}d)`;
+}
+
+// src/cli/dispatch.ts
+async function dispatch(options) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  const newCmd = matchNewCommand(options.argv);
+  if (newCmd !== null) {
+    return runNewCommand(newCmd, options, stdout, stderr);
+  }
+  const parsed = parseArgs2(options.argv);
+  const jsonMode = parsed.flags.json === true;
+  if (parsed.flags.version === true) {
+    stdout.write(`${options.version}
+`);
+    return 0;
+  }
+  if (parsed.command.length === 0 || parsed.flags.help === true) {
+    if (parsed.command.length === 0) {
+      stdout.write(renderRootHelp(options.version));
+    } else {
+      stdout.write(renderCommandHelp(parsed.command));
+    }
+    return 0;
+  }
+  const commandName = parsed.command.join(".");
+  const ctx = {
+    startMs: Date.now(),
+    command: commandName,
+    version: options.version
+  };
+  try {
+    validateFlags(parsed);
+    return await runCommand(parsed, ctx, {
+      stdout,
+      stderr,
+      jsonMode,
+      version: options.version,
+      signal: options.signal,
+      uiHooks: options.uiHooks
+    });
+  } catch (err) {
+    if (isAbortedError(err, options.signal)) {
+      if (jsonMode) {
+        stdout.write(
+          formatJsonError(new AuthError("AUTH_FLOW_CANCELLED", "Cancelled."), ctx) + "\n"
+        );
+      } else {
+        stderr.write("Cancelled.\n");
+      }
+      return SIGINT_EXIT_CODE;
+    }
+    const code = extractCode(err);
+    if (jsonMode) {
+      stdout.write(formatJsonError(err, ctx) + "\n");
+    } else {
+      stderr.write(formatHumanError(err) + "\n");
+    }
+    return getExitCode(code);
+  }
+}
+async function runCommand(parsed, ctx, rc) {
+  const path = parsed.command.join(".");
+  switch (path) {
+    case "login": {
+      const result = await loginCommand(parsed, rc);
+      emit(result, renderLoginResult, ctx, rc);
+      return 0;
+    }
+    case "logout": {
+      const result = await logoutCommand(parsed, rc);
+      emit(result, renderLogoutResult, ctx, rc);
+      return 0;
+    }
+    case "tokens.list": {
+      const rows = await listTokens({
+        profile: stringFlag(parsed.flags.profile),
+        signal: rc.signal
+      });
+      emit(rows, renderTokensList, ctx, rc);
+      return 0;
+    }
+    case "telemetry.inspect": {
+      const state = inspectTelemetry();
+      emit(state, renderTelemetryState, ctx, rc);
+      return 0;
+    }
+    default:
+      throw new ApiError(
+        "INPUT_INVALID_FORMAT",
+        `Unknown command: ${parsed.command.join(" ")}. Run \`clickraft --help\` for available commands.`,
+        { retryable: false }
+      );
+  }
+}
+async function loginCommand(parsed, rc) {
+  const noOpen = parsed.flags["open-browser"] === false;
+  let spinner;
+  try {
+    return await login({
+      profile: stringFlag(parsed.flags.profile),
+      apiBaseUrl: stringFlag(parsed.flags["api-base-url"]),
+      scope: stringFlag(parsed.flags.scope),
+      forceReauth: parsed.flags["force-reauth"] === true,
+      openBrowser: !noOpen,
+      signal: rc.signal,
+      onUserCode: (info) => {
+        if (rc.uiHooks?.onUserCode) {
+          rc.uiHooks.onUserCode(info);
+          return;
+        }
+        if (!rc.jsonMode) {
+          renderUserCodePrompt(info, rc.stderr);
+          if (!noOpen) openBrowser(info.verificationUriComplete);
+          spinner = startPollingSpinner(void 0, rc.stderr);
+        }
+      },
+      onPoll: () => {
+        rc.uiHooks?.onPoll?.();
+      }
+    });
+  } finally {
+    spinner?.stop();
+  }
+}
+async function logoutCommand(parsed, rc) {
+  return logout({
+    profile: stringFlag(parsed.flags.profile),
+    all: parsed.flags.all === true,
+    revoke: parsed.flags.revoke !== false,
+    signal: rc.signal,
+    warn: rc.jsonMode ? () => {
+    } : void 0
+  });
+}
+function emit(result, human, ctx, rc) {
+  if (rc.signal?.aborted) {
+    throw new AuthError("AUTH_FLOW_CANCELLED", "Cancelled.");
+  }
+  if (rc.jsonMode) {
+    rc.stdout.write(JSON.stringify(wrapSuccess(result, ctx)) + "\n");
+    return;
+  }
+  human(result, rc.stdout);
+}
+function stringFlag(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+var COMMAND_FLAGS = {
+  login: {
+    profile: "string",
+    "api-base-url": "string",
+    scope: "string",
+    "force-reauth": "boolean",
+    "open-browser": "boolean",
+    json: "boolean"
+  },
+  logout: { profile: "string", all: "boolean", revoke: "boolean", json: "boolean" },
+  "tokens.list": { profile: "string", json: "boolean" },
+  "telemetry.inspect": { json: "boolean" }
+};
+function validateFlags(parsed) {
+  const allowed = COMMAND_FLAGS[parsed.command.join(".")];
+  if (!allowed) return;
+  for (const [name, value] of Object.entries(parsed.flags)) {
+    const kind = allowed[name];
+    if (!kind) {
+      throw new ApiError("INPUT_INVALID_FORMAT", `Unknown flag: --${name}.`, { retryable: false });
+    }
+    if (kind === "string" && typeof value !== "string") {
+      throw new ApiError("INPUT_INVALID_FORMAT", `Flag --${name} requires a value.`, {
+        retryable: false
+      });
+    }
+  }
+}
+function isAbortedError(err, signal) {
+  if (signal?.aborted) return true;
+  if (err instanceof AuthError && err.code === "AUTH_FLOW_CANCELLED") return true;
+  return false;
+}
+function extractCode(err) {
+  if (err && typeof err === "object" && "code" in err) {
+    const code = err.code;
+    if (typeof code === "string" && code in EXIT_CODE_MAP) {
+      return code;
+    }
+  }
+  return "INTERNAL_ERROR";
+}
+function renderRootHelp(version) {
+  return [
+    `clickraft v${version} \u2014 the Clickraft CLI`,
+    "",
+    "Usage: clickraft <command> [options]",
+    "",
+    "Commands:",
+    "  login                   Authenticate via OAuth device flow",
+    "  logout                  Remove credentials (optional server-side revoke)",
+    "  tokens list             List the caller's API tokens",
+    "  telemetry inspect       Show current telemetry state and payload shape",
+    "  generate create         Submit a generation job and wait for completion",
+    "  generate wait           Wait for an existing job to reach a terminal state",
+    "  generate get            Fetch the current state of a job",
+    "  jobs wait               Alias of `generate wait`",
+    "  upload <file>           Upload a local file and return its public URL",
+    "",
+    "Options:",
+    "  -v, --version           Show version",
+    "  -h, --help              Show help",
+    "      --json              Emit JSON envelope instead of human output",
+    ""
+  ].join("\n");
+}
+function renderCommandHelp(command) {
+  const path = command.join(" ");
+  switch (path) {
+    case "login":
+      return [
+        "Usage: clickraft login [options]",
+        "",
+        "Options:",
+        '  --profile <name>          Write to a specific profile (default: "default")',
+        "  --api-base-url <url>      Override the API base URL",
+        "  --scope <s>               Space-separated scope list (default: all 8)",
+        "  --force-reauth            Re-authenticate even if a valid token exists",
+        "  --no-open-browser         Do not auto-open the verification URL",
+        "  --json                    Emit JSON envelope instead of human output",
+        ""
+      ].join("\n");
+    case "logout":
+      return [
+        "Usage: clickraft logout [options]",
+        "",
+        "Options:",
+        '  --profile <name>   Remove a specific profile (default: "default")',
+        "  --all              Remove every profile (delete the credentials file)",
+        "  --no-revoke        Skip the server-side revoke call",
+        "  --json             Emit JSON envelope instead of human output",
+        ""
+      ].join("\n");
+    case "tokens list":
+      return [
+        "Usage: clickraft tokens list [options]",
+        "",
+        "Options:",
+        "  --profile <name>   Read credentials from a specific profile",
+        "  --json             Emit JSON envelope instead of human output",
+        ""
+      ].join("\n");
+    case "telemetry inspect":
+      return [
+        "Usage: clickraft telemetry inspect [options]",
+        "",
+        "Options:",
+        "  --json             Emit JSON envelope instead of human output",
+        ""
+      ].join("\n");
+    case "generate":
+      return [
+        "Usage: clickraft generate <subcommand> [options]",
+        "",
+        "Subcommands:",
+        "  create  Submit a generation job (waits for completion by default)",
+        "  wait    Long-poll an existing job until terminal",
+        "  get     Fetch the current state of a job (no polling)",
+        ""
+      ].join("\n");
+    case "generate create":
+      return [
+        "Usage: clickraft generate create [prompt] --model-slug <slug> [options]",
+        "",
+        "Submits a generation job. By default the command waits up to 120s for the",
+        "job to reach a terminal state via the server long-poll (?wait=30) rounds.",
+        "",
+        "Options:",
+        "  --prompt <text>           Text prompt (or pass as the positional argument)",
+        "  --model-slug <slug>       Required model identifier",
+        "  --brand-model <id>        Optional Brand Model reference",
+        "  --reference-image <v>     URL or local path (repeatable, max 8)",
+        "  --aspect-ratio <a:b>      e.g. 16:9",
+        "  --resolution <WxH>        e.g. 1024x768",
+        "  --duration-seconds <n>    For video/audio models (1-60)",
+        "  --workflow-id <uuid>      Attach to an existing workflow",
+        "  --node-id <id>            Attach to a specific node",
+        "  --no-wait, --async        Return immediately with the jobId",
+        "  --timeout <seconds>       Override the 120s default wait",
+        "  --profile <name>          Credentials profile name",
+        "  --api-base-url <url>      Override the API base URL",
+        "  --token <token>           Override the access token",
+        "  --json                    Emit a JSON envelope instead of human output",
+        "  -h, --help                Show help",
+        ""
+      ].join("\n");
+    case "generate wait":
+      return [
+        "Usage: clickraft generate wait <jobId> [options]",
+        "",
+        "Long-polls an existing job until it reaches a terminal state (completed,",
+        "failed, or cancelled) or the timeout elapses.",
+        "",
+        "Options:",
+        "  --timeout <seconds>   Overall wait deadline (default: 120)",
+        "  --profile <name>",
+        "  --api-base-url <url>",
+        "  --token <token>",
+        "  --json",
+        ""
+      ].join("\n");
+    case "generate get":
+      return [
+        "Usage: clickraft generate get <jobId> [options]",
+        "",
+        "Fetches the current state of a generation job without polling.",
+        "",
+        "Options:",
+        "  --profile <name>",
+        "  --api-base-url <url>",
+        "  --token <token>",
+        "  --json",
+        ""
+      ].join("\n");
+    case "jobs":
+      return [
+        "Usage: clickraft jobs <subcommand> [options]",
+        "",
+        "Subcommands:",
+        "  wait  Long-poll a job until terminal (alias of `generate wait`)",
+        ""
+      ].join("\n");
+    case "jobs wait":
+      return [
+        "Usage: clickraft jobs wait <jobId> [options]",
+        "",
+        "Alias of `clickraft generate wait`. See `clickraft generate wait --help`.",
+        ""
+      ].join("\n");
+    case "upload":
+      return [
+        "Usage: clickraft upload <file-path> [options]",
+        "",
+        "Uploads a local file (up to 15MB) to the Agents API. The CLI computes a",
+        "sha256 of the contents and uses it as the idempotency key, so uploading",
+        "the same file twice within the same scope reuses the original asset.",
+        "",
+        "Options:",
+        "  --scope <name>        Namespace for idempotency dedup (default: user-uploads)",
+        "  --profile <name>",
+        "  --api-base-url <url>",
+        "  --token <token>",
+        "  --json",
+        ""
+      ].join("\n");
+    default:
+      return `Unknown command: ${path}
+Run \`clickraft --help\` for available commands.
+`;
+  }
+}
+function matchNewCommand(argv) {
+  if (argv.length === 0) return null;
+  const verb = argv[0];
+  if (verb === "upload") {
+    return { kind: "cmd", path: "upload", verbTokenCount: 1 };
+  }
+  if (verb === "generate") {
+    const sub = argv[1];
+    if (sub === "create") return { kind: "cmd", path: "generate.create", verbTokenCount: 2 };
+    if (sub === "wait") return { kind: "cmd", path: "generate.wait", verbTokenCount: 2 };
+    if (sub === "get") return { kind: "cmd", path: "generate.get", verbTokenCount: 2 };
+    if (sub === void 0 || sub.startsWith("-")) return { kind: "sub-help", verb: "generate" };
+    return { kind: "unknown-sub", verb: "generate", sub };
+  }
+  if (verb === "jobs") {
+    const sub = argv[1];
+    if (sub === "wait") return { kind: "cmd", path: "jobs.wait", verbTokenCount: 2 };
+    if (sub === void 0 || sub.startsWith("-")) return { kind: "sub-help", verb: "jobs" };
+    return { kind: "unknown-sub", verb: "jobs", sub };
+  }
+  return null;
+}
+async function runNewCommand(newCmd, options, stdout, stderr) {
+  if (newCmd.kind === "sub-help") {
+    stdout.write(renderCommandHelp([newCmd.verb]));
+    return 0;
+  }
+  if (newCmd.kind === "unknown-sub") {
+    const err = new ApiError(
+      "INPUT_INVALID_FORMAT",
+      `Unknown ${newCmd.verb} subcommand: ${newCmd.sub}. Run \`clickraft ${newCmd.verb} --help\` for available subcommands.`,
+      { retryable: false }
+    );
+    const ctx2 = {
+      startMs: Date.now(),
+      command: newCmd.verb,
+      version: options.version
+    };
+    if (options.argv.includes("--json")) {
+      stdout.write(formatJsonError(err, ctx2) + "\n");
+    } else {
+      stderr.write(formatHumanError(err) + "\n");
+    }
+    return 2;
+  }
+  const path = newCmd.path;
+  const argvAfterVerb = options.argv.slice(newCmd.verbTokenCount);
+  const jsonMode = argvAfterVerb.includes("--json");
+  if (argvAfterVerb.includes("--help") || argvAfterVerb.includes("-h")) {
+    stdout.write(renderCommandHelp(path.split(".")));
+    return 0;
+  }
+  const ctx = {
+    startMs: Date.now(),
+    command: path,
+    version: options.version
+  };
+  const rc = { stdout, stderr, jsonMode, signal: options.signal };
+  try {
+    switch (path) {
+      case "generate.create":
+        return await runGenerateCreate(argvAfterVerb, ctx, rc);
+      case "generate.wait":
+        return await runGenerateWait(argvAfterVerb, ctx, rc);
+      case "generate.get":
+        return await runGenerateGet(argvAfterVerb, ctx, rc);
+      case "jobs.wait":
+        return await runJobsWait(argvAfterVerb, ctx, rc);
+      case "upload":
+        return await runUploadCmd(argvAfterVerb, ctx, rc);
+    }
+  } catch (err) {
+    if (isAbortedError(err, options.signal)) {
+      if (jsonMode) {
+        stdout.write(
+          formatJsonError(new AuthError("AUTH_FLOW_CANCELLED", "Cancelled."), ctx) + "\n"
+        );
+      } else {
+        stderr.write("Cancelled.\n");
+      }
+      return SIGINT_EXIT_CODE;
+    }
+    const mapped = err instanceof ArgError ? new ApiError("INPUT_INVALID_FORMAT", err.message, { retryable: false }) : err;
+    const code = extractCode(mapped);
+    if (jsonMode) {
+      stdout.write(formatJsonError(mapped, ctx) + "\n");
+    } else {
+      stderr.write(formatHumanError(mapped) + "\n");
+    }
+    return getExitCode(code);
+  }
+}
+var COMMON_RICH_STRING_FLAGS = ["profile", "api-base-url", "token"];
+var COMMON_RICH_BOOL_FLAGS = ["json", "help"];
+async function runGenerateCreate(argv, ctx, rc) {
+  const parsed = parseArgs(argv, {
+    string: [
+      ...COMMON_RICH_STRING_FLAGS,
+      "prompt",
+      "model-slug",
+      "brand-model",
+      "aspect-ratio",
+      "resolution",
+      "duration-seconds",
+      "workflow-id",
+      "node-id",
+      "timeout"
+    ],
+    boolean: [...COMMON_RICH_BOOL_FLAGS, "wait", "async"],
+    array: ["reference-image"]
+  });
+  const modelSlug = parsed.string["model-slug"];
+  if (!modelSlug) throw new ArgError("--model-slug is required.");
+  const result = await generateCreate({
+    prompt: parsed.string.prompt ?? parsed.positional[0],
+    modelSlug,
+    referenceImages: parsed.array["reference-image"],
+    aspectRatio: parsed.string["aspect-ratio"],
+    resolution: parsed.string.resolution,
+    durationSeconds: optionalInt(parsed.string["duration-seconds"], "duration-seconds"),
+    brandModel: parsed.string["brand-model"],
+    workflowId: parsed.string["workflow-id"],
+    nodeId: parsed.string["node-id"],
+    wait: computeWaitFlag(parsed),
+    timeoutSeconds: optionalInt(parsed.string.timeout, "timeout"),
+    profile: parsed.string.profile,
+    apiBaseUrl: parsed.string["api-base-url"],
+    token: parsed.string.token,
+    signal: rc.signal
+  });
+  emitJob(result, ctx, rc);
+  return exitCodeForResult(result);
+}
+async function runGenerateWait(argv, ctx, rc) {
+  const parsed = parseArgs(argv, {
+    string: [...COMMON_RICH_STRING_FLAGS, "timeout"],
+    boolean: [...COMMON_RICH_BOOL_FLAGS]
+  });
+  const jobId = parsed.positional[0];
+  if (!jobId) throw new ArgError("Missing required <jobId> argument.");
+  const result = await generateWait({
+    jobId,
+    timeoutSeconds: optionalInt(parsed.string.timeout, "timeout"),
+    profile: parsed.string.profile,
+    apiBaseUrl: parsed.string["api-base-url"],
+    token: parsed.string.token,
+    signal: rc.signal
+  });
+  emitJob(result, ctx, rc);
+  return exitCodeForResult(result);
+}
+async function runGenerateGet(argv, ctx, rc) {
+  const parsed = parseArgs(argv, {
+    string: [...COMMON_RICH_STRING_FLAGS],
+    boolean: [...COMMON_RICH_BOOL_FLAGS]
+  });
+  const jobId = parsed.positional[0];
+  if (!jobId) throw new ArgError("Missing required <jobId> argument.");
+  const result = await generateGet({
+    jobId,
+    profile: parsed.string.profile,
+    apiBaseUrl: parsed.string["api-base-url"],
+    token: parsed.string.token,
+    signal: rc.signal
+  });
+  emitJob(result, ctx, rc);
+  return exitCodeForResult(result);
+}
+async function runJobsWait(argv, ctx, rc) {
+  const parsed = parseArgs(argv, {
+    string: [...COMMON_RICH_STRING_FLAGS, "timeout"],
+    boolean: [...COMMON_RICH_BOOL_FLAGS]
+  });
+  const jobId = parsed.positional[0];
+  if (!jobId) throw new ArgError("Missing required <jobId> argument.");
+  const result = await generateWait({
+    jobId,
+    timeoutSeconds: optionalInt(parsed.string.timeout, "timeout"),
+    profile: parsed.string.profile,
+    apiBaseUrl: parsed.string["api-base-url"],
+    token: parsed.string.token,
+    signal: rc.signal
+  });
+  emitJob(result, ctx, rc);
+  return exitCodeForResult(result);
+}
+async function runUploadCmd(argv, ctx, rc) {
+  const parsed = parseArgs(argv, {
+    string: [...COMMON_RICH_STRING_FLAGS, "scope"],
+    boolean: [...COMMON_RICH_BOOL_FLAGS]
+  });
+  const filePath = parsed.positional[0];
+  if (!filePath) throw new ArgError("Missing required <file-path> argument.");
+  const result = await uploadFile({
+    filePath,
+    scope: parsed.string.scope,
+    profile: parsed.string.profile,
+    apiBaseUrl: parsed.string["api-base-url"],
+    token: parsed.string.token,
+    signal: rc.signal
+  });
+  emitUpload(result, ctx, rc);
+  return 0;
+}
+function emitJob(result, ctx, rc) {
+  if (rc.signal?.aborted) {
+    throw new AuthError("AUTH_FLOW_CANCELLED", "Cancelled.");
+  }
+  if (rc.jsonMode) {
+    rc.stdout.write(JSON.stringify(wrapSuccess(result, ctx)) + "\n");
+    return;
+  }
+  rc.stdout.write(renderGenerationResult(result) + "\n");
+}
+function emitUpload(result, ctx, rc) {
+  if (rc.signal?.aborted) {
+    throw new AuthError("AUTH_FLOW_CANCELLED", "Cancelled.");
+  }
+  if (rc.jsonMode) {
+    rc.stdout.write(JSON.stringify(wrapSuccess(result, ctx)) + "\n");
+    return;
+  }
+  rc.stdout.write(renderUploadResult(result) + "\n");
+}
+function renderGenerationResult(r) {
+  const lines = [`Job ID: ${r.jobId}`, `Status: ${r.status}`, `Model: ${r.modelSlug}`];
+  if (r.resultUrl) lines.push(`Result URL: ${r.resultUrl}`);
+  if (r.thumbnailUrl) lines.push(`Thumbnail: ${r.thumbnailUrl}`);
+  lines.push(`Credits charged: ${r.creditsCharged}`);
+  if (r.creditsRefunded) lines.push("Credits refunded: yes");
+  if (r.errorCode || r.errorMessage) {
+    lines.push(`Error: ${r.errorCode ?? "unknown"}${r.errorMessage ? ` \u2014 ${r.errorMessage}` : ""}`);
+  }
+  return lines.join("\n");
+}
+function renderUploadResult(r) {
+  return [
+    `Uploaded: ${r.publicUrl}`,
+    `Asset ID: ${r.assetId}`,
+    `Bytes: ${r.bytes}`,
+    `Deduplicated: ${r.deduplicated}`
+  ].join("\n");
+}
+function computeWaitFlag(parsed) {
+  if (typeof parsed.boolean.wait === "boolean") return parsed.boolean.wait;
+  if (parsed.boolean.async === true) return false;
+  return true;
+}
+function optionalInt(value, label) {
+  if (value === void 0) return void 0;
+  const n = Number.parseInt(value, 10);
+  if (!Number.isFinite(n) || n < 0 || String(n) !== value) {
+    throw new ArgError(`--${label} must be a non-negative integer.`);
+  }
+  return n;
+}
+function exitCodeForResult(result) {
+  if (result.status === "completed") return 0;
+  if (result.status === "failed" || result.status === "cancelled") {
+    if (result.errorCode) return getExitCode(result.errorCode);
+    return 1;
+  }
+  return 0;
+}
+
+// src/index.ts
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = dirname2(__filename2);
+var pkg = JSON.parse(readFileSync(join2(__dirname2, "..", "package.json"), "utf8"));
+async function run(args, signal) {
+  return dispatch({
+    argv: args,
+    version: pkg.version,
+    signal
+  });
+}
+
+// src/cli.ts
+var controller = new AbortController();
+var sigintCount = 0;
+var onSigint = () => {
+  sigintCount += 1;
+  controller.abort();
+  if (sigintCount >= 2) process.exit(130);
+};
+process.on("SIGINT", onSigint);
+process.on("SIGTERM", onSigint);
+run(process.argv.slice(2), controller.signal).then((exitCode) => {
+  process.exit(exitCode);
+}).catch((error) => {
+  process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map