@crabcloud/cli 0.3.0 → 0.5.0

package/dist/crab.js

@@ -2390,6 +2390,89 @@ var $ZodUnion = /* @__PURE__ */ $constructor("$ZodUnion", (inst, def) => {
     });
   };
 });
+function discriminatorMap(def) {
+  const map = new Map;
+  for (const option of def.options) {
+    const values = option._zod.propValues?.[def.discriminator];
+    if (!values || values.size === 0)
+      throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(option)}"`);
+    for (const value of values) {
+      if (map.has(value)) {
+        if (value !== undefined)
+          throw new Error(`Duplicate discriminator value "${String(value)}"`);
+        map.set(value, null);
+      } else {
+        map.set(value, option);
+      }
+    }
+  }
+  return map;
+}
+var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnion", (inst, def) => {
+  def.inclusive = false;
+  $ZodUnion.init(inst, def);
+  const _super = inst._zod.parse;
+  defineLazyInternal(inst, "propValues", (zod) => {
+    const propValues = {};
+    let undefinedCount = 0;
+    for (const option of zod.def.options) {
+      const pv = option._zod.propValues;
+      if (!pv || Object.keys(pv).length === 0)
+        throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option)}"`);
+      if (pv[zod.def.discriminator]?.has(undefined))
+        undefinedCount++;
+      for (const [k, v] of Object.entries(pv)) {
+        if (!Object.prototype.hasOwnProperty.call(propValues, k)) {
+          assignProp(propValues, k, new Set);
+        }
+        for (const val of v) {
+          propValues[k].add(val);
+        }
+      }
+    }
+    if (!zod.def.unionFallback && undefinedCount > 1)
+      propValues[zod.def.discriminator]?.delete(undefined);
+    return propValues;
+  });
+  def.options.forEach((option, i) => {
+    const propShape = rawShape(option._zod.def);
+    if (propShape && !Object.prototype.hasOwnProperty.call(propShape, def.discriminator)) {
+      throw new Error(`Invalid discriminated union option at index "${i}"`);
+    }
+  });
+  const disc = cached(() => discriminatorMap(def));
+  inst._zod.parse = (payload, ctx) => {
+    const input = payload.value;
+    if (!isObject(input)) {
+      payload.issues.push({
+        code: "invalid_type",
+        expected: "object",
+        input,
+        inst
+      });
+      return payload;
+    }
+    const value = input?.[def.discriminator];
+    const opt = disc.value.get(value);
+    if (opt && (value !== undefined || ctx.direction !== "backward")) {
+      return opt._zod.run(payload, ctx);
+    }
+    if (def.unionFallback || ctx.direction === "backward") {
+      return _super(payload, ctx);
+    }
+    payload.issues.push({
+      code: "invalid_union",
+      errors: [],
+      note: "No matching discriminator",
+      discriminator: def.discriminator,
+      options: Array.from(disc.value.keys()).filter((value) => disc.value.get(value) !== null),
+      input,
+      path: [def.discriminator],
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodIntersection = /* @__PURE__ */ $constructor("$ZodIntersection", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload, ctx) => {
@@ -2682,6 +2765,28 @@ var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
     return payload;
   };
 });
+var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
+  $ZodType.init(inst, def);
+  const values = new Set(def.values);
+  inst._zod.values = values;
+  defineLazyInternal(inst, "pattern", (zod) => {
+    const vals = zod.def.values;
+    return new RegExp(vals.length ? `^(${vals.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$` : "^[^\\s\\S]$");
+  });
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (values.has(input)) {
+      return payload;
+    }
+    payload.issues.push({
+      code: "invalid_value",
+      values: def.values,
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodTransform = /* @__PURE__ */ $constructor("$ZodTransform", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.optin = "optional";
@@ -2883,6 +2988,9 @@ function handlePipeResult(left, next, ctx) {
   }
   return next._zod.run({ value: left.value, issues: left.issues }, ctx);
 }
+var $ZodPreprocess = /* @__PURE__ */ $constructor("$ZodPreprocess", (inst, def) => {
+  $ZodPipe.init(inst, def);
+});
 var $ZodReadonly = /* @__PURE__ */ $constructor("$ZodReadonly", (inst, def) => {
   $ZodType.init(inst, def);
   defineLazyInternal(inst, "propValues", (zod) => zod.def.innerType._zod.propValues);
@@ -4587,6 +4695,45 @@ var enumProcessor = (schema, _ctx, json, _params) => {
     json.type = "string";
   json.enum = values;
 };
+var literalProcessor = (schema, ctx, json, params) => {
+  const def = schema._zod.def;
+  if (def.values.length === 0) {
+    json.not = {};
+    return;
+  }
+  const vals = [];
+  for (const val of def.values) {
+    if (val === undefined) {
+      if (handleUnrepresentable(schema, ctx, json, params, "Literal `undefined` cannot be represented in JSON Schema"))
+        return;
+    } else if (typeof val === "bigint") {
+      if (handleUnrepresentable(schema, ctx, json, params, "BigInt literals cannot be represented in JSON Schema"))
+        return;
+      vals.push(Number(val));
+    } else {
+      vals.push(val);
+    }
+  }
+  if (vals.length === 0) {} else if (vals.length === 1) {
+    const val = vals[0];
+    json.type = val === null ? "null" : typeof val;
+    if (ctx.target === "draft-04" || ctx.target === "openapi-3.0") {
+      json.enum = [val];
+    } else {
+      json.const = val;
+    }
+  } else {
+    if (vals.every((v) => typeof v === "number"))
+      json.type = "number";
+    if (vals.every((v) => typeof v === "string"))
+      json.type = "string";
+    if (vals.every((v) => typeof v === "boolean"))
+      json.type = "boolean";
+    if (vals.every((v) => v === null))
+      json.type = "null";
+    json.enum = vals;
+  }
+};
 var customProcessor = (schema, ctx, json, params) => {
   handleUnrepresentable(schema, ctx, json, params, "Custom types cannot be represented in JSON Schema");
 };
@@ -5618,6 +5765,18 @@ function union(options, params) {
     ...normalizeParams(params)
   });
 }
+var ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("ZodDiscriminatedUnion", (inst, def) => {
+  ZodUnion.init(inst, def);
+  $ZodDiscriminatedUnion.init(inst, def);
+});
+function discriminatedUnion(discriminator, options, params) {
+  return new ZodDiscriminatedUnion({
+    type: "union",
+    options,
+    discriminator,
+    ...normalizeParams(params)
+  });
+}
 var ZodIntersection = /* @__PURE__ */ $constructor("ZodIntersection", (inst, def) => {
   $ZodIntersection.init(inst, def);
   ZodType.init(inst, def);
@@ -5700,6 +5859,27 @@ function _enum(values, params) {
     ...normalizeParams(params)
   });
 }
+var ZodLiteral = /* @__PURE__ */ $constructor("ZodLiteral", (inst, def) => {
+  $ZodLiteral.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => literalProcessor(inst, ctx, json, params);
+  inst.values = new Set(def.values);
+  Object.defineProperty(inst, "value", {
+    get() {
+      if (def.values.length > 1) {
+        throw new Error("This schema contains multiple valid literal values. Use `.values` instead.");
+      }
+      return def.values[0];
+    }
+  });
+});
+function literal(value, params) {
+  return new ZodLiteral({
+    type: "literal",
+    values: Array.isArray(value) ? value : [value],
+    ...normalizeParams(params)
+  });
+}
 var ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
   _ensureDefaultMemoizer();
   $ZodTransform.init(inst, def);
@@ -5848,6 +6028,10 @@ function pipe(in_, out) {
     out
   });
 }
+var ZodPreprocess = /* @__PURE__ */ $constructor("ZodPreprocess", (inst, def) => {
+  ZodPipe.init(inst, def);
+  $ZodPreprocess.init(inst, def);
+});
 var ZodReadonly = /* @__PURE__ */ $constructor("ZodReadonly", (inst, def) => {
   $ZodReadonly.init(inst, def);
   ZodType.init(inst, def);
@@ -5871,6 +6055,13 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
   return _superRefine(fn, params);
 }
+function preprocess(fn, schema) {
+  return new ZodPreprocess({
+    type: "pipe",
+    in: transform(fn),
+    out: schema
+  });
+}
 // ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/classic/coerce.js
 var exports_coerce = {};
 __export(exports_coerce, {
@@ -5895,6 +6086,298 @@ function bigint2(params) {
 function date2(params) {
   return _coercedDate(ZodDate, params);
 }
+// ../../packages/contracts/src/shop.ts
+var SHOP_PERMISSIONS = ["products", "orders", "aftercare", "customers", "marketing", "finance", "team", "settings"];
+var shopCategoryMoveInput = object({
+  direction: _enum(["up", "down"])
+});
+var shopSpecGroupCreateInput = object({
+  name: string2().trim().min(1).max(30),
+  values: array(string2().trim().min(1).max(60)).min(1).max(20)
+});
+var shopSpecGroupUpdateInput = shopSpecGroupCreateInput.partial();
+var comboValues = array(string2().min(1).max(60)).min(1).max(24);
+var shopStoreCreateInput = object({
+  name: string2().min(1).max(60),
+  tagline: string2().max(200).default("")
+});
+var shopCategoryCreateInput = object({
+  name: string2().min(1).max(60),
+  parentId: string2().min(1).nullish()
+});
+var shopCategoryUpdateInput = object({
+  name: string2().min(1).max(60),
+  parentId: string2().min(1).nullable()
+}).partial();
+var shopVariantInput = object({
+  combo: comboValues,
+  priceCents: number2().int().min(0).max(1e8),
+  stock: number2().int().min(0).max(1e7).nullish(),
+  enabled: boolean2().default(true)
+});
+var shopProductCreateInput = object({
+  kind: _enum(["digital", "physical"]),
+  name: string2().min(1).max(140),
+  description: string2().max(2000).default(""),
+  categoryId: string2().min(1).nullish(),
+  status: _enum(["draft", "active", "archived"]).default("draft"),
+  priceCents: number2().int().min(0).max(1e8).nullish(),
+  stock: number2().int().min(0).max(1e7).nullish(),
+  deliveryType: _enum(["file", "license"]).nullish(),
+  deliveryFileId: string2().min(1).nullish(),
+  specAxes: array(object({ name: string2().min(1).max(30), values: comboValues })).max(3).nullish(),
+  specGroupIds: array(string2().min(1)).max(3).nullish(),
+  variants: array(shopVariantInput).max(24).nullish()
+});
+var shopProductUpdateInput = shopProductCreateInput.partial();
+var shopStockAdjustInput = object({
+  mode: _enum(["in", "out", "set"]),
+  amount: number2().int().min(0).max(1e7),
+  variantId: string2().min(1).nullish(),
+  reason: _enum(["purchase", "manual"]).nullish(),
+  note: string2().max(200).nullish()
+});
+var shopStripeConnectInput = object({
+  secretKey: string2().min(1).max(255).regex(/^(sk|rk)_(test|live)_/, "must be a Stripe secret key (sk_…/rk_…)"),
+  webhookSecret: string2().max(255).regex(/^whsec_/, "must be a Stripe webhook signing secret (whsec_…)").optional()
+});
+var shopDiscountCodeCreateInput = object({
+  code: string2().trim().regex(/^[A-Z0-9]{0,20}$/, "code must be uppercase letters/digits").optional(),
+  kind: _enum(["amount_off", "percent_off"]),
+  amountCents: number2().int().min(1).max(1e8).nullish(),
+  percent: number2().int().min(1).max(99).nullish(),
+  minSpendCents: number2().int().min(0).max(1e8).nullish(),
+  maxUses: number2().int().min(1).max(1e6).nullish(),
+  expiresAt: number2().int().min(0).nullish()
+});
+var shopDiscountCodeToggleInput = object({
+  status: _enum(["active", "disabled"])
+});
+var shopCustomerAssignInput = object({
+  memberId: string2().min(1).nullable()
+});
+var shopCustomerNoteInput = object({
+  note: string2().max(2000)
+});
+var shopInviteResetInput = object({
+  permissions: array(_enum(SHOP_PERMISSIONS)).default(["orders", "customers"]),
+  bizRoles: array(_enum(["sales", "support"])).default([])
+});
+var shopMemberUpdateInput = object({
+  permissions: array(_enum(SHOP_PERMISSIONS)).min(0).max(SHOP_PERMISSIONS.length),
+  bizRoles: array(_enum(["sales", "support"])).nullish()
+});
+var shopStoreRoleCreateInput = object({
+  name: string2().trim().min(1).max(30),
+  permissions: array(_enum(SHOP_PERMISSIONS)).max(SHOP_PERMISSIONS.length)
+});
+var shopStoreRoleUpdateInput = object({
+  name: string2().trim().min(1).max(30).optional(),
+  permissions: array(_enum(SHOP_PERMISSIONS)).max(SHOP_PERMISSIONS.length).optional()
+});
+var shopShippingAddressInput = object({
+  name: string2().min(1).max(80),
+  phone: string2().min(1).max(40),
+  region: string2().max(120).optional(),
+  detail: string2().min(1).max(500)
+});
+var shopCheckoutInput = object({
+  productId: string2().min(1),
+  variantId: string2().min(1).nullish(),
+  quantity: number2().int().min(1).max(99).default(1),
+  buyerEmail: string2().email().max(200),
+  shippingAddress: shopShippingAddressInput.nullish(),
+  discountCode: string2().trim().max(20).nullish(),
+  provider: _enum(["auto", "mock", "stripe"]).default("auto")
+});
+var shopShipInput = object({
+  trackingNumber: string2().min(1).max(120),
+  quantity: number2().int().min(1).max(1e7).optional()
+});
+var shopApplicationCreateInput = object({
+  name: string2().trim().min(1).max(60),
+  tagline: string2().trim().max(200).default("")
+});
+// ../../packages/contracts/src/hr.ts
+var hrPermissionFlags = [
+  "org.manage",
+  "people.write",
+  "tasks.write",
+  "sensitive.read"
+];
+var hrEventTypes = [
+  "onboard",
+  "contract",
+  "change",
+  "attendance",
+  "payroll",
+  "award",
+  "asset",
+  "offboard",
+  "note"
+];
+var hrTaskStatuses = ["alert", "confirm", "queued", "done"];
+var hrTaskDecisions = ["approved", "rejected"];
+var optionalDay = number2().int().positive().nullable().optional();
+var hrOrgCreateInput = object({
+  name: string2().trim().min(1).max(80)
+});
+var hrOrgUpdateInput = object({
+  name: string2().trim().min(1).max(80)
+});
+var hrMemberAddInput = object({
+  username: string2().trim().toLowerCase().min(3).max(32),
+  title: string2().trim().max(40).optional()
+});
+var hrMemberUpdateInput = object({
+  role: _enum(["admin", "member"]).optional(),
+  permissions: record(_enum(hrPermissionFlags), boolean2()).optional(),
+  title: string2().trim().max(40).optional()
+});
+var hrPersonCreateInput = object({
+  name: string2().trim().min(1).max(60),
+  employeeNo: string2().trim().max(40).optional(),
+  dept: string2().trim().max(40).optional(),
+  role: string2().trim().max(40).optional(),
+  status: _enum(["active", "probation"]).optional(),
+  hiredAt: number2().int().positive(),
+  probationEnd: optionalDay,
+  contractType: string2().trim().max(20).optional(),
+  contractStart: optionalDay,
+  contractEnd: optionalDay,
+  mobile: string2().trim().max(20).optional(),
+  email: string2().trim().max(120).optional(),
+  profile: record(string2(), unknown()).optional(),
+  idNumber: string2().trim().max(18).optional(),
+  salaryCents: number2().int().min(0).max(1e7).nullable().optional(),
+  notes: string2().trim().max(2000).optional()
+});
+var hrImportRowInput = hrPersonCreateInput.omit({ status: true });
+var hrImportInput = object({
+  rows: array(hrImportRowInput).min(1).max(200)
+});
+var hrPersonUpdateInput = object({
+  name: string2().trim().min(1).max(60).optional(),
+  employeeNo: string2().trim().max(40).optional(),
+  dept: string2().trim().max(40).optional(),
+  role: string2().trim().max(40).optional(),
+  status: _enum(["active", "probation", "resigned"]).optional(),
+  hiredAt: number2().int().positive().optional(),
+  probationEnd: optionalDay,
+  contractType: string2().trim().max(20).optional(),
+  contractStart: optionalDay,
+  contractEnd: optionalDay,
+  offboardedAt: optionalDay,
+  mobile: string2().trim().max(20).optional(),
+  email: string2().trim().max(120).optional(),
+  profile: record(string2(), unknown()).optional(),
+  idNumber: string2().trim().max(18).nullable().optional(),
+  salaryCents: number2().int().min(0).max(1e7).nullable().optional(),
+  notes: string2().trim().max(2000).optional()
+});
+var hrPersonListQuery = object({
+  q: string2().trim().max(100).optional(),
+  status: _enum(["active", "probation", "resigned"]).optional(),
+  dept: string2().trim().max(40).optional(),
+  limit: exports_coerce.number().int().min(1).max(200).optional(),
+  offset: exports_coerce.number().int().min(0).optional()
+});
+var hrEventCreateInput = object({
+  type: _enum(hrEventTypes),
+  note: string2().trim().min(1).max(2000),
+  at: number2().int().positive().optional()
+});
+var hrEventListQuery = object({
+  personId: string2().trim().min(1).max(64).optional(),
+  type: _enum(hrEventTypes).optional(),
+  limit: exports_coerce.number().int().min(1).max(200).optional(),
+  offset: exports_coerce.number().int().min(0).optional()
+});
+var hrTaskCreateInput = object({
+  kind: string2().trim().min(1).max(40),
+  title: string2().trim().min(1).max(120),
+  node: string2().trim().max(200).optional(),
+  detail: string2().trim().max(2000).optional(),
+  status: _enum(hrTaskStatuses).optional(),
+  dueAt: number2().int().positive().nullable().optional(),
+  assigneeAccountId: string2().trim().max(64).nullable().optional(),
+  source: string2().trim().max(20).optional(),
+  refType: string2().trim().max(20).optional(),
+  refId: string2().trim().max(64).optional(),
+  meta: record(string2(), unknown()).nullable().optional()
+});
+var hrTaskUpdateInput = object({
+  status: _enum(hrTaskStatuses).optional(),
+  node: string2().trim().max(200).optional(),
+  detail: string2().trim().max(2000).optional(),
+  dueAt: number2().int().positive().nullable().optional(),
+  assigneeAccountId: string2().trim().max(64).nullable().optional(),
+  decision: _enum(hrTaskDecisions).optional(),
+  decisionNote: string2().trim().max(500).optional(),
+  meta: record(string2(), unknown()).nullable().optional()
+});
+var hrTaskListQuery = object({
+  status: _enum(hrTaskStatuses).optional(),
+  kind: string2().trim().max(40).optional(),
+  limit: exports_coerce.number().int().min(1).max(200).optional(),
+  offset: exports_coerce.number().int().min(0).optional()
+});
+var hrAnnouncementCreateInput = object({
+  title: string2().trim().min(1).max(120),
+  body: string2().trim().min(1).max(4000)
+});
+var hrAnnouncementListQuery = object({
+  includeWithdrawn: _enum(["1", "0"]).optional(),
+  limit: exports_coerce.number().int().min(1).max(100).optional(),
+  offset: exports_coerce.number().int().min(0).optional()
+});
+var hrDictTypes = ["dept", "position"];
+var hrDictCreateInput = object({
+  type: _enum(hrDictTypes),
+  name: string2().trim().min(1).max(40)
+});
+var hrAttachmentListQuery = object({
+  personId: string2().trim().max(64).optional(),
+  taskId: string2().trim().max(64).optional(),
+  limit: exports_coerce.number().int().min(1).max(200).optional(),
+  offset: exports_coerce.number().int().min(0).optional()
+});
+var optionalDayField = number2().int().positive().nullable().optional();
+var hrOnboardFormSchema = object({
+  name: string2().trim().max(60).optional(),
+  gender: string2().trim().max(20).optional(),
+  birthDate: optionalDayField,
+  mobile: string2().trim().max(20).optional(),
+  email: string2().trim().max(120).optional(),
+  idNumber: string2().trim().max(18).optional(),
+  education: string2().trim().max(40).optional(),
+  address: string2().trim().max(120).optional(),
+  emergencyContact: string2().trim().max(120).optional(),
+  notes: string2().trim().max(2000).optional(),
+  employeeNo: string2().trim().max(40).optional(),
+  dept: string2().trim().max(40).optional(),
+  role: string2().trim().max(40).optional(),
+  contractType: string2().trim().max(20).optional(),
+  contractStart: optionalDayField,
+  contractEnd: optionalDayField,
+  employmentType: _enum(["probation", "active"]).optional(),
+  probationEnd: optionalDayField,
+  hiredAt: number2().int().positive().optional(),
+  salaryCents: number2().int().min(0).max(1e7).nullable().optional()
+});
+var hrRegularizeFormSchema = object({
+  selfSummary: string2().trim().max(4000).optional(),
+  newRole: string2().trim().max(40).optional(),
+  salaryCents: number2().int().min(0).max(1e7).nullable().optional(),
+  probationReview: string2().trim().max(2000).optional(),
+  regularizeDate: optionalDayField
+});
+var hrOffboardFormSchema = object({
+  offboardType: _enum(["personal", "mutual", "dismissal"]).optional(),
+  reason: string2().trim().max(2000).optional(),
+  lastDay: optionalDayField,
+  handoverNotes: string2().trim().max(2000).optional()
+});
 // ../../packages/contracts/src/index.ts
 var accountDomain = "crabcloud.cc";
 var adminDomain = `admin.${accountDomain}`;
@@ -5916,14 +6399,20 @@ var scopes = [
   "contacts.read",
   "contacts.write",
   "collab.read",
-  "collab.write"
+  "collab.write",
+  "hr.read",
+  "hr.write",
+  "agent.read",
+  "agent.write"
 ];
 var scopeGroups = [
   { id: "account", scopes: ["account.read", "credits.read"] },
   { id: "mail", scopes: ["mail.read", "mail.send", "mail.search", "mail.delete"] },
   { id: "storage", scopes: ["storage.read", "storage.write", "storage.delete"] },
   { id: "collab", scopes: ["collab.read", "collab.write"] },
-  { id: "contacts", scopes: ["contacts.read", "contacts.write"] }
+  { id: "contacts", scopes: ["contacts.read", "contacts.write"] },
+  { id: "hr", scopes: ["hr.read", "hr.write"] },
+  { id: "agent", scopes: ["agent.read", "agent.write"] }
 ];
 function expandScopes(input) {
   const expanded = input.flatMap((item) => {
@@ -6005,7 +6494,8 @@ var sessionSummarySchema = object({
 var deviceStartInput = object({
   name: string2().trim().min(1).max(80),
   scopes: array(_enum(scopes)).min(1).max(scopes.length),
-  space: string2().trim().min(1).max(80).optional()
+  space: string2().trim().min(1).max(80).optional(),
+  org: string2().trim().min(1).max(80).optional()
 });
 var devicePollInput = object({ deviceCode: string2().min(16).max(200) });
 var deviceDecisionInput = object({
@@ -6018,11 +6508,18 @@ var agentTokenSummarySchema = object({
   name: string2(),
   scopes: array(_enum(scopes)),
   collabSpace: string2().nullable().optional(),
+  hrOrg: string2().nullable().optional(),
+  kind: _enum(["agent", "api"]).optional(),
+  keyHint: string2().optional(),
   createdAt: number2(),
   lastUsedAt: number2().nullable(),
   expiresAt: number2().nullable(),
   revoked: boolean2()
 });
+var apiKeyCreateInput = object({
+  name: string2().trim().min(1).max(64),
+  scopes: array(string2().trim().min(1).max(40)).min(1).max(32)
+});
 var oauthProviders = ["google", "reai", "github"];
 var oauthUnbindInput = object({ provider: _enum(oauthProviders) });
 var oauthOnboardingConfirmInput = object({
@@ -6069,6 +6566,12 @@ var adminPlanTierUpdateInput = object({
   quotaJson: record(string2(), unknown()).optional(),
   status: _enum(adminPlanTierStatuses).optional()
 });
+var adminShopStoreStatusInput = object({
+  status: _enum(["active", "archived"])
+});
+var adminShopApplicationRejectInput = object({
+  note: string2().trim().min(1).max(500)
+});
 var subscriptionChangeInput = object({
   tierId: string2().trim().min(1).max(50)
 });
@@ -6229,6 +6732,160 @@ var collabRecordListQuery = object({
   cursor: string2().trim().max(200).optional(),
   limit: exports_coerce.number().int().min(1).max(200).optional()
 });
+var agentPermissionModes = ["confirm", "auto_edit", "yolo"];
+var agentSessionKinds = ["chat", "task"];
+var agentMemoryTypes = ["preference", "contact", "project", "daily"];
+var AGENT_TITLE_MAX = 120;
+var AGENT_MEMORY_MAX = 2000;
+var AGENT_PERSONA_MAX = 2000;
+var agentToolsConfigSchema = object({
+  web: boolean2().optional(),
+  code: boolean2().optional(),
+  workspace: boolean2().optional(),
+  crab: object({
+    credits: boolean2().optional(),
+    mail: boolean2().optional(),
+    storage: boolean2().optional(),
+    collab: boolean2().optional(),
+    contacts: boolean2().optional()
+  }).optional()
+});
+var agentDelegationModules = ["mail", "storage", "collab", "workspace", "web"];
+var agentDelegationRefSchema = object({
+  module: _enum(agentDelegationModules),
+  id: string2().min(1).max(200),
+  title: string2().max(300).optional()
+});
+var agentConfigUpdateInput = object({
+  activeModelId: string2().trim().min(1).max(64).optional(),
+  persona: string2().max(AGENT_PERSONA_MAX).optional(),
+  mode: _enum(agentPermissionModes).optional(),
+  planEnabled: boolean2().optional(),
+  tools: agentToolsConfigSchema.optional()
+});
+var AGENT_PROVIDER_LABEL_MAX = 60;
+var agentProviderInput = object({
+  label: string2().trim().min(1).max(AGENT_PROVIDER_LABEL_MAX),
+  baseUrl: string2().trim().min(1).max(500),
+  apiKey: string2().trim().min(1).max(500)
+});
+var agentProviderModelInput = object({
+  model: string2().trim().min(1).max(200),
+  contextWindow: number2().int().min(1000).max(1e8).nullable().optional(),
+  maxOutput: number2().int().min(100).max(1e7).nullable().optional(),
+  inputText: boolean2().optional(),
+  inputImage: boolean2().optional(),
+  inputVideo: boolean2().optional()
+});
+var agentSkillCreateInput = object({
+  name: string2().trim().max(64).optional(),
+  description: string2().trim().max(600).optional(),
+  body: string2().min(1).max(1e5)
+});
+var agentSessionCreateInput = object({
+  kind: _enum(agentSessionKinds).default("chat"),
+  title: string2().trim().max(AGENT_TITLE_MAX).optional(),
+  repeatCron: string2().trim().max(100).optional(),
+  notifyMail: boolean2().optional()
+}).refine((v) => v.kind === "chat" || !!v.title && v.title.length > 0, {
+  message: "task requires title"
+});
+var agentSessionRenameInput = object({
+  title: string2().trim().min(1).max(AGENT_TITLE_MAX).optional(),
+  mode: _enum(agentPermissionModes).optional()
+}).refine((v) => v.title !== undefined || v.mode !== undefined, { message: "nothing to update" });
+var agentUsageOverviewSchema = object({
+  monthActions: number2().int().min(0),
+  turns30d: number2().int().min(0),
+  daily: array(object({ day: string2().regex(/^\d{4}-\d{2}-\d{2}$/), count: number2().int().min(0) })).max(120),
+  toolCalls: array(object({ action: string2().min(1), count: number2().int().min(0) })).max(40),
+  approvals: object({
+    approved: number2().int().min(0),
+    rejected: number2().int().min(0),
+    pending: number2().int().min(0),
+    expired: number2().int().min(0)
+  }),
+  taskRuns: object({ total: number2().int().min(0), failed: number2().int().min(0) })
+});
+var agentSessionListQuery = object({
+  kind: _enum(agentSessionKinds).optional(),
+  limit: exports_coerce.number().int().min(1).max(200).optional(),
+  archived: preprocess((v) => v === "1" || v === "true", boolean2()).optional(),
+  q: string2().trim().min(1).max(100).optional()
+});
+var agentTaskCreateInput = object({
+  title: string2().trim().min(1).max(AGENT_TITLE_MAX),
+  repeatCron: string2().trim().max(100).optional(),
+  notifyMail: boolean2().optional(),
+  mode: _enum(["task", "branch"]).optional(),
+  seedMessageIds: array(string2().min(1).max(80)).max(20).optional()
+});
+var agentMemoryCreateInput = object({
+  type: _enum(agentMemoryTypes),
+  content: string2().trim().min(1).max(AGENT_MEMORY_MAX),
+  sessionId: string2().max(64).optional()
+});
+var agentTraceStatuses = ["running", "ok", "error", "pending", "approved", "rejected"];
+var agentPlanItemStates = ["done", "current", "todo"];
+var agentTraceCommon = {
+  id: string2().min(1).max(64),
+  status: _enum(agentTraceStatuses),
+  round: number2().int().min(1),
+  title: string2().max(200),
+  durationMs: number2().int().min(0).optional()
+};
+var agentPlanTraceSchema = object({
+  ...agentTraceCommon,
+  kind: literal("plan"),
+  items: array(object({ text: string2().max(500), state: _enum(agentPlanItemStates) })).max(50)
+});
+var agentWebTraceSchema = object({
+  ...agentTraceCommon,
+  kind: literal("web"),
+  url: string2().max(2000),
+  summary: string2().max(8000)
+});
+var agentArtifactSchema = object({
+  name: string2().max(200),
+  mime: string2().max(100),
+  path: string2().max(500),
+  rows: number2().int().min(0).optional()
+});
+var agentCodeTraceSchema = object({
+  ...agentTraceCommon,
+  kind: literal("code"),
+  code: string2().max(50000).optional(),
+  result: string2().max(20000).optional(),
+  artifact: agentArtifactSchema.optional()
+});
+var agentCrabTraceSchema = object({
+  ...agentTraceCommon,
+  kind: literal("crab"),
+  command: string2().max(2000),
+  response: string2().max(8000).optional()
+});
+var agentApprovalTraceSchema = object({
+  ...agentTraceCommon,
+  kind: literal("approval"),
+  tool: string2().max(64),
+  action: string2().max(200),
+  detail: string2().max(8000)
+});
+var agentTraceSchema = discriminatedUnion("kind", [
+  agentPlanTraceSchema,
+  agentWebTraceSchema,
+  agentCodeTraceSchema,
+  agentCrabTraceSchema,
+  agentApprovalTraceSchema
+]);
+var agentMemoryChipSchema = object({
+  text: string2().max(200),
+  memoryId: string2().max(64).optional()
+});
+var agentCompressionChipSchema = object({
+  foldedRounds: number2().int().min(1),
+  summary: string2().max(4000)
+});
 
 // ../../packages/cloudkit/src/crypto.ts
 var enc = new TextEncoder;
@@ -6519,6 +7176,9 @@ function exitCodeForApiError(body) {
     case "collab_space_not_bound":
     case "collab_space_mismatch":
       return EXIT_SCOPE;
+    case "hr_org_not_bound":
+    case "hr_org_mismatch":
+      return EXIT_SCOPE;
     default:
       return 1;
   }
@@ -6598,13 +7258,15 @@ var usage = `crab — Crab Cloud CLI（Agent-first 入口）
   contacts invite [--reset] [--json] 我的邀请码、链接与统计（--reset 重置，旧链接失效）
   contacts invitees [--offset N] [--json]
                                      我邀请的人（直接下级 + 间接计数）
-  storage ls [--q 关键字] [--source files|media|mail] [--category <id|none>]
+  storage ls [--q 关键字] [--source files|media|mail|collab|agent] [--category <id|none>]
                [--type doc|image|video|archive|code] [--tag a,b] [--trash]
-               [--shared] [--recent] [--message-id <id>] [--limit N] [--offset N] [--json]
-                                     列出云盘对象（跨来源统一视图，能力与 Web 云盘一致）
+               [--shared] [--recent] [--encrypted only|plain] [--message-id <id>]
+               [--limit N] [--offset N] [--json]
+                                     列出云盘对象（跨来源统一视图，能力与 Web 云盘一致；
+                                     --encrypted only=仅保险箱、plain=排除保险箱）
   storage upload <file...> [--json]  上传一个或多个文件（直传优先，自动回退中转）；
-                                     files 域默认端到端加密，口令 --passphrase /
-                                     CRAB_PASSPHRASE 提供，终端内运行时交互输入
+                                     默认明文上传（2026-10 基础服务化）；--passphrase /
+                                     CRAB_PASSPHRASE 提供时端到端加密（保险箱文件）
   storage download <id|文件名> [-o 输出路径]
                                      下载对象内容（默认按原文件名存到当前目录；
                                      加密对象需口令，终端内运行时交互输入）
@@ -6617,7 +7279,7 @@ var usage = `crab — Crab Cloud CLI（Agent-first 入口）
                                      公开 / 收回公开（公开时打印公开直链）
   storage rm|restore|purge <id|文件名>
                                      回收站 / 恢复 / 彻底删除（purge 不可恢复）
-  storage quota [--json]             存储水位（统一容量账：文件/素材/邮件附件一本账）
+  storage quota [--json]             存储水位（统一一本账：五来源分项 + 保险箱计数）
   storage share <id|文件名> [--expires 7|30|90|forever] [--passcode 提取码]
                        创建分享链接（加密文件链接自带解密钥匙 #fragment）
   storage key [--remember|--forget]
@@ -6657,6 +7319,67 @@ var usage = `crab — Crab Cloud CLI（Agent-first 入口）
   collab activity [--json]           协作域活动事件（Agent 推送/读取、任务创建、摘要更新）
   post <taskId> (--body "..." | --body-file <path>) [--attach <fileId,...>] [--link <url,...>] [--json]
                                      推送任务记录（糖命令：等价 collab task records 的写入）
+  hr orgs [--json]                   我的组织列表（hr 命令需令牌绑定组织：login --scopes hr --org org:<名称>）
+  hr org create <名称> [--json]      创建公司 / 组织（创建者 owner）
+  hr members [--org <arg>] [--json]  成员列表（角色与权限 flags）
+  hr member add <用户名> [--title 头衔] [--org <arg>]
+                                     邀请平台账号入组织（member，只读）
+  hr member set <memberId> [--role admin|member] [--permissions org.manage=1,...] [--title]
+                                     角色与权限逐项配置（owner 恒全权不可改）
+  hr member rm <memberId>            移除成员
+  hr invite [--reset] [--org <arg>]  常驻邀请链接（未注册者注册即入组织；--reset 作废旧链）
+  hr people [--q 关键字] [--status active|probation|resigned] [--dept] [--limit N] [--offset N] [--json]
+                                     花名册（身份证/薪资对令牌永不外泄，输出如实按无权限转述）
+  hr person <id> [--json]            人员详情
+  hr person create --name "姓名" --hired-at YYYY-MM-DD [--dept] [--role] [--probation-end] [--contract-type] [--contract-end] [--mobile] [--email] [--notes] [--json]
+                                     建档（自动落入职事件）
+  hr person edit <id> [--dept] [--role] [--status ...] [--contract-end YYYY-MM-DD] [--offboarded-at YYYY-MM-DD] [--json]
+                                     编辑（转正/离职状态流转自动落痕）
+  hr person offboard <id> [--date YYYY-MM-DD] [--json]
+                                     办理离职（档案封存，记录依法保留）
+  hr event add <personId> --type <onboard|contract|change|attendance|payroll|award|asset|offboard|note> --note "..." [--at YYYY-MM-DD] [--json]
+                                     事件落痕（时间线即证据链）
+  hr events [--person <id>] [--type] [--limit N] [--offset N] [--json]
+                                     事件时间线
+  hr import <文件.csv|.tsv|.json> [--org <arg>] [--json]
+                                     批量建档（≤200 行；CSV/TSV 表头自动识别，姓名/入职列必填）
+  hr tasks [--status alert|confirm|queued|done] [--kind] [--limit N] [--offset N] [--json]
+                                     任务列表
+  hr task create --kind <attendance|payroll|contract|...> --title "..." [--node] [--detail] [--due YYYY-MM-DD] [--json]
+                                     新建任务
+  hr task update <id> [--status ...] [--node] [--detail] [--due YYYY-MM-DD] [--json]
+                                     任务流转
+  hr desk [--org <arg>] [--json]     工作台聚合（Agent 首入口：任务三段 + 大事提醒 + 最近动态）
+  shop status [--json]               店铺列表 + 开通申请进度（多店全列，★ = 当前店）
+  shop use <slug>                    切换当前管理的店铺（持久保存；店级命令缺省作用于它，
+                                     --store 可单条临时覆盖；不带参数显示当前店）
+  shop apply <店铺名> [--tagline 一句话介绍] [--json]
+                                     提交开店申请（成为卖家/增开统一入口；平台审核通过自动建店，
+                                     增开通过时扣积分）
+  shop roles --store <slug> [--json] 店铺角色预设（权限组合模板 + 匹配成员数）
+  shop members --store <slug> [--json]
+                                     成员列表（身份/权限组合/业务身份/归属客户/状态）
+  shop member edit <用户名> --perms <a,b,c> [--biz sales,support] --store <slug> [--json]
+                                     编辑成员权限组合与业务身份（--perms 七项逗号分隔，
+                                     --biz 省略则不改；身份=归因资格，可多选）
+  shop invite [--reset --perms <a,b> --biz <sales,support>] --store <slug> [--json]
+                                     查看 / 重置常驻邀请链接（重置后旧链接作废，
+                                     受邀者权限取新默认组合；接受走链接页）
+  shop categories [--store <slug>] [--json]
+                                     分类树（多级缩进 + 商品数 + id）
+  shop category add <名称> [--parent <id或名称>] --store <slug> [--json]
+                                     新建分类（缺省顶级；新建落同级末尾）
+  shop category rename <id或名称> <新名称> --store <slug> [--json]
+  shop category move <id或名称> <up|down> --store <slug> [--json]
+                                     同级内上移/下移一位（边界静默不动）
+  shop category delete <id或名称> --store <slug> [--json]
+                                     删除分类（有子级拒绝；叶子删除后商品迁入未分类）
+  shop specs [--store <slug>] [--json]
+                                     规格库模板（名称/选项值/引用商品数）
+  shop spec add <名称> --values <值1,值2,…> --store <slug> [--json]
+  shop spec update <id或名称> [--name <新名>] [--values <a,b,c>] --store <slug> [--json]
+  shop spec delete <id或名称> --store <slug> [--json]
+                                     规格模板管理（引用 = 快照拷贝，改/删不影响已建商品）
   credits [--json]                   积分余额（月送/充值/合计；需 credits.read scope）
   credits history [--limit N] [--offset N] [--json]
                                      积分流水（变动 ±：消耗为负；需 credits.read）
@@ -6700,10 +7423,21 @@ async function login() {
     console.error("示例：crab login --scopes collab --space default");
     return EXIT_USAGE;
   }
+  const orgArg = readFlag("--org");
+  if (requested.some((s) => s === "hr.read" || s === "hr.write") && !orgArg) {
+    console.error("含人事行政 scope（hr）时必须指定 --org <org:<名称>|组织id>>——令牌将绑定该组织，越界访问一律拒绝。");
+    console.error("示例：crab login --scopes hr --org org:远帆文化");
+    return EXIT_USAGE;
+  }
   const openBrowser = !hasFlag("--no-open");
   const start = await api2(apiBase, "/v1/auth/device/start", {
     method: "POST",
-    body: JSON.stringify({ name: `${hostname()} · crab cli`, scopes: requested, ...spaceArg ? { space: spaceArg } : {} })
+    body: JSON.stringify({
+      name: `${hostname()} · crab cli`,
+      scopes: requested,
+      ...spaceArg ? { space: spaceArg } : {},
+      ...orgArg ? { org: orgArg } : {}
+    })
   });
   if (start.status !== 200) {
     console.error(`发起授权失败（${start.status}）：`, errorMessage(start.body, JSON.stringify(start.body)));
@@ -6747,6 +7481,8 @@ async function login() {
       console.log(`  scopes: ${poll.body.data.scopes.join(", ")}`);
       if (spaceArg)
         console.log(`  协作空间绑定: ${spaceArg}（collab 命令只能作用于该空间）`);
+      if (orgArg)
+        console.log(`  HR 组织绑定: ${orgArg}（hr 命令只能作用于该组织）`);
       return 0;
     }
   }
@@ -6889,11 +7625,13 @@ async function tokensList() {
     return 0;
   }
   if (rows.length === 0) {
-    console.log("还没有已授权的 Agent 令牌。");
+    console.log("还没有已授权的令牌。");
     return 0;
   }
   for (const token of rows) {
-    console.log(`${token.id}  ${token.name}  [${token.scopes.join(", ")}]  ${token.revoked ? "已撤销" : "生效中"}${token.collabSpace ? `  ⟨空间 ${token.collabSpace}⟩` : ""}`);
+    const isApiKey = token.kind === "api";
+    const hint = isApiKey && token.keyHint ? ` ⟨${token.keyHint}⟩` : "";
+    console.log(`${token.id}  ${isApiKey ? "[API Key] " : ""}${token.name}${hint}  [${token.scopes.join(", ")}]  ${token.revoked ? "已撤销" : "生效中"}${token.collabSpace ? `  ⟨空间 ${token.collabSpace}⟩` : ""}`);
     console.log(`    创建 ${formatTime(token.createdAt)} · 最近使用 ${token.lastUsedAt ? formatTime(token.lastUsedAt) : "—"}${token.expiresAt ? ` · 过期 ${formatTime(token.expiresAt)}` : ""}`);
   }
   return 0;
@@ -7122,8 +7860,8 @@ async function mailSend() {
     const hit = await resolveStorageObject(credentials, token);
     if (typeof hit === "number")
       return hit;
-    if (typeof hit === "object" && hit.isEncrypted) {
-      console.error(`「${token}」是端到端加密文件，暂不能作为邮件附件发送（服务端无法解密）。`);
+    if (typeof hit === "object" && hit.isEncrypted && hit.wrappedDataKey?.startsWith("u1.")) {
+      console.error(`「${token}」是保险箱文件（端到端加密），不能作为邮件附件发送。`);
       return EXIT_USAGE;
     }
     const id = typeof hit === "object" ? hit.id : hit;
@@ -7392,7 +8130,7 @@ async function contactsInvitees() {
     console.log(`（还有更多：contacts invitees --offset ${page.nextOffset}）`);
   return 0;
 }
-var STORAGE_SOURCES = ["files", "media", "mail"];
+var STORAGE_SOURCES = ["files", "media", "mail", "collab", "agent"];
 var STORAGE_TYPES = ["doc", "image", "video", "archive", "code"];
 var MIME_BY_EXT = {
   png: "image/png",
@@ -7429,9 +8167,10 @@ function formatBytesCli(n) {
   return `${n} B`;
 }
 function printStorageRow(o) {
+  const encFlag = o.isEncrypted ? o.wrappedDataKey?.startsWith("u1.") ? "保险箱" : "平台加密" : null;
   const flags = [
-    o.source !== "files" ? o.source === "media" ? "素材" : "邮件附件" : null,
-    o.isEncrypted ? "加密" : null,
+    o.source !== "files" ? o.source === "media" ? "素材" : o.source === "mail" ? "邮件附件" : o.source === "collab" ? "协作" : "Agent 产物" : null,
+    encFlag,
     o.isPublic ? "公开" : null
   ].filter(Boolean);
   console.log(`${o.id}  ${o.filename}  ${formatBytesCli(o.sizeBytes)}  ${formatTime(o.createdAt)}${flags.length > 0 ? `  [${flags.join(" · ")}]` : ""}`);
@@ -7501,6 +8240,15 @@ async function storageList() {
   const tags = readFlag("--tag");
   if (tags)
     params.set("tags", tags);
+  const encrypted = readFlag("--encrypted");
+  if (encrypted) {
+    if (encrypted !== "only" && encrypted !== "plain") {
+      console.error(`未知 encrypted 过滤：${encrypted}
+可用：only（仅保险箱）、plain（排除保险箱）`);
+      return EXIT_USAGE;
+    }
+    params.set("encrypted", encrypted);
+  }
   if (hasFlag("--trash"))
     params.set("trash", "1");
   if (hasFlag("--shared"))
@@ -7759,7 +8507,7 @@ async function driveMasterKey(credentials) {
     return raw;
   return importAesKey(raw);
 }
-async function storageUploadOne(credentials, filePath) {
+async function storageUploadOne(credentials, filePath, encrypt) {
   let buf;
   try {
     buf = readFileSync2(filePath);
@@ -7769,22 +8517,26 @@ async function storageUploadOne(credentials, filePath) {
   }
   const filename = basename(filePath);
   const mimeType = mimeFor(filename);
-  const master = await driveMasterKey(credentials);
-  if (typeof master === "number")
-    return master;
-  const dataKey = randomKeyBytes(32);
-  const sealed = await aeadEncrypt(await importAesKey(dataKey), new Uint8Array(buf), DATA_AAD);
-  const cipher = new Uint8Array([...sealed.iv, ...sealed.ciphertext]);
-  const wrapped = await aeadEncrypt(master, dataKey, DATA_AAD);
-  const wrappedDataKey = `u1.${sealToB64url({ iv: wrapped.iv, ciphertext: wrapped.ciphertext })}`;
+  let body = new Uint8Array(buf);
+  let wrappedDataKey = null;
+  if (encrypt) {
+    const master = await driveMasterKey(credentials);
+    if (typeof master === "number")
+      return master;
+    const dataKey = randomKeyBytes(32);
+    const sealed = await aeadEncrypt(await importAesKey(dataKey), body, DATA_AAD);
+    body = new Uint8Array([...sealed.iv, ...sealed.ciphertext]);
+    const wrapped = await aeadEncrypt(master, dataKey, DATA_AAD);
+    wrappedDataKey = `u1.${sealToB64url({ iv: wrapped.iv, ciphertext: wrapped.ciphertext })}`;
+  }
   const presign = await api2(credentials.apiBase, "/v1/storage/presign", {
     method: "POST",
     headers: authHeaders(credentials),
-    body: JSON.stringify({ filename, mimeType, sizeBytes: cipher.byteLength, enc: true })
+    body: JSON.stringify({ filename, mimeType, sizeBytes: body.byteLength, enc: wrappedDataKey !== null })
   });
   if (presign.status === 200 || presign.status === 201) {
     const { fileId, uploadUrl } = presign.body.data;
-    const put = await fetch(uploadUrl, { method: "PUT", body: cipher, headers: { "content-type": mimeType } });
+    const put = await fetch(uploadUrl, { method: "PUT", body, headers: { "content-type": mimeType } });
     if (!put.ok) {
       console.error(`直传失败（${put.status}）：${filename}`);
       return 1;
@@ -7792,7 +8544,7 @@ async function storageUploadOne(credentials, filePath) {
     const complete = await api2(credentials.apiBase, `/v1/storage/${encodeURIComponent(fileId)}/complete`, {
       method: "POST",
       headers: authHeaders(credentials),
-      body: JSON.stringify({ isEncrypted: true, wrappedDataKey })
+      body: JSON.stringify(wrappedDataKey ? { isEncrypted: true, wrappedDataKey } : {})
     });
     if (complete.status !== 200 && complete.status !== 201) {
       console.error(errorMessage(complete.body, `记账失败：${filename}`));
@@ -7802,28 +8554,30 @@ async function storageUploadOne(credentials, filePath) {
     if (hasFlag("--json"))
       console.log(JSON.stringify(object, null, 2));
     else
-      console.log(`✓ 已上传（已加密）：${object.filename}（id ${object.id}）`);
+      console.log(`✓ 已上传${wrappedDataKey ? "（已加密）" : ""}：${object.filename}（id ${object.id}）`);
     return 0;
   }
   if (presign.body?.error?.code === "presign_unavailable") {
     const form = new FormData;
-    form.append("file", new Blob([cipher], { type: mimeType }), filename);
-    form.append("enc", "1");
-    form.append("wrappedDataKey", wrappedDataKey);
+    form.append("file", new Blob([body], { type: mimeType }), filename);
+    if (wrappedDataKey) {
+      form.append("enc", "1");
+      form.append("wrappedDataKey", wrappedDataKey);
+    }
     const res = await fetch(`${credentials.apiBase}/v1/storage`, {
       method: "POST",
       headers: authHeaders(credentials),
       body: form
     });
-    const body = await res.json().catch(() => ({}));
+    const body2 = await res.json().catch(() => ({}));
     if (res.status !== 200 && res.status !== 201) {
-      console.error(body.error?.message ?? `上传失败：${filename}`);
-      return exitCodeForApiError(body);
+      console.error(body2.error?.message ?? `上传失败：${filename}`);
+      return exitCodeForApiError(body2);
     }
     if (hasFlag("--json"))
-      console.log(JSON.stringify(body.data, null, 2));
+      console.log(JSON.stringify(body2.data, null, 2));
     else
-      console.log(`✓ 已上传（已加密）：${body.data?.filename}（id ${body.data?.id}）`);
+      console.log(`✓ 已上传${wrappedDataKey ? "（已加密）" : ""}：${body2.data?.filename}（id ${body2.data?.id}）`);
     return 0;
   }
   console.error(errorMessage(presign.body, `上传失败：${filename}`));
@@ -7831,16 +8585,21 @@ async function storageUploadOne(credentials, filePath) {
 }
 async function storageUpload(paths) {
   const files = [];
+  let encrypt = false;
   for (let i = 0;i < paths.length; i++) {
     if (paths[i].startsWith("--")) {
-      if (paths[i] === "--passphrase")
+      if (paths[i] === "--passphrase") {
+        encrypt = true;
         i++;
+      }
       continue;
     }
     files.push(paths[i]);
   }
+  if (!encrypt && process.env.CRAB_PASSPHRASE)
+    encrypt = true;
   if (files.length === 0) {
-    console.error("用法：crab storage upload <file...> [--passphrase 口令] [--json]");
+    console.error("用法：crab storage upload <file...> [--passphrase 口令] [--json]（缺省明文上传；带口令则端到端加密）");
     return EXIT_USAGE;
   }
   const credentials = requireCredentials();
@@ -7848,7 +8607,7 @@ async function storageUpload(paths) {
     return credentials;
   let code = 0;
   for (const file of files) {
-    const result = await storageUploadOne(credentials, file);
+    const result = await storageUploadOne(credentials, file, encrypt);
     if (result !== 0 && code === 0)
       code = result;
     if (result === EXIT_AUTH || result === EXIT_SCOPE)
@@ -8144,9 +8903,10 @@ async function storageQuota() {
     return 0;
   }
   const pct = quota.quotaBytes > 0 ? (quota.usedBytes / quota.quotaBytes * 100).toFixed(1) : "0";
+  const libraryCount = (quota.counts.all ?? 0) - (quota.counts.vault ?? 0);
   console.log(`已用 ${formatBytesCli(quota.usedBytes)} / ${formatBytesCli(quota.quotaBytes)}（${pct}%）`);
-  console.log(`  文件 ${formatBytesCli(quota.bySource.files)} · 素材 ${formatBytesCli(quota.bySource.media)} · 邮件附件 ${formatBytesCli(quota.bySource.mail)} · 回收站 ${formatBytesCli(quota.trashBytes)}`);
-  console.log(`  对象数：全部 ${quota.counts.all ?? 0} · 素材 ${quota.counts.media ?? 0} · 邮件附件 ${quota.counts.mail ?? 0} · 共享 ${quota.counts.shared ?? 0} · 回收站 ${quota.counts.trash ?? 0}`);
+  console.log(`  文件 ${formatBytesCli(quota.bySource.files)} · 素材 ${formatBytesCli(quota.bySource.media)} · ` + `邮件附件 ${formatBytesCli(quota.bySource.mail)} · 协作 ${formatBytesCli(quota.bySource.collab)} · ` + `Agent ${formatBytesCli(quota.bySource.agent)} · 回收站 ${formatBytesCli(quota.trashBytes)}`);
+  console.log(`  对象数：全部 ${quota.counts.all ?? 0} · 素材库 ${libraryCount}（保险箱 ${quota.counts.vault ?? 0}） · ` + `共享 ${quota.counts.shared ?? 0} · 回收站 ${quota.counts.trash ?? 0}`);
   return 0;
 }
 async function storageCategories() {
@@ -8407,7 +9167,7 @@ async function collabSpacesList() {
   }
   for (const s of data.spaces) {
     const storage = s.kind === "independent" ? ` · 存储 ${formatBytesCli(s.storageUsedBytes)}/${formatBytesCli(s.storageAllocatedBytes)}` : "";
-    console.log(`${collabSpaceToken(s)}  ${s.status === "archived" ? "[已归档·只读] " : ""}任务 ${s.taskCount}/${s.limits.taskLimit} · 受邀成员 ${s.memberCount}/${s.limits.invitedMemberLimit}${storage}`);
+    console.log(`${collabSpaceToken(s)}  ${s.status === "archived" ? "[已归档·只读] " : ""}任务 ${s.taskCount}/${s.limits.taskLimit} · 成员 ${s.memberCount}/${s.limits.memberLimit}${storage}`);
     console.log(`    id ${s.id}`);
   }
   console.log(`独立空间名额：${data.independentUsed}/${data.independentLimit}（创建消耗 5 积分：crab collab space create <名称>）`);
@@ -8846,131 +9606,1798 @@ async function logout() {
   console.log("✓ 已撤销 Agent Token 并清除本地凭证。");
   return 0;
 }
-switch (command) {
-  case "init":
-    process.exit(await init());
-  case "login":
-    process.exit(await login());
-  case "whoami":
-    process.exit(await whoami());
-  case "tokens": {
-    const sub = args[1];
-    if (sub === "list")
-      process.exit(await tokensList());
-    if (sub === "revoke")
-      process.exit(await tokensRevoke(args[2]));
-    console.error(sub ? `未知子命令：tokens ${sub}
-` : `缺少子命令：tokens list | tokens revoke <id>
-`);
-    console.log(usage);
-    process.exit(EXIT_USAGE);
+var HR_VALUED_FLAGS = [
+  "--org",
+  "--title",
+  "--role",
+  "--permissions",
+  "--name",
+  "--hired-at",
+  "--employee-no",
+  "--dept",
+  "--role",
+  "--status",
+  "--probation-end",
+  "--contract-type",
+  "--contract-end",
+  "--mobile",
+  "--email",
+  "--notes",
+  "--type",
+  "--note",
+  "--at",
+  "--date",
+  "--kind",
+  "--title",
+  "--node",
+  "--detail",
+  "--due",
+  "--limit",
+  "--offset",
+  "--q"
+];
+var HR_PERSON_STATUSES = ["active", "probation", "resigned"];
+var HR_TASK_STATUSES = ["alert", "confirm", "queued", "done"];
+var HR_EVENT_TYPES = ["onboard", "contract", "change", "attendance", "payroll", "award", "asset", "offboard", "note"];
+function hrOrgToken(org) {
+  return `org:${org.name}`;
+}
+async function resolveHrOrg(credentials, arg) {
+  const res = await api2(credentials.apiBase, "/v1/hr/orgs", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取组织列表失败。"));
+    const code = res.body?.error?.code;
+    if (code === "scope_denied") {
+      console.error("提示：hr 命令需要 hr scope——运行 crab login --scopes hr --org org:<名称> 重新授权。");
+    }
+    return exitCodeForApiError(res.body);
   }
-  case "skills": {
-    const sub = args[1];
-    if (sub === "install")
-      process.exit(installSkills(args.slice(2)));
-    if (sub === "list")
-      process.exit(listSkills());
-    if (sub === "uninstall")
-      process.exit(uninstallSkills(args.slice(2)));
-    console.error(`用法：crab skills install | list | uninstall [--agent claude,zcode,codex,agents]
-`);
-    process.exit(EXIT_USAGE);
+  const orgs = res.body.data.orgs;
+  if (orgs.length === 0) {
+    console.error("你还没有加入任何公司 / 组织（在 hr-web 创建，或 crab hr org create <名称>）。");
+    return EXIT_NOT_FOUND;
   }
-  case "mail": {
-    const sub = args[1];
-    if (sub === "list")
-      process.exit(await mailList());
-    if (sub === "read")
-      process.exit(await mailRead(args[2]));
-    if (sub === "unread")
-      process.exit(await mailUnread(args[2]));
-    if (sub === "search")
-      process.exit(await mailSearch(args.slice(2).join(" ") || undefined));
-    if (sub === "send")
-      process.exit(await mailSend());
-    if (sub === "archive" || sub === "trash" || sub === "delete")
-      process.exit(await mailMove(sub, args[2]));
-    if (sub === "folders")
-      process.exit(await mailFoldersOverview());
-    if (sub === "activity")
-      process.exit(await mailActivity());
-    console.error(sub ? `未知子命令：mail ${sub}
-` : `缺少子命令：mail list | read | unread | search | send | archive | trash | delete | folders | activity
-`);
-    console.log(usage);
-    process.exit(EXIT_USAGE);
+  const raw = (arg ?? "").trim();
+  if (!raw) {
+    if (orgs.length === 1)
+      return orgs[0];
+    console.error("你所在的组织不止一个，请用 --org 指定（org:<名称> / 组织 id）：");
+    for (const org of orgs)
+      console.error(`  ${hrOrgToken(org)}  （成员 ${org.memberCount} · ${org.myRole}）`);
+    return EXIT_USAGE;
   }
-  case "contacts": {
-    const sub = args[1];
-    if (sub === "list")
-      process.exit(await contactsList(args.slice(2).join(" ") || undefined));
-    if (sub === "add")
-      process.exit(await contactsAdd(args[2]));
-    if (sub === "rm")
-      process.exit(await contactsRm(args[2]));
-    if (sub === "invite")
-      process.exit(await contactsInvite(hasFlag("--reset")));
-    if (sub === "invitees")
-      process.exit(await contactsInvitees());
-    console.error(sub ? `未知子命令：contacts ${sub}
-` : `缺少子命令：contacts list | add | rm | invite | invitees
-`);
-    console.log(usage);
-    process.exit(EXIT_USAGE);
+  if (raw.startsWith("org:")) {
+    const name = raw.slice("org:".length).trim();
+    if (!name) {
+      console.error("org: 后面要跟组织名称（crab hr orgs 查看）。");
+      return EXIT_USAGE;
+    }
+    const hit = orgs.filter((o) => o.name === name && o.status === "active");
+    if (hit.length === 1)
+      return hit[0];
+    console.error(hit.length === 0 ? `没有名为「${name}」的 active 组织。` : `「${name}」命中多个组织，请用组织 id 指定。`);
+    return EXIT_NOT_FOUND;
   }
-  case "storage": {
-    const sub = args[1];
-    if (sub === "ls")
-      process.exit(await storageList());
-    if (sub === "upload")
-      process.exit(await storageUpload(args.slice(2)));
-    if (sub === "download")
-      process.exit(await storageDownload(args[2]));
-    if (sub === "rename")
-      process.exit(await storageRename(args[2], args[3]));
-    if (sub === "tag")
-      process.exit(await storageTag(args[2]));
-    if (sub === "category")
-      process.exit(await storageCategory(args[2], args[3]));
-    if (sub === "publish")
-      process.exit(await storagePublish(args[2], true));
-    if (sub === "unpublish")
-      process.exit(await storagePublish(args[2], false));
-    if (sub === "rm" || sub === "restore" || sub === "purge")
-      process.exit(await storageMove(sub, args[2]));
-    if (sub === "quota")
-      process.exit(await storageQuota());
-    if (sub === "categories")
-      process.exit(await storageCategories());
-    if (sub === "mkcat")
-      process.exit(await storageMkCat(args.slice(2)));
-    if (sub === "rencat")
-      process.exit(await storageRenCat(args[2], args.slice(3)));
-    if (sub === "rmcat")
-      process.exit(await storageRmCat(args[2]));
-    if (sub === "tags")
-      process.exit(await storageTags());
-    if (sub === "share")
-      process.exit(await storageShareCmd(args[2]));
-    if (sub === "shares")
-      process.exit(await storageShares(args[2]));
-    if (sub === "unshare")
-      process.exit(await storageUnshare(args[2]));
-    if (sub === "key")
-      process.exit(await storageKeyCmd());
-    if (sub === "activity")
-      process.exit(await storageActivity());
-    console.error(sub ? `未知子命令：storage ${sub}
-` : `缺少子命令：storage ls | upload | download | rename | tag | category | publish | unpublish | rm | restore | purge | quota | categories | mkcat | rencat | rmcat | tags | share | shares | unshare | key | activity
-`);
-    console.log(usage);
-    process.exit(EXIT_USAGE);
+  const byId = orgs.find((o) => o.id === raw);
+  if (byId)
+    return byId;
+  const byName = orgs.filter((o) => o.name === raw);
+  if (byName.length === 1)
+    return byName[0];
+  console.error(`组织标识无效：${raw}
+应为 org:<名称> 或组织 id（crab hr orgs 查看）。`);
+  return EXIT_USAGE;
+}
+function parseHrDate(text) {
+  if (text === undefined || text.trim() === "")
+    return;
+  const [y, m, d] = text.trim().split("-").map(Number);
+  if (!y || !m || !d)
+    return null;
+  const ms = new Date(y, m - 1, d).getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+async function resolveStoreArg(credentials) {
+  const arg = readFlag("--store") ?? credentials.shopStore;
+  const res = await api2(credentials.apiBase, "/v1/shop/stores", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取店铺列表失败。"));
+    return exitCodeForApiError(res.body);
   }
-  case "credits": {
-    const sub = args[1];
-    if (!sub || sub === "balance")
-      process.exit(await creditsBalance());
+  const stores = res.body.data.stores;
+  const wanted = arg ? stores.find((x) => x.slug === arg || x.id === arg) : undefined;
+  if (arg && !wanted) {
+    console.error(`找不到店铺 ${arg}（crab shop status 查看可用的 slug；crab shop use <slug> 切换当前店）`);
+    return EXIT_NOT_FOUND;
+  }
+  if (wanted)
+    return wanted;
+  if (stores.length === 1)
+    return stores[0];
+  console.error("该账号有多家店铺：先 crab shop use <slug> 设置当前店，或单条命令用 --store <slug> 临时指定");
+  return EXIT_USAGE;
+}
+var SHOP_PERMS = ["products", "orders", "aftercare", "customers", "marketing", "finance", "team", "settings"];
+function shopWebBase(apiBase) {
+  if (/127\.0\.0\.1:14321|localhost:14321/.test(apiBase))
+    return "http://127.0.0.1:14341";
+  try {
+    return `https://shop.${new URL(apiBase).host.replace(/^api\./, "")}`;
+  } catch {
+    return apiBase;
+  }
+}
+function parseCsvPermList(raw) {
+  if (!raw)
+    return null;
+  const items = raw.split(",").map((x) => x.trim()).filter(Boolean);
+  const invalid = items.filter((x) => !SHOP_PERMS.includes(x));
+  if (invalid.length > 0) {
+    console.error(`未知权限项：${invalid.join(", ")}
+可用：${SHOP_PERMS.join(", ")}`);
+    return null;
+  }
+  return items;
+}
+async function shopRoles() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const res = await api2(credentials.apiBase, `/v1/shop/stores/${store.id}/roles`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取角色列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const roles = res.body.data.roles;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(roles, null, 2));
+    return 0;
+  }
+  console.log(`「${store.name}」角色预设（模板套用：改模板不影响已套用成员）：`);
+  for (const r of roles) {
+    console.log(`  ${r.name}${r.builtin ? "（默认）" : ""}  [${r.permissions.join(", ") || "无权限"}]  匹配成员 ${r.memberCount}`);
+  }
+  return 0;
+}
+async function fetchStoreMembers(credentials, storeId) {
+  const res = await api2(credentials.apiBase, `/v1/shop/stores/${storeId}/members`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取成员列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  return res.body.data.members;
+}
+async function shopMembers() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const members = await fetchStoreMembers(credentials, store.id);
+  if (typeof members === "number")
+    return members;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(members, null, 2));
+    return 0;
+  }
+  console.log(`「${store.name}」成员：`);
+  for (const m of members) {
+    const biz = m.bizRoles.length > 0 ? m.bizRoles.join("/") : "无业务身份";
+    console.log(`  ${m.displayName || m.username} (@${m.username})  [${m.role === "owner" ? "店主" : m.permissions.join(", ") || "无权限"}]  身份: ${biz}  归属客户: ${m.assignedCustomers}  ${m.status}`);
+  }
+  return 0;
+}
+async function shopMemberEdit() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = args.slice(3).filter((x) => !x.startsWith("--") && args[args.indexOf(x) - 1] !== "--perms" && args[args.indexOf(x) - 1] !== "--biz");
+  const username = positional[0];
+  const permsRaw = readFlag("--perms");
+  const bizRaw = readFlag("--biz");
+  if (!username || !permsRaw) {
+    console.error(`用法：crab shop member edit <用户名> --perms <a,b,c> [--biz sales,support] --store <slug>
+权限项：products, orders, aftercare, customers, marketing, finance, team, settings`);
+    return EXIT_USAGE;
+  }
+  const permissions = parseCsvPermList(permsRaw);
+  if (permissions === null)
+    return EXIT_USAGE;
+  let bizRoles;
+  if (bizRaw !== undefined) {
+    bizRoles = bizRaw.split(",").map((x) => x.trim()).filter(Boolean);
+    const invalid = bizRoles.filter((x) => x !== "sales" && x !== "support");
+    if (invalid.length > 0) {
+      console.error(`未知业务身份：${invalid.join(", ")}（可选 sales / support，可逗号分隔多选）`);
+      return EXIT_USAGE;
+    }
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const members = await fetchStoreMembers(credentials, store.id);
+  if (typeof members === "number")
+    return members;
+  const member = members.find((m) => m.username === username);
+  if (!member) {
+    console.error(`成员不存在：@${username}（crab shop members 查看）`);
+    return EXIT_NOT_FOUND;
+  }
+  if (member.role === "owner") {
+    console.error("店主由店铺归属决定，权限不可修改。");
+    return 1;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/members/${member.id}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ permissions, ...bizRoles !== undefined ? { bizRoles } : {} })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "更新成员权限失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const updated = res.body.data.member;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(updated, null, 2));
+    return 0;
+  }
+  console.log(`✓ @${username} 权限已更新：[${permissions.join(", ")}]${bizRoles !== undefined ? ` · 业务身份：${bizRoles.length > 0 ? bizRoles.join("/") : "无"}` : `（业务身份保持：${member.bizRoles.join("/") || "无"}）`}`);
+  return 0;
+}
+async function shopInvite() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const reset = hasFlag("--reset");
+  const permsRaw = readFlag("--perms");
+  const bizRaw = readFlag("--biz");
+  let body = {};
+  if (reset) {
+    const permissions = permsRaw ? parseCsvPermList(permsRaw) : null;
+    if (permsRaw && permissions === null)
+      return EXIT_USAGE;
+    body = { permissions: permissions ?? ["orders", "customers"], bizRoles: bizRaw ? bizRaw.split(",").map((x) => x.trim()).filter(Boolean) : [] };
+  }
+  const path = reset ? `/v1/shop/stores/${store.id}/invite/reset` : `/v1/shop/stores/${store.id}/invite`;
+  const res = await api2(credentials.apiBase, path, {
+    method: reset ? "POST" : "GET",
+    headers: authHeaders(credentials),
+    ...reset ? { body: JSON.stringify(body) } : {}
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取邀请链接失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const invite = res.body.data.invite;
+  const url = `${shopWebBase(credentials.apiBase)}/join/${store.slug}?t=${invite.token}`;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify({ ...invite, joinUrl: url }, null, 2));
+    return 0;
+  }
+  console.log(`${reset ? "已重置，新邀请链接（旧链接作废）：" : "常驻邀请链接："}`);
+  console.log(`  ${url}`);
+  console.log(`  受邀默认权限：[${invite.permissions.join(", ")}] · 业务身份：${invite.bizRoles.length > 0 ? invite.bizRoles.join("/") : "无"}`);
+  console.log("  对方打开链接登录后一键加入；--reset --perms <a,b> --biz <sales,support> 可重置并改默认组合。");
+  return 0;
+}
+async function shopUse(slug) {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  if (!slug) {
+    if (credentials.shopStore)
+      console.log(`当前店铺：${credentials.shopStore}（crab shop use <slug> 切换）`);
+    else
+      console.log("未设置当前店。crab shop use <slug> 设置（多店账号店级命令需要）。");
+    return 0;
+  }
+  const res = await api2(credentials.apiBase, "/v1/shop/stores", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取店铺列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const stores = res.body.data.stores;
+  const hit = stores.find((x) => x.slug === slug || x.id === slug);
+  if (!hit) {
+    console.error(`找不到店铺 ${slug}（crab shop status 查看）`);
+    return EXIT_NOT_FOUND;
+  }
+  saveCredentials({ ...credentials, shopStore: hit.slug });
+  console.log(`✓ 当前店铺切换为「${hit.name}」（${hit.slug}）——店级命令缺省作用于它，--store 可临时覆盖`);
+  return 0;
+}
+async function shopStatus() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const json = hasFlag("--json");
+  const [storesRes, appRes] = await Promise.all([
+    api2(credentials.apiBase, "/v1/shop/stores", { headers: authHeaders(credentials) }),
+    api2(credentials.apiBase, "/v1/shop/applications/mine", { headers: authHeaders(credentials) })
+  ]);
+  if (storesRes.status !== 200) {
+    console.error(errorMessage(storesRes.body, "获取店铺列表失败。"));
+    return exitCodeForApiError(storesRes.body);
+  }
+  const stores = storesRes.body.data.stores;
+  const application = appRes.body.data.application;
+  if (json) {
+    console.log(JSON.stringify({ stores, application }, null, 2));
+    return 0;
+  }
+  const statusText = { pending: "审核中", approved: "已通过", rejected: "已拒绝" };
+  if (application) {
+    const line = `申请 ${application.name}［${application.kind === "seller" ? "卖家开通" : "增开店铺"}］：${statusText[application.status] ?? application.status}`;
+    console.log(application.status === "rejected" ? `${line} — 理由：${application.reviewNote || "未填写"}` : line);
+  }
+  if (stores.length === 0) {
+    console.log(application?.status === "pending" ? "（审核通过后店铺自动出现在这里）" : "还没有店铺。运行 crab shop apply <店铺名> 提交开店申请。");
+    return 0;
+  }
+  console.log(`共 ${stores.length} 家店铺${credentials.shopStore ? "（★ = 当前店）" : ""}：`);
+  for (const store of stores) {
+    const star = credentials.shopStore === store.slug ? "★ " : "  ";
+    console.log(`${star}${store.name}  [${store.myRole}]  ${store.slug}${store.status === "archived" ? "（已下架）" : ""}  id: ${store.id}`);
+  }
+  if (stores.length > 1)
+    console.log("（crab shop use <slug> 切换当前店；单条命令也可 --store <slug>）");
+  return 0;
+}
+async function shopApply(name, tagline) {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/shop/applications", {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ name, ...tagline ? { tagline } : {} })
+  });
+  if (res.status !== 201) {
+    console.error(errorMessage(res.body, "提交开店申请失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const application = res.body.data.application;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(application, null, 2));
+    return 0;
+  }
+  console.log(`✓ 申请已提交（${application.id}）`);
+  console.log(`  类型：${application.kind === "seller" ? "卖家开通（首店）" : "增开店铺"} · 状态：审核中`);
+  console.log("  平台审核通过后店铺自动开通（增开店铺在通过时扣积分）；crab shop status 查看进度。");
+  return 0;
+}
+function shopPositionals(start, valueFlags) {
+  const positional = [];
+  const rest = args.slice(start);
+  for (let i = 0;i < rest.length; i++) {
+    if (valueFlags.includes(rest[i])) {
+      i++;
+      continue;
+    }
+    if (rest[i]?.startsWith("--"))
+      continue;
+    positional.push(rest[i]);
+  }
+  return positional;
+}
+async function fetchStoreCategories(credentials, storeId) {
+  const res = await api2(credentials.apiBase, `/v1/shop/stores/${storeId}/categories`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取分类列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  return res.body.data.categories;
+}
+function resolveCategoryRef(list, ref) {
+  const byId = list.find((c) => c.id === ref);
+  if (byId)
+    return byId;
+  const byName = list.filter((c) => c.name === ref);
+  if (byName.length === 1)
+    return byName[0];
+  if (byName.length > 1)
+    return `名称「${ref}」有 ${byName.length} 个同名分类，请用 id 指定（crab shop categories 查看）`;
+  return `分类不存在：${ref}（crab shop categories 查看）`;
+}
+async function shopCategories() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const categories = await fetchStoreCategories(credentials, store.id);
+  if (typeof categories === "number")
+    return categories;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(categories, null, 2));
+    return 0;
+  }
+  if (categories.length === 0) {
+    console.log(`「${store.name}」还没有分类。crab shop category add <名称> 创建。`);
+    return 0;
+  }
+  console.log(`「${store.name}」分类树（名称后 = 商品数）：`);
+  const byParent = new Map;
+  for (const c of categories) {
+    const key = c.parentId ?? "";
+    byParent.set(key, [...byParent.get(key) ?? [], c]);
+  }
+  const print = (parentId, depth) => {
+    for (const c of byParent.get(parentId ?? "") ?? []) {
+      console.log(`${"  ".repeat(depth * 2)}  ${c.name}  (${c.productCount})  ${c.id}`);
+      print(c.id, depth + 1);
+    }
+  };
+  print(null, 0);
+  return 0;
+}
+async function shopCategoryAdd() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, ["--parent"]);
+  const name = positional.join(" ").trim();
+  const parentRef = readFlag("--parent");
+  if (!name) {
+    console.error("用法：crab shop category add <名称> [--parent <分类 id 或名称>] --store <slug>");
+    return EXIT_USAGE;
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  let parentId;
+  if (parentRef) {
+    const categories = await fetchStoreCategories(credentials, store.id);
+    if (typeof categories === "number")
+      return categories;
+    const parent = resolveCategoryRef(categories, parentRef);
+    if (typeof parent === "string") {
+      console.error(parent);
+      return EXIT_NOT_FOUND;
+    }
+    parentId = parent.id;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/stores/${store.id}/categories`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ name, ...parentId ? { parentId } : {} })
+  });
+  if (res.status !== 201) {
+    console.error(errorMessage(res.body, "创建分类失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const category = res.body.data.category;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(category, null, 2));
+    return 0;
+  }
+  console.log(`✓ 分类已创建：${category.name}（${category.id}，落同级末尾）`);
+  return 0;
+}
+async function shopCategoryRename() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, []);
+  const ref = positional[0];
+  const name = positional.slice(1).join(" ").trim();
+  if (!ref || !name) {
+    console.error("用法：crab shop category rename <分类 id 或名称> <新名称> --store <slug>");
+    return EXIT_USAGE;
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const categories = await fetchStoreCategories(credentials, store.id);
+  if (typeof categories === "number")
+    return categories;
+  const target = resolveCategoryRef(categories, ref);
+  if (typeof target === "string") {
+    console.error(target);
+    return EXIT_NOT_FOUND;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/categories/${target.id}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ name })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "重命名分类失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(res.body.data.category, null, 2));
+  else
+    console.log(`✓ 已重命名：${target.name} → ${name}`);
+  return 0;
+}
+async function shopCategoryMove() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, []);
+  const ref = positional[0];
+  const direction = positional[1];
+  if (!ref || direction !== "up" && direction !== "down") {
+    console.error(`用法：crab shop category move <分类 id 或名称> <up|down> --store <slug>
+（同级内上移/下移一位；已在边界时静默不动）`);
+    return EXIT_USAGE;
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const categories = await fetchStoreCategories(credentials, store.id);
+  if (typeof categories === "number")
+    return categories;
+  const target = resolveCategoryRef(categories, ref);
+  if (typeof target === "string") {
+    console.error(target);
+    return EXIT_NOT_FOUND;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/categories/${target.id}/move`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ direction })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "移动分类失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(res.body.data.category, null, 2));
+  else
+    console.log(`✓ 已${direction === "up" ? "上移" : "下移"}：${target.name}`);
+  return 0;
+}
+async function shopCategoryDelete() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, []);
+  const ref = positional[0];
+  if (!ref) {
+    console.error(`用法：crab shop category delete <分类 id> --store <slug>
+（有子分类时会被拒绝；叶子分类删除后旗下商品迁入「未分类」）`);
+    return EXIT_USAGE;
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const categories = await fetchStoreCategories(credentials, store.id);
+  if (typeof categories === "number")
+    return categories;
+  const target = resolveCategoryRef(categories, ref);
+  if (typeof target === "string") {
+    console.error(target);
+    return EXIT_NOT_FOUND;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/categories/${target.id}`, {
+    method: "DELETE",
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "删除分类失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  if (hasFlag("--json"))
+    console.log(JSON.stringify({ ok: true }, null, 2));
+  else
+    console.log(`✓ 已删除分类：${target.name}（旗下商品迁入「未分类」）`);
+  return 0;
+}
+async function fetchSpecGroups(credentials, storeId) {
+  const res = await api2(credentials.apiBase, `/v1/shop/stores/${storeId}/spec-groups`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取规格库失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  return res.body.data.groups;
+}
+function resolveSpecGroupRef(list, ref) {
+  const byId = list.find((g) => g.id === ref);
+  if (byId)
+    return byId;
+  const byName = list.filter((g) => g.name === ref);
+  if (byName.length === 1)
+    return byName[0];
+  if (byName.length > 1)
+    return `名称「${ref}」有 ${byName.length} 个同名模板，请用 id 指定（crab shop specs 查看）`;
+  return `规格模板不存在：${ref}（crab shop specs 查看）`;
+}
+function parseSpecValues(flagName) {
+  const raw = readFlag(flagName);
+  if (raw === undefined)
+    return null;
+  const values = raw.split(/[,，、]+/).map((x) => x.trim()).filter(Boolean);
+  if (values.length === 0 || values.length > 20) {
+    console.error("选项值需 1-20 个（逗号分隔；重复值自动去重）。");
+    return null;
+  }
+  return values;
+}
+async function shopSpecs() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const groups = await fetchSpecGroups(credentials, store.id);
+  if (typeof groups === "number")
+    return groups;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(groups, null, 2));
+    return 0;
+  }
+  if (groups.length === 0) {
+    console.log(`「${store.name}」规格库还是空的。crab shop spec add <名称> --values <a,b,c> 创建模板。`);
+    return 0;
+  }
+  console.log(`「${store.name}」规格库（引用 = 快照拷贝进商品，改模板不影响已建商品）：`);
+  for (const g of groups) {
+    console.log(`  ${g.name}  [${g.values.join(" / ")}]  引用商品 ${g.productCount}  ${g.id}`);
+  }
+  return 0;
+}
+async function shopSpecAdd() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, ["--values"]);
+  const name = positional.join(" ").trim();
+  const values = parseSpecValues("--values");
+  if (!name || values === null) {
+    console.error("用法：crab shop spec add <名称> --values <值1,值2,…> --store <slug>");
+    return EXIT_USAGE;
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const res = await api2(credentials.apiBase, `/v1/shop/stores/${store.id}/spec-groups`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ name, values })
+  });
+  if (res.status !== 201) {
+    console.error(errorMessage(res.body, "创建规格模板失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const group = res.body.data.group;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(group, null, 2));
+    return 0;
+  }
+  console.log(`✓ 模板已创建：${group.name} [${group.values.join(" / ")}]（${group.id}）`);
+  return 0;
+}
+async function shopSpecUpdate() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, ["--name", "--values"]);
+  const ref = positional[0];
+  const name = readFlag("--name");
+  const values = readFlag("--values") !== undefined ? parseSpecValues("--values") : undefined;
+  if (!ref || name === undefined && values === undefined) {
+    console.error("用法：crab shop spec update <模板 id 或名称> [--name <新名>] [--values <a,b,c>] --store <slug>");
+    return EXIT_USAGE;
+  }
+  if (values === null)
+    return EXIT_USAGE;
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const groups = await fetchSpecGroups(credentials, store.id);
+  if (typeof groups === "number")
+    return groups;
+  const target = resolveSpecGroupRef(groups, ref);
+  if (typeof target === "string") {
+    console.error(target);
+    return EXIT_NOT_FOUND;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/spec-groups/${target.id}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ ...name !== undefined ? { name: name.trim() } : {}, ...values !== undefined ? { values } : {} })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "更新规格模板失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const group = res.body.data.group;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(group, null, 2));
+  else
+    console.log(`✓ 模板已更新：${group.name} [${group.values.join(" / ")}]（已建商品不受影响）`);
+  return 0;
+}
+async function shopSpecDelete() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const positional = shopPositionals(3, []);
+  const ref = positional[0];
+  if (!ref) {
+    console.error(`用法：crab shop spec delete <模板 id 或名称> --store <slug>
+（引用 = 快照拷贝：删除不影响已建商品）`);
+    return EXIT_USAGE;
+  }
+  const store = await resolveStoreArg(credentials);
+  if (typeof store === "number")
+    return store;
+  const groups = await fetchSpecGroups(credentials, store.id);
+  if (typeof groups === "number")
+    return groups;
+  const target = resolveSpecGroupRef(groups, ref);
+  if (typeof target === "string") {
+    console.error(target);
+    return EXIT_NOT_FOUND;
+  }
+  const res = await api2(credentials.apiBase, `/v1/shop/spec-groups/${target.id}`, {
+    method: "DELETE",
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "删除规格模板失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  if (hasFlag("--json"))
+    console.log(JSON.stringify({ ok: true }, null, 2));
+  else
+    console.log(`✓ 已删除模板：${target.name}（已引用商品不受影响）`);
+  return 0;
+}
+async function hrOrgsList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/hr/orgs", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取组织列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const orgs = res.body.data.orgs;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(orgs, null, 2));
+    return 0;
+  }
+  if (orgs.length === 0) {
+    console.log("还没有公司 / 组织。");
+    return 0;
+  }
+  for (const org of orgs) {
+    console.log(`${org.name}  [${org.myRole}]  ${hrOrgToken(org)}  id: ${org.id}`);
+  }
+  return 0;
+}
+async function hrOrgCreate(name) {
+  if (!name) {
+    console.error("用法：crab hr org create <名称> [--json]");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/hr/orgs", {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ name })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "创建组织失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const org = res.body.data.org;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(org, null, 2));
+    return 0;
+  }
+  console.log(`✓ 已创建 ${org.name}（你是 owner）。提示：重新授权绑定该组织：crab login --scopes hr --org ${hrOrgToken(org)}`);
+  return 0;
+}
+async function hrMembersList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/members`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取成员列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const members = res.body.data.members;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(members, null, 2));
+    return 0;
+  }
+  console.log(`组织：${hrOrgToken(org)}`);
+  for (const m of members) {
+    const flags = Object.entries(m.permissions).filter(([, v]) => v).map(([k]) => k).join(",") || "只读";
+    console.log(`${m.username}${m.title ? `（${m.title}）` : ""}  [${m.role}]  ${flags}  id: ${m.id}${m.status !== "active" ? ` · ${m.status}` : ""}`);
+  }
+  return 0;
+}
+async function hrMemberAdd() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const username = positionalArgs(args.slice(3), HR_VALUED_FLAGS);
+  const target = username[0];
+  if (!target) {
+    console.error("用法：crab hr member add <用户名> [--title 头衔] [--org <arg>]");
+    return EXIT_USAGE;
+  }
+  const title = readFlag("--title");
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/members`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ username: target, ...title ? { title } : {} })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "邀请成员失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(res.body.data, null, 2));
+  else
+    console.log(`✓ 已把 ${target} 加入 ${org.name}（member，只读；用 hr member set 提权）。`);
+  return 0;
+}
+function parsePermissionFlags(text) {
+  if (!text)
+    return;
+  const out = {};
+  for (const pair of text.split(",").map((x) => x.trim()).filter(Boolean)) {
+    const [key, value] = pair.split("=");
+    if (!key)
+      continue;
+    out[key.trim()] = value !== "0" && value?.toLowerCase() !== "false";
+  }
+  return out;
+}
+async function hrMemberSet() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const target = positionalArgs(args.slice(3), HR_VALUED_FLAGS)[0];
+  const role = readFlag("--role");
+  const permissions = parsePermissionFlags(readFlag("--permissions"));
+  const title = readFlag("--title");
+  if (!target || !role && !permissions && title === undefined) {
+    console.error("用法：crab hr member set <memberId> [--role admin|member] [--permissions org.manage=1,people.write=1,tasks.write=1,sensitive.read=0] [--title 头衔] [--org <arg>]");
+    return EXIT_USAGE;
+  }
+  if (role && role !== "admin" && role !== "member") {
+    console.error("--role 只接受 admin | member（owner 不可改）。");
+    return EXIT_USAGE;
+  }
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/members/${encodeURIComponent(target)}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ ...role ? { role } : {}, ...permissions ? { permissions } : {}, ...title !== undefined ? { title } : {} })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "更新成员失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const member = res.body.data.member;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(member, null, 2));
+  else
+    console.log(`✓ 已更新 ${member?.username ?? target}（${member?.role ?? "?"}）。`);
+  return 0;
+}
+async function hrMemberRm() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const target = positionalArgs(args.slice(3), HR_VALUED_FLAGS)[0];
+  if (!target) {
+    console.error("用法：crab hr member rm <memberId> [--org <arg>]（id 见 crab hr members）");
+    return EXIT_USAGE;
+  }
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/members/${encodeURIComponent(target)}`, {
+    method: "DELETE",
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "移除成员失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(res.body.data, null, 2));
+  else
+    console.log("✓ 已移除成员（可随时重新邀请）。");
+  return 0;
+}
+async function hrInvite() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const path = hasFlag("--reset") ? "/invite/reset" : "/invite";
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}${path}`, { method: hasFlag("--reset") ? "POST" : "GET", headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取邀请链接失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const invite = res.body.data.invite;
+  const main = credentials.apiBase.includes("127.0.0.1") ? "http://127.0.0.1:14331" : "https://crabcloud.cc";
+  const link = `${main}/register?invite=${invite.token}`;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify({ ...invite, link }, null, 2));
+  else {
+    if (hasFlag("--reset"))
+      console.log("✓ 已重置（旧链接立即失效）。");
+    console.log(`邀请链接：${link}`);
+    console.log("未注册的老板 / 同事打开此链接，注册后自动加入组织。");
+  }
+  return 0;
+}
+async function hrPeopleList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const status = readFlag("--status");
+  if (status && !HR_PERSON_STATUSES.includes(status)) {
+    console.error(`未知状态：${status}
+可用：${HR_PERSON_STATUSES.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const params = new URLSearchParams;
+  const q = readFlag("--q");
+  if (q)
+    params.set("q", q);
+  if (status)
+    params.set("status", status);
+  const dept = readFlag("--dept");
+  if (dept)
+    params.set("dept", dept);
+  const limit = readFlag("--limit");
+  if (limit)
+    params.set("limit", limit);
+  const offset = readFlag("--offset");
+  if (offset)
+    params.set("offset", offset);
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people?${params}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取花名册失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify({ ...page, org: { id: org.id, name: org.name } }, null, 2));
+    return 0;
+  }
+  console.log(`组织：${hrOrgToken(org)} · 共 ${page.total} 人`);
+  if (page.people.length === 0) {
+    console.log('没有匹配的人员（crab hr person create --name "…" --hired-at YYYY-MM-DD 建档）。');
+    return 0;
+  }
+  for (const p of page.people) {
+    const day = (ms) => ms ? new Date(ms).toISOString().slice(0, 10) : "—";
+    console.log(`${p.name}  ${p.dept ? `${p.dept} · ` : ""}${p.role || "员工"}  [${p.status}]  入职 ${day(p.hiredAt)}  id: ${p.id}`);
+    if (p.alert)
+      console.log(`  ⚠ ${p.alert}`);
+  }
+  if (page.people.length < page.total)
+    console.log(`（还有更多：--offset ${(Number(offset ?? 0) || 0) + page.people.length}）`);
+  return 0;
+}
+async function hrPersonDetail(id) {
+  if (!id) {
+    console.error("用法：crab hr person <id> [--json]（id 见 crab hr people）");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people?q=${encodeURIComponent(id)}&limit=50`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取人员失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const people = res.body.data.people;
+  const person = people.find((p) => p.id === id);
+  if (!person) {
+    console.error("人员不存在或不属于当前组织。");
+    return EXIT_NOT_FOUND;
+  }
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(person, null, 2));
+    return 0;
+  }
+  const p = person;
+  const day = (ms) => ms ? new Date(ms).toISOString().slice(0, 10) : "—";
+  console.log(`${p.name}  ${p.dept ? `${p.dept} · ` : ""}${p.role || "员工"}  [${p.status}]`);
+  console.log(`  入职 ${day(p.hiredAt)} · 合同 ${p.contractType || "—"}（${day(p.contractEnd)}）`);
+  if (p.mobile || p.email)
+    console.log(`  联系方式: ${p.mobile || "—"} / ${p.email || "—"}`);
+  console.log(`  身份证: ${p.idNumber ?? "（无权限）"} · 薪资: ${p.salaryCents != null ? `¥${(p.salaryCents / 100).toFixed(2)}` : "（无权限）"}`);
+  if (p.alert)
+    console.log(`  ⚠ ${p.alert}`);
+  console.log(`  时间线: crab hr events --person ${p.id}`);
+  return 0;
+}
+async function hrPersonCreate() {
+  const name = readFlag("--name");
+  const hiredFlag = readFlag("--hired-at");
+  if (!name || !hiredFlag) {
+    console.error('用法：crab hr person create --name "姓名" --hired-at YYYY-MM-DD [--employee-no 工号] [--dept 部门] [--role 岗位] [--status active|probation] [--probation-end YYYY-MM-DD] [--contract-type 类型] [--contract-end YYYY-MM-DD] [--mobile] [--email] [--notes] [--json]');
+    return EXIT_USAGE;
+  }
+  const hired = parseHrDate(hiredFlag);
+  if (hired == null) {
+    console.error("--hired-at 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const probation = parseHrDate(readFlag("--probation-end"));
+  if (probation === null) {
+    console.error("--probation-end 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const contractEnd = parseHrDate(readFlag("--contract-end"));
+  if (contractEnd === null) {
+    console.error("--contract-end 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const status = readFlag("--status") ?? "active";
+  if (!HR_PERSON_STATUSES.includes(status) || status === "resigned") {
+    console.error("--status 只接受 active | probation（建档不直接建离职）。");
+    return EXIT_USAGE;
+  }
+  const payload = {
+    name,
+    hiredAt: hired,
+    status,
+    employeeNo: readFlag("--employee-no") ?? "",
+    dept: readFlag("--dept") ?? "",
+    role: readFlag("--role") ?? "",
+    mobile: readFlag("--mobile") ?? "",
+    email: readFlag("--email") ?? "",
+    notes: readFlag("--notes") ?? ""
+  };
+  if (probation != null)
+    payload.probationEnd = probation;
+  const contractType = readFlag("--contract-type");
+  if (contractType)
+    payload.contractType = contractType;
+  if (contractEnd != null)
+    payload.contractEnd = contractEnd;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify(payload)
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "建档失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const person = res.body.data.person;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(person, null, 2));
+  else
+    console.log(`✓ 已建档 ${person.name}（自动落入职事件）· id: ${person.id}`);
+  return 0;
+}
+async function hrPersonEdit() {
+  const target = positionalArgs(args.slice(3), HR_VALUED_FLAGS)[0];
+  if (!target) {
+    console.error("用法：crab hr person edit <id> [--dept] [--role] [--status active|probation|resigned] [--offboarded-at YYYY-MM-DD] [--contract-type] [--contract-end YYYY-MM-DD] [--mobile] [--email] [--notes] [--json]");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const payload = {};
+  const simple = [
+    ["--dept", "dept"],
+    ["--role", "role"],
+    ["--contract-type", "contractType"],
+    ["--mobile", "mobile"],
+    ["--email", "email"],
+    ["--notes", "notes"]
+  ];
+  for (const [flag, key] of simple) {
+    const value = readFlag(flag);
+    if (value !== undefined)
+      payload[key] = value;
+  }
+  const status = readFlag("--status");
+  if (status) {
+    if (!HR_PERSON_STATUSES.includes(status)) {
+      console.error(`--status 只接受：${HR_PERSON_STATUSES.join(", ")}`);
+      return EXIT_USAGE;
+    }
+    payload.status = status;
+  }
+  const contractEnd = parseHrDate(readFlag("--contract-end"));
+  if (contractEnd === null) {
+    console.error("--contract-end 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  if (contractEnd != null)
+    payload.contractEnd = contractEnd;
+  const offboarded = parseHrDate(readFlag("--offboarded-at"));
+  if (offboarded === null) {
+    console.error("--offboarded-at 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  if (offboarded != null)
+    payload.offboardedAt = offboarded;
+  if (Object.keys(payload).length === 0) {
+    console.error("没有要更新的字段。");
+    return EXIT_USAGE;
+  }
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people/${encodeURIComponent(target)}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify(payload)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "更新失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const person = res.body.data.person;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(person, null, 2));
+  else
+    console.log(`✓ 已更新 ${person?.name ?? target}（${person?.status ?? "?"}；状态流转自动落痕）。`);
+  return 0;
+}
+async function hrPersonOffboard() {
+  const target = positionalArgs(args.slice(3), HR_VALUED_FLAGS)[0];
+  if (!target) {
+    console.error("用法：crab hr person offboard <id> [--date YYYY-MM-DD] [--json]（离职封存不删，记录依法保留）");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const date = parseHrDate(readFlag("--date"));
+  if (date === null) {
+    console.error("--date 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people/${encodeURIComponent(target)}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ status: "resigned", ...date != null ? { offboardedAt: date } : {} })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "离职办理失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const person = res.body.data.person;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(person, null, 2));
+  else
+    console.log(`✓ ${person?.name ?? target} 已离职（档案封存，离职事件已落时间线）。`);
+  return 0;
+}
+async function hrEventAdd() {
+  const target = positionalArgs(args.slice(3), HR_VALUED_FLAGS)[0];
+  const type = readFlag("--type");
+  const note = readFlag("--note");
+  if (!target || !type || !note) {
+    console.error(`用法：crab hr event add <personId> --type <${HR_EVENT_TYPES.join("|")}> --note "记录内容" [--at YYYY-MM-DD] [--json]`);
+    return EXIT_USAGE;
+  }
+  if (!HR_EVENT_TYPES.includes(type)) {
+    console.error(`未知事件类型：${type}
+可用：${HR_EVENT_TYPES.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const at = parseHrDate(readFlag("--at"));
+  if (at === null) {
+    console.error("--at 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people/${encodeURIComponent(target)}/events`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ type, note, ...at != null ? { at } : {} })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "落痕失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const event = res.body.data.event;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(event, null, 2));
+  else
+    console.log(`✓ 已落痕（${type}）· 事件 id: ${event.id}`);
+  return 0;
+}
+async function hrEventsList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const type = readFlag("--type");
+  if (type && !HR_EVENT_TYPES.includes(type)) {
+    console.error(`未知事件类型：${type}
+可用：${HR_EVENT_TYPES.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const params = new URLSearchParams;
+  const person = readFlag("--person");
+  if (person)
+    params.set("personId", person);
+  if (type)
+    params.set("type", type);
+  const limit = readFlag("--limit");
+  if (limit)
+    params.set("limit", limit);
+  const offset = readFlag("--offset");
+  if (offset)
+    params.set("offset", offset);
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/events?${params}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取时间线失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify({ ...page, org: { id: org.id, name: org.name } }, null, 2));
+    return 0;
+  }
+  console.log(`组织：${hrOrgToken(org)} · 共 ${page.total} 条`);
+  for (const event of page.events) {
+    const day = new Date(event.at).toISOString().slice(0, 10);
+    console.log(`${day}  [${event.type}]  ${event.note}  person: ${event.personId}`);
+  }
+  if (page.events.length < page.total)
+    console.log(`（还有更多：--offset ${(Number(offset ?? 0) || 0) + page.events.length}）`);
+  return 0;
+}
+function parseHrImportFile(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed))
+      return { rows: parsed };
+  } catch {}
+  const lines = text.split(/\r?\n/).filter((line) => line.trim() !== "");
+  if (lines.length < 2) {
+    console.error("文件至少要有表头 + 一行数据（TSV/CSV），或 JSON 行数组。");
+    return EXIT_USAGE;
+  }
+  const delimiter = lines[0].includes("\t") ? "\t" : ",";
+  const cells = lines.map((line) => line.split(delimiter).map((cell) => cell.trim().replace(/^"|"$/g, "")));
+  const aliases = [
+    ["name", ["姓名", "名字", "name"]],
+    ["employeeNo", ["工号", "员工编号", "emp"]],
+    ["dept", ["部门", "dept"]],
+    ["role", ["岗位", "职位", "role"]],
+    ["hiredAt", ["入职", "hire"]],
+    ["probationEnd", ["试用期", "probation"]],
+    ["contractType", ["合同类型", "contract type"]],
+    ["contractEnd", ["合同到期", "合同终止", "contract end"]],
+    ["mobile", ["手机", "电话", "mobile", "phone"]],
+    ["email", ["邮箱", "email"]],
+    ["notes", ["备注", "note"]]
+  ];
+  const mapping = (cells[0] ?? []).map((header) => {
+    const lower = header.toLowerCase();
+    for (const [field, list] of aliases)
+      if (list.some((alias) => lower.includes(alias)))
+        return field;
+    return null;
+  });
+  const nameIndex = mapping.indexOf("name");
+  const hireIndex = mapping.indexOf("hiredAt");
+  if (nameIndex < 0 || hireIndex < 0) {
+    console.error("表头里没认出「姓名」和「入职」列——JSON 数组格式不受此限。");
+    return EXIT_USAGE;
+  }
+  const rows = [];
+  for (const row of cells.slice(1)) {
+    const record = {};
+    let skip = false;
+    mapping.forEach((field, index) => {
+      if (!field)
+        return;
+      const value = (row[index] ?? "").trim();
+      if (!value)
+        return;
+      if (field === "hiredAt" || field === "probationEnd" || field === "contractEnd") {
+        const [y, m, d] = value.replace(/[/.]/g, "-").split("-").map(Number);
+        const ms = y && m && d ? new Date(y, m - 1, d).getTime() : NaN;
+        if (!Number.isFinite(ms)) {
+          skip = true;
+          return;
+        }
+        record[field] = ms;
+      } else {
+        record[field] = value;
+      }
+    });
+    if (!skip && record.name && record.hiredAt)
+      rows.push(record);
+  }
+  return { rows };
+}
+async function hrImport() {
+  const file = positionalArgs(args.slice(2), HR_VALUED_FLAGS)[0];
+  if (!file) {
+    console.error("用法：crab hr import <文件.csv|.tsv|.json> [--org <arg>] [--json]（≤200 行；CSV/TSV 首行表头，姓名与入职列必填）");
+    return EXIT_USAGE;
+  }
+  let text;
+  try {
+    text = readFileSync2(file, "utf8");
+  } catch {
+    console.error(`读取文件失败：${file}`);
+    return EXIT_USAGE;
+  }
+  const parsed = parseHrImportFile(text);
+  if (typeof parsed === "number")
+    return parsed;
+  if (parsed.rows.length === 0) {
+    console.error("没有可导入的行（姓名/入职日期缺失或日期格式不对）。");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/people/import`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ rows: parsed.rows.slice(0, 200) })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "导入失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const report = res.body.data.report;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(report, null, 2));
+  else {
+    console.log(`✓ 导入完成：新建 ${report.created} 人${parsed.rows.length > 200 ? `（仅前 200 行，共 ${parsed.rows.length} 行）` : ""}。`);
+    if (report.failed.length)
+      console.log(`  失败 ${report.failed.length} 行：#${report.failed.map((f) => f.row + 1).join(", #")}`);
+  }
+  return 0;
+}
+async function hrTasksList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const status = readFlag("--status");
+  if (status && !HR_TASK_STATUSES.includes(status)) {
+    console.error(`未知状态：${status}
+可用：${HR_TASK_STATUSES.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const params = new URLSearchParams;
+  if (status)
+    params.set("status", status);
+  const kind = readFlag("--kind");
+  if (kind)
+    params.set("kind", kind);
+  const limit = readFlag("--limit");
+  if (limit)
+    params.set("limit", limit);
+  const offset = readFlag("--offset");
+  if (offset)
+    params.set("offset", offset);
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/tasks?${params}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取任务失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify({ ...page, org: { id: org.id, name: org.name } }, null, 2));
+    return 0;
+  }
+  console.log(`组织：${hrOrgToken(org)} · 共 ${page.total} 条`);
+  for (const task of page.tasks) {
+    const due = task.dueAt ? new Date(task.dueAt).toISOString().slice(0, 10) : "—";
+    console.log(`[${task.status}] ${task.title}  ${task.node || ""}  (${task.kind} · 截止 ${due})  id: ${task.id}`);
+  }
+  if (page.tasks.length < page.total)
+    console.log(`（还有更多：--offset ${(Number(offset ?? 0) || 0) + page.tasks.length}）`);
+  return 0;
+}
+async function hrTaskCreate() {
+  const kind = readFlag("--kind");
+  const title = readFlag("--title");
+  if (!kind || !title) {
+    console.error('用法：crab hr task create --kind <attendance|payroll|contract|recruit|meeting|asset|admin|...> --title "..." [--node 节点说明] [--detail 详情] [--due YYYY-MM-DD] [--status alert|confirm|queued|done] [--json]');
+    return EXIT_USAGE;
+  }
+  const status = readFlag("--status");
+  if (status && !HR_TASK_STATUSES.includes(status)) {
+    console.error(`未知状态：${status}
+可用：${HR_TASK_STATUSES.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const due = parseHrDate(readFlag("--due"));
+  if (due === null) {
+    console.error("--due 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/tasks`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ kind, title, node: readFlag("--node") ?? "", detail: readFlag("--detail") ?? "", ...status ? { status } : {}, ...due != null ? { dueAt: due } : {} })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "创建任务失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const task = res.body.data.task;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(task, null, 2));
+  else
+    console.log(`✓ 已创建任务 ${task.title} · id: ${task.id}`);
+  return 0;
+}
+async function hrTaskUpdate() {
+  const target = positionalArgs(args.slice(3), HR_VALUED_FLAGS)[0];
+  const status = readFlag("--status");
+  if (!target || !status && readFlag("--node") === undefined && readFlag("--detail") === undefined && readFlag("--due") === undefined) {
+    console.error("用法：crab hr task update <id> [--status alert|confirm|queued|done] [--node 节点说明] [--detail 详情] [--due YYYY-MM-DD] [--json]");
+    return EXIT_USAGE;
+  }
+  if (status && !HR_TASK_STATUSES.includes(status)) {
+    console.error(`未知状态：${status}
+可用：${HR_TASK_STATUSES.join(", ")}`);
+    return EXIT_USAGE;
+  }
+  const due = parseHrDate(readFlag("--due"));
+  if (due === null) {
+    console.error("--due 格式应为 YYYY-MM-DD。");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/tasks/${encodeURIComponent(target)}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ ...status ? { status } : {}, ...readFlag("--node") !== undefined ? { node: readFlag("--node") } : {}, ...readFlag("--detail") !== undefined ? { detail: readFlag("--detail") } : {}, ...due != null ? { dueAt: due } : {} })
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "更新任务失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const task = res.body.data.task;
+  if (hasFlag("--json"))
+    console.log(JSON.stringify(task, null, 2));
+  else
+    console.log(`✓ 已更新 ${task.title}（${task.status}）。`);
+  return 0;
+}
+async function hrDesk() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const org = await resolveHrOrg(credentials, readFlag("--org"));
+  if (typeof org === "number")
+    return org;
+  const res = await api2(credentials.apiBase, `/v1/hr/orgs/${encodeURIComponent(org.id)}/desk`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取工作台失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const desk = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify({ ...desk, org: { id: org.id, name: org.name } }, null, 2));
+    return 0;
+  }
+  console.log(`组织：${hrOrgToken(org)} · 工作台`);
+  console.log(`
+等你拍板：`);
+  for (const task of desk.desk.pending)
+    console.log(`  [${task.status}] ${task.title}  ${task.node || ""}  id: ${task.id}`);
+  if (!desk.desk.pending.length)
+    console.log("  （空）");
+  console.log(`
+助理在办：`);
+  for (const task of desk.desk.running)
+    console.log(`  ${task.title}  ${task.node || ""}  id: ${task.id}`);
+  if (!desk.desk.running.length)
+    console.log("  （空）");
+  console.log(`
+近期完成：`);
+  for (const task of desk.desk.done)
+    console.log(`  ${task.title}  ${task.node || ""}`);
+  if (!desk.desk.done.length)
+    console.log("  （空）");
+  console.log(`
+替你盯着：`);
+  for (const reminder of desk.desk.reminders)
+    console.log(`  ⚠ ${reminder.text}（${reminder.days < 0 ? `过期 ${-reminder.days} 天` : `剩 ${reminder.days} 天`}）`);
+  if (!desk.desk.reminders.length)
+    console.log("  （无）");
+  console.log(`
+最近动态：`);
+  for (const event of desk.desk.recentEvents.slice(0, 8)) {
+    const day = new Date(event.at).toISOString().slice(0, 10);
+    console.log(`  ${day}  ${event.personName ? `${event.personName} · ` : ""}${event.note}`);
+  }
+  if (!desk.desk.recentEvents.length)
+    console.log("  （无）");
+  return 0;
+}
+switch (command) {
+  case "init":
+    process.exit(await init());
+  case "login":
+    process.exit(await login());
+  case "whoami":
+    process.exit(await whoami());
+  case "tokens": {
+    const sub = args[1];
+    if (sub === "list")
+      process.exit(await tokensList());
+    if (sub === "revoke")
+      process.exit(await tokensRevoke(args[2]));
+    console.error(sub ? `未知子命令：tokens ${sub}
+` : `缺少子命令：tokens list | tokens revoke <id>
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "skills": {
+    const sub = args[1];
+    if (sub === "install")
+      process.exit(installSkills(args.slice(2)));
+    if (sub === "list")
+      process.exit(listSkills());
+    if (sub === "uninstall")
+      process.exit(uninstallSkills(args.slice(2)));
+    console.error(`用法：crab skills install | list | uninstall [--agent claude,zcode,codex,agents]
+`);
+    process.exit(EXIT_USAGE);
+  }
+  case "mail": {
+    const sub = args[1];
+    if (sub === "list")
+      process.exit(await mailList());
+    if (sub === "read")
+      process.exit(await mailRead(args[2]));
+    if (sub === "unread")
+      process.exit(await mailUnread(args[2]));
+    if (sub === "search")
+      process.exit(await mailSearch(args.slice(2).join(" ") || undefined));
+    if (sub === "send")
+      process.exit(await mailSend());
+    if (sub === "archive" || sub === "trash" || sub === "delete")
+      process.exit(await mailMove(sub, args[2]));
+    if (sub === "folders")
+      process.exit(await mailFoldersOverview());
+    if (sub === "activity")
+      process.exit(await mailActivity());
+    console.error(sub ? `未知子命令：mail ${sub}
+` : `缺少子命令：mail list | read | unread | search | send | archive | trash | delete | folders | activity
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "contacts": {
+    const sub = args[1];
+    if (sub === "list")
+      process.exit(await contactsList(args.slice(2).join(" ") || undefined));
+    if (sub === "add")
+      process.exit(await contactsAdd(args[2]));
+    if (sub === "rm")
+      process.exit(await contactsRm(args[2]));
+    if (sub === "invite")
+      process.exit(await contactsInvite(hasFlag("--reset")));
+    if (sub === "invitees")
+      process.exit(await contactsInvitees());
+    console.error(sub ? `未知子命令：contacts ${sub}
+` : `缺少子命令：contacts list | add | rm | invite | invitees
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "storage": {
+    const sub = args[1];
+    if (sub === "ls")
+      process.exit(await storageList());
+    if (sub === "upload")
+      process.exit(await storageUpload(args.slice(2)));
+    if (sub === "download")
+      process.exit(await storageDownload(args[2]));
+    if (sub === "rename")
+      process.exit(await storageRename(args[2], args[3]));
+    if (sub === "tag")
+      process.exit(await storageTag(args[2]));
+    if (sub === "category")
+      process.exit(await storageCategory(args[2], args[3]));
+    if (sub === "publish")
+      process.exit(await storagePublish(args[2], true));
+    if (sub === "unpublish")
+      process.exit(await storagePublish(args[2], false));
+    if (sub === "rm" || sub === "restore" || sub === "purge")
+      process.exit(await storageMove(sub, args[2]));
+    if (sub === "quota")
+      process.exit(await storageQuota());
+    if (sub === "categories")
+      process.exit(await storageCategories());
+    if (sub === "mkcat")
+      process.exit(await storageMkCat(args.slice(2)));
+    if (sub === "rencat")
+      process.exit(await storageRenCat(args[2], args.slice(3)));
+    if (sub === "rmcat")
+      process.exit(await storageRmCat(args[2]));
+    if (sub === "tags")
+      process.exit(await storageTags());
+    if (sub === "share")
+      process.exit(await storageShareCmd(args[2]));
+    if (sub === "shares")
+      process.exit(await storageShares(args[2]));
+    if (sub === "unshare")
+      process.exit(await storageUnshare(args[2]));
+    if (sub === "key")
+      process.exit(await storageKeyCmd());
+    if (sub === "activity")
+      process.exit(await storageActivity());
+    console.error(sub ? `未知子命令：storage ${sub}
+` : `缺少子命令：storage ls | upload | download | rename | tag | category | publish | unpublish | rm | restore | purge | quota | categories | mkcat | rencat | rmcat | tags | share | shares | unshare | key | activity
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "agent": {
+    const sub = args[1];
+    if (sub === "status")
+      process.exit(await agentStatus());
+    if (sub === "sessions")
+      process.exit(await agentSessions());
+    if (sub === "approvals")
+      process.exit(await agentApprovals());
+    console.error(sub ? `未知子命令：agent ${sub}
+` : `缺少子命令：agent status | sessions | approvals
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "shop": {
+    const sub = args[1];
+    if (sub === "status")
+      process.exit(await shopStatus());
+    if (sub === "roles")
+      process.exit(await shopRoles());
+    if (sub === "members")
+      process.exit(await shopMembers());
+    if (sub === "member") {
+      if (args[2] === "edit")
+        process.exit(await shopMemberEdit());
+      console.error(`用法：crab shop member edit <用户名> --perms <a,b,c> [--biz sales,support] --store <slug>
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "categories")
+      process.exit(await shopCategories());
+    if (sub === "category") {
+      if (args[2] === "add")
+        process.exit(await shopCategoryAdd());
+      if (args[2] === "rename")
+        process.exit(await shopCategoryRename());
+      if (args[2] === "move")
+        process.exit(await shopCategoryMove());
+      if (args[2] === "delete")
+        process.exit(await shopCategoryDelete());
+      console.error(`用法：crab shop category add|rename|move|delete …（crab --help 看完整用法）
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "specs")
+      process.exit(await shopSpecs());
+    if (sub === "spec") {
+      if (args[2] === "add")
+        process.exit(await shopSpecAdd());
+      if (args[2] === "update")
+        process.exit(await shopSpecUpdate());
+      if (args[2] === "delete")
+        process.exit(await shopSpecDelete());
+      console.error(`用法：crab shop spec add|update|delete …（crab --help 看完整用法）
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "invite")
+      process.exit(await shopInvite());
+    if (sub === "use") {
+      const target = args.slice(2).find((x) => !x.startsWith("--"));
+      process.exit(await shopUse(target));
+    }
+    if (sub === "apply") {
+      const positional = [];
+      const rest = args.slice(2);
+      for (let i = 0;i < rest.length; i++) {
+        if (rest[i] === "--tagline") {
+          i++;
+          continue;
+        }
+        if (rest[i]?.startsWith("--"))
+          continue;
+        positional.push(rest[i]);
+      }
+      const taglineArg = readFlag("--tagline");
+      if (positional.length === 0) {
+        console.error(`用法：crab shop apply <店铺名> [--tagline 一句话介绍] [--json]
+`);
+        process.exit(EXIT_USAGE);
+      }
+      process.exit(await shopApply(positional.join(" "), taglineArg));
+    }
+    console.error(sub ? `未知子命令：shop ${sub}
+` : `缺少子命令：shop status | shop apply <店铺名>
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "credits": {
+    const sub = args[1];
+    if (!sub || sub === "balance")
+      process.exit(await creditsBalance());
     if (sub === "history")
       process.exit(await creditsHistory());
     if (sub === "pricing")
@@ -9019,6 +11446,76 @@ switch (command) {
   }
   case "post":
     process.exit(await collabPushRecord(args[1]));
+  case "hr": {
+    const sub = args[1];
+    if (sub === "orgs")
+      process.exit(await hrOrgsList());
+    if (sub === "org") {
+      if (args[2] === "create")
+        process.exit(await hrOrgCreate(args.slice(3).find((x) => !x.startsWith("--"))));
+      console.error(`用法：crab hr org create <名称> [--json]
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "members")
+      process.exit(await hrMembersList());
+    if (sub === "member") {
+      const op = args[2];
+      if (op === "add")
+        process.exit(await hrMemberAdd());
+      if (op === "set")
+        process.exit(await hrMemberSet());
+      if (op === "rm")
+        process.exit(await hrMemberRm());
+      console.error(`用法：crab hr member add|set|rm
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "invite")
+      process.exit(await hrInvite());
+    if (sub === "people")
+      process.exit(await hrPeopleList());
+    if (sub === "person") {
+      const op = args[2];
+      if (op === "create")
+        process.exit(await hrPersonCreate());
+      if (op === "edit")
+        process.exit(await hrPersonEdit());
+      if (op === "offboard")
+        process.exit(await hrPersonOffboard());
+      process.exit(await hrPersonDetail(op));
+    }
+    if (sub === "event") {
+      if (args[2] === "add")
+        process.exit(await hrEventAdd());
+      console.error(`用法：crab hr event add <personId> --type <类型> --note "..."
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "events")
+      process.exit(await hrEventsList());
+    if (sub === "import")
+      process.exit(await hrImport());
+    if (sub === "tasks")
+      process.exit(await hrTasksList());
+    if (sub === "task") {
+      const op = args[2];
+      if (op === "create")
+        process.exit(await hrTaskCreate());
+      if (op === "update")
+        process.exit(await hrTaskUpdate());
+      console.error(`用法：crab hr task create|update
+`);
+      process.exit(EXIT_USAGE);
+    }
+    if (sub === "desk")
+      process.exit(await hrDesk());
+    console.error(sub ? `未知子命令：hr ${sub}
+` : `缺少子命令：hr orgs | org create | members | member | invite | people | person | event add | events | import | tasks | task | desk
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
   case "logout":
     process.exit(await logout());
   case "version":
@@ -9037,3 +11534,73 @@ switch (command) {
     console.log(usage);
     process.exit(EXIT_USAGE);
 }
+async function agentStatus() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const [sessionsRes, approvalsRes] = await Promise.all([
+    api2(credentials.apiBase, "/v1/agent/sessions", { headers: authHeaders(credentials) }),
+    api2(credentials.apiBase, "/v1/agent/approvals", { headers: authHeaders(credentials) })
+  ]);
+  if (sessionsRes.status !== 200 || approvalsRes.status !== 200) {
+    console.error(errorMessage(sessionsRes.body ?? approvalsRes.body, "获取 Agent 状态失败。"));
+    if (sessionsRes.body?.error?.code === "scope_denied") {
+      console.error("提示：需要 agent.read scope——运行 crab login --scopes agent 重新授权。");
+    }
+    return 1;
+  }
+  const sessions = sessionsRes.body.data?.sessions ?? [];
+  const approvals = approvalsRes.body.data?.approvals ?? [];
+  const running = sessions.filter((x) => x.status === "running").length;
+  const pending = approvals.filter((x) => x.status === "pending").length;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify({ sessions: sessions.length, running, pendingApprovals: pending }, null, 2));
+    return 0;
+  }
+  console.log(`个人云 Agent：会话 ${sessions.length} · 运行中 ${running} · 待审批 ${pending}`);
+  return 0;
+}
+async function agentSessions() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/agent/sessions", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取会话列表失败。"));
+    return 1;
+  }
+  const sessions = res.body.data?.sessions ?? [];
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(sessions, null, 2));
+    return 0;
+  }
+  for (const x of sessions) {
+    console.log(`${x.kind === "task" ? "[任务]" : "[对话]"} ${x.title}  ${x.status}${x.repeatCron ? `  cron ${x.repeatCron}` : ""}  ${new Date(x.updatedAt).toLocaleString("zh-CN")}`);
+  }
+  console.log(`共 ${sessions.length} 个会话`);
+  return 0;
+}
+async function agentApprovals() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/agent/approvals", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取审批队列失败。"));
+    return 1;
+  }
+  const approvals = res.body.data?.approvals ?? [];
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(approvals, null, 2));
+    return 0;
+  }
+  if (approvals.length === 0) {
+    console.log("没有待处理或已过期的审批。");
+    return 0;
+  }
+  for (const x of approvals) {
+    console.log(`${x.status === "pending" ? "[待审批]" : "[已超时]"} ${x.tool}  ${x.sessionTitle}`);
+    console.log(`  ${x.summary.slice(0, 160)}`);
+  }
+  return 0;
+}