@datarails-ai/dr-cli 1.6.162 → 1.6.164

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.162",
+  version: "1.6.164",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.30",
+    "@datarails-ai/dr-appspace-cli": "0.12.32",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-25T12:27:12.533Z";
+var BUILD_TIME = "2026-10-26T10:42:12.958Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -2343,24 +2343,40 @@ var AuthorizedClient = class _AuthorizedClient {
    * `whoami` precedent.
    */
   getCurrentOrgId() {
+    const raw2 = this.currentClaims()["organization_id"];
+    if (typeof raw2 !== "number" || !Number.isInteger(raw2) || raw2 <= 0) {
+      throw new Error(
+        `JWT claim "organization_id" is missing or invalid for ${this._serverKey}; ${this.reAuthRemedy("claim")}`
+      );
+    }
+    return raw2;
+  }
+  /**
+   * The caller's org domain from the access JWT's `organization_domain` claim — the value
+   * the monolith stamps on rows it scopes by domain (e.g. a Template Library entry's
+   * `domain`). Same failure modes and wording as {@link getCurrentOrgId}.
+   */
+  getCurrentOrgDomain() {
+    const raw2 = this.currentClaims()["organization_domain"];
+    if (typeof raw2 !== "string" || raw2 === "") {
+      throw new Error(
+        `JWT claim "organization_domain" is missing or invalid for ${this._serverKey}; ${this.reAuthRemedy("claim")}`
+      );
+    }
+    return raw2;
+  }
+  /** Decoded claims of the stored access JWT; throws with the re-auth remedy when there is none. */
+  currentClaims() {
     const access2 = this._session.jwtAccess ?? "";
     if (access2 === "") {
       throw new Error(`no JWT stored for ${this._serverKey}; ${this.reAuthRemedy("missing")}`);
     }
-    let claims;
     try {
-      claims = decodeJwtClaims(access2);
+      return decodeJwtClaims(access2);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(`decode JWT for ${this._serverKey}: ${msg}`);
     }
-    const raw2 = claims["organization_id"];
-    if (typeof raw2 !== "number" || !Number.isInteger(raw2) || raw2 <= 0) {
-      throw new Error(
-        `JWT claim "organization_id" is missing or invalid for ${this._serverKey}; ${this.reAuthRemedy("claim")}`
-      );
-    }
-    return raw2;
   }
   /**
    * How this identity gets a usable JWT again. `dr login` is refused over an
@@ -2573,6 +2589,18 @@ var AuthorizedClient = class _AuthorizedClient {
    * at `client.go:191`.
    */
   async postMultipart(path13, fields, file, options) {
+    return this.sendMultipart("POST", path13, fields, file, options);
+  }
+  /**
+   * {@link AuthorizedClient.postMultipart} sent with PUT, for DRF update views that read a
+   * multipart body (e.g. the Template Library image on `PUT /api/report_library/management/<id>`).
+   * A separate method rather than a `method` option so the endpoint inventory
+   * (`scripts/endpoints/extract.mts`) records the verb from the method name.
+   */
+  async putMultipart(path13, fields, file, options) {
+    return this.sendMultipart("PUT", path13, fields, file, options);
+  }
+  async sendMultipart(method, path13, fields, file, options) {
     const fd = new FormData();
     for (const [k, v] of Object.entries(fields)) {
       fd.set(k, v);
@@ -2591,25 +2619,25 @@ var AuthorizedClient = class _AuthorizedClient {
     this.applyAuthHeaders(headers, true, true);
     headers.delete("Content-Type");
     const res = await fetch(url, {
-      method: "POST",
+      method,
       headers,
       body: fd,
       signal: options?.signal
     });
     const text2 = await res.text();
-    _AuthorizedClient.throwIfScopeDeniedBody("POST", path13, res.status, text2);
+    _AuthorizedClient.throwIfScopeDeniedBody(method, path13, res.status, text2);
     if (res.status === 401 || res.status === 403) {
-      throw new SessionExpiredError(`POST ${path13} (HTTP ${res.status})`);
+      throw new SessionExpiredError(`${method} ${path13} (HTTP ${res.status})`);
     }
     if (res.status < 200 || res.status >= 300) {
-      throw new Error(`POST ${path13}: HTTP ${res.status}: ${truncate2(text2, 200)}`);
+      throw new Error(`${method} ${path13}: HTTP ${res.status}: ${truncate2(text2, 200)}`);
     }
     if (text2 === "" || text2 === '""') return null;
     try {
       return JSON.parse(text2);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      throw new Error(`POST ${path13}: decode: ${msg}`);
+      throw new Error(`${method} ${path13}: decode: ${msg}`);
     }
   }
   /**
@@ -4170,7 +4198,15 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   // mark (the plan does not). If a seed ever lands, deletes or rewrites a version,
   // these keys move back to Tier A.
   "connector-poll|seed",
-  "connector-poll|set-seed"
+  "connector-poll|set-seed",
+  // template library (dr template-library …): an unpublished entry's card, draft rows and
+  // the unpublished-only archive change nothing a customer sees; publishing, and editing a
+  // published entry's card (`update-published`), are Tier A.
+  "template-library|add",
+  "template-library|update",
+  "template-library|unpublish",
+  "template-library|archive",
+  "template-library|restore"
 ]);
 var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // workflow / mec — soft-delete + cascade deletes. `archive` also covers the
@@ -4335,7 +4371,13 @@ var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   "managed-agent|set-global",
   "managed-agent|set-visibility",
   "managed-agent|archive",
-  "agent-skill|delete"
+  "agent-skill|delete",
+  // template library: a published entry is offered to every customer org on the server.
+  // Not `publish`: a Tier-A-only `publish` verb would make gen-scopes-map classify every
+  // leaf named `publish` (app-space, agents skills) as destructive.
+  "template-library|publish-to-customers",
+  // ...and editing a published entry rewrites the card those orgs see.
+  "template-library|update-published"
 ]);
 function classifyTier(action) {
   const key = `${action.resource}|${action.verb}`;
@@ -4582,8 +4624,8 @@ function parseScope(value) {
   return m ? [m[1], m[2]] : null;
 }
 function parsed(scopes) {
-  const list28 = scopes ?? [];
-  const entries = typeof list28 === "string" ? splitScopeString(list28) : Array.isArray(list28) ? list28 : [];
+  const list29 = scopes ?? [];
+  const entries = typeof list29 === "string" ? splitScopeString(list29) : Array.isArray(list29) ? list29 : [];
   return entries.map(parseScope).filter((p) => p !== null);
 }
 function scopeEntries(scopes) {
@@ -6840,8 +6882,8 @@ async function resolveOperator(store, serverKey, operatorFlag) {
   }
   if (operatorFlag !== void 0 && operatorFlag !== "") {
     if (operators.includes(operatorFlag)) return operatorFlag;
-    const list28 = operators.length > 0 ? operators.join(", ") : "(none \u2014 run dr login)";
-    throw new Error(`${operatorFlag} is not an operator login on ${serverKey}. Operators: ${list28}`);
+    const list29 = operators.length > 0 ? operators.join(", ") : "(none \u2014 run dr login)";
+    throw new Error(`${operatorFlag} is not an operator login on ${serverKey}. Operators: ${list29}`);
   }
   const candidates = autoSelectable.length > 0 ? autoSelectable : operators;
   if (candidates.length === 1) return candidates[0];
@@ -20061,8 +20103,8 @@ async function listDocumentTables(client, docId, reqOptions) {
     `/api/documents/${docId}/bucket`,
     reqOptions
   );
-  const list28 = out?.templates;
-  return Array.isArray(list28) ? list28 : [];
+  const list29 = out?.templates;
+  return Array.isArray(list29) ? list29 : [];
 }
 async function rescanBucketVersions(client, bucketId, body, reqOptions) {
   await client.postJSON(`/api/buckets/${bucketId}/rescan_versions`, body, reqOptions);
@@ -20570,10 +20612,10 @@ async function maybeWarnLutKeyOverride(cfg, sentBody, created) {
   }
   let stored;
   try {
-    const list28 = await listForDocument(cfg.client, sentDocument, {
+    const list29 = await listForDocument(cfg.client, sentDocument, {
       signal: cfg.signal
     });
-    stored = list28.find((row) => row.id === created.id);
+    stored = list29.find((row) => row.id === created.id);
   } catch {
     stored = created;
   }
@@ -20715,8 +20757,8 @@ async function runLutExport(cfg) {
   const buf = await getLutFile(cfg.client, cfg.documentId, {
     signal: cfg.signal
   });
-  const { promises: fs37 } = await import("fs");
-  await fs37.writeFile(target, buf);
+  const { promises: fs38 } = await import("fs");
+  await fs38.writeFile(target, buf);
   cfg.out.write(
     `Wrote ${buf.length} bytes to ${target} (LUT export for document ${cfg.documentId}).
 `
@@ -21687,9 +21729,9 @@ function findPeriodLabelRefs(formula) {
 function assertNoPeriodLabelRefs(formula) {
   const bad = findPeriodLabelRefs(formula);
   if (bad.length === 0) return;
-  const list28 = bad.map((r) => `[${r}]`).join(", ");
+  const list29 = bad.map((r) => `[${r}]`).join(", ");
   throw new Error(
-    `formula references period labels (${list28}) \u2014 refs must be bracket-wrapped ROW names like [1000 Cash], not month columns. The server rejects period-label refs with "Ref in formula does not exist in the report anymore."`
+    `formula references period labels (${list29}) \u2014 refs must be bracket-wrapped ROW names like [1000 Cash], not month columns. The server rejects period-label refs with "Ref in formula does not exist in the report anymore."`
   );
 }
 function extractRowValidation(resp, rowName) {
@@ -25269,9 +25311,9 @@ function scoreMetricProfile(input) {
   const metricsByTable = /* @__PURE__ */ new Map();
   for (const m of input.existingMetrics) {
     if (typeof m.table_id !== "number") continue;
-    const list28 = metricsByTable.get(m.table_id);
-    if (list28 === void 0) metricsByTable.set(m.table_id, [m]);
-    else list28.push(m);
+    const list29 = metricsByTable.get(m.table_id);
+    if (list29 === void 0) metricsByTable.set(m.table_id, [m]);
+    else list29.push(m);
   }
   let fieldsExamined = 0;
   let profileErrors = 0;
@@ -27145,8 +27187,8 @@ function parseDimensionMappings(raws) {
   return out;
 }
 function wireMetricsCreate(metrics) {
-  const create19 = metrics.command("create").description("Create a metric (BASE, CALC or DRIVER)");
-  const baseCmd = create19.command("base").description("Create a BASE metric (table-derived)").requiredOption("--name <name>", "Metric name (required)").requiredOption("--template <id>", "Template ID (required)").requiredOption("--value-field <id>", "Value field ID (required)").requiredOption("--date-field <id>", "Date field ID (required)").option(
+  const create20 = metrics.command("create").description("Create a metric (BASE, CALC or DRIVER)");
+  const baseCmd = create20.command("base").description("Create a BASE metric (table-derived)").requiredOption("--name <name>", "Metric name (required)").requiredOption("--template <id>", "Template ID (required)").requiredOption("--value-field <id>", "Value field ID (required)").requiredOption("--date-field <id>", "Date field ID (required)").option(
     "--aggregator <kind>",
     "Value-field aggregation: SUM, COUNT, CUMULATIVE_SUM, CUMULATIVE_COUNT (default: SUM). The CUMULATIVE_* variants accumulate across periods (running total); they default time-aggregation to EOP and cannot use --time-aggregation SUM.",
     "SUM"
@@ -27200,7 +27242,7 @@ function wireMetricsCreate(metrics) {
   );
   addServerFlag(baseCmd);
   addAccountFlag(baseCmd);
-  const calcCmd = create19.command("calc").description("Create a CALC metric (formula-based)").requiredOption("--name <name>", "Metric name (required)").requiredOption(
+  const calcCmd = create20.command("calc").description("Create a CALC metric (formula-based)").requiredOption("--name <name>", "Metric name (required)").requiredOption(
     "--formula <s>",
     `Presented formula. Each referenced metric name MUST be wrapped in square brackets, e.g. "[Revenue]-[COGS]" or "[Revenue] / [Headcount]". Bare names like "revenue/headcount" are rejected (the server's flattener silently produces a broken metric). Reserved tokens are the exception \u2014 write them bare: DAYS_IN_PERIOD (days in the aggregation period, e.g. "[Revenue] / DAYS_IN_PERIOD") and PERIODS_IN_YEAR (annualization factor of the query window: 12 at month grain, 4 at quarter, 1 at year; such metrics reject day-grain queries). Time modifiers: [M].SHIFT(year|quarter|month|day|consumption_period, offset<=0) and [M].AS_OF(year_end|quarter_end|month_end); the consumption_period unit steps by the query grain instead of a fixed unit.`
   ).option("--description <s>", "Description").option("--category <id>", "Category ID").option(
@@ -27231,7 +27273,7 @@ function wireMetricsCreate(metrics) {
   );
   addServerFlag(calcCmd);
   addAccountFlag(calcCmd);
-  const driverCmd = create19.command("driver").description(
+  const driverCmd = create20.command("driver").description(
     "Create a DRIVER metric (entered values, no source table or formula). Set its definition and values per scenario with `dr metrics driver set` / `driver values set`."
   ).requiredOption("--name <name>", "Metric name (required)").option("--description <s>", "Description").option("--category <id>", "Category ID").option(
     "--dimensions <ids>",
@@ -27962,16 +28004,16 @@ function parseDriverValuesJson(text2, source = "--file") {
     const m = err instanceof Error ? err.message : String(err);
     throw new Error(`${source}: invalid JSON: ${m}`);
   }
-  let list28 = doc;
+  let list29 = doc;
   let where = source;
   if (doc !== null && typeof doc === "object" && !Array.isArray(doc)) {
-    list28 = doc["values"];
+    list29 = doc["values"];
     where = `${source} values`;
-    if (list28 === void 0) {
+    if (list29 === void 0) {
       throw new Error(`${source}: expected {"values": [...]} or a bare array of cells`);
     }
   }
-  const cells = parseDriverValueCells(list28, where);
+  const cells = parseDriverValueCells(list29, where);
   assertDriverGrid(
     cells,
     cells.map((_, i) => `${where}[${i}]`),
@@ -35271,10 +35313,10 @@ async function runRecipesSave(cfg) {
   );
 }
 async function readAnyJson(filePath) {
-  const fs37 = await import("fs");
+  const fs38 = await import("fs");
   let raw2;
   try {
-    raw2 = await fs37.promises.readFile(filePath, "utf8");
+    raw2 = await fs38.promises.readFile(filePath, "utf8");
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
     throw new Error(`read --payload-file: ${m}`);
@@ -38179,7 +38221,7 @@ function mergeKindBodies(bodies) {
   const merged = {};
   for (const [key, value] of Object.entries(first)) {
     const lists = [value, ...rest.map((body) => isObject(body) ? body[key] : void 0)];
-    merged[key] = lists.every(Array.isArray) ? lists.flatMap((list28) => list28) : value;
+    merged[key] = lists.every(Array.isArray) ? lists.flatMap((list29) => list29) : value;
   }
   return merged;
 }
@@ -43895,9 +43937,9 @@ function eventsBySource(events) {
   const m = /* @__PURE__ */ new Map();
   for (const e of sorted) {
     const k = sourceKey(e.server, e.data_integration_id);
-    const list28 = m.get(k);
-    if (list28 === void 0) m.set(k, [e]);
-    else list28.push(e);
+    const list29 = m.get(k);
+    if (list29 === void 0) m.set(k, [e]);
+    else list29.push(e);
   }
   return m;
 }
@@ -48043,9 +48085,9 @@ function registerConnectorsTasks(connectors) {
     await withConnectorsSetup(opts, async ({ client, signal }) => {
       const orgId = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
       try {
-        const list28 = await listTasks(client, orgId, { signal });
-        if (opts.json === true) writeJSONIndented(process.stdout, list28);
-        else writeTaskList(process.stdout, list28);
+        const list29 = await listTasks(client, orgId, { signal });
+        if (opts.json === true) writeJSONIndented(process.stdout, list29);
+        else writeTaskList(process.stdout, list29);
       } catch (err) {
         throw explainTaskError(err);
       }
@@ -48213,13 +48255,13 @@ function writeConnection(out, c) {
     "\nThe customer role's permissions should be read-only on their bucket/prefix (plus kms:Decrypt for a customer-managed KMS key).\n"
   );
 }
-function writeConnectionTable(out, list28) {
-  if (list28.length === 0) {
+function writeConnectionTable(out, list29) {
+  if (list29.length === 0) {
     out.write("No AWS connections for this org.\n");
     return;
   }
   const rows = [["ID", "SECRET_REF", "ROLE_ARN", "STATUS", "EXPIRES_AT", "LAST_ERROR"]];
-  for (const c of list28) {
+  for (const c of list29) {
     rows.push([
       String(c.id),
       oneLine4(c.secret_ref),
@@ -53117,9 +53159,9 @@ verify the date matches the accounts' reporting period (try \`dr reconciliation
       unchanged.push(r);
       continue;
     }
-    const list28 = changesByAccount.get(r.row.accountId) ?? [];
-    list28.push(r);
-    changesByAccount.set(r.row.accountId, list28);
+    const list29 = changesByAccount.get(r.row.accountId) ?? [];
+    list29.push(r);
+    changesByAccount.set(r.row.accountId, list29);
   }
   const changeCount = resolved.length - unchanged.length;
   const toJsonRow = (r) => ({
@@ -53246,9 +53288,9 @@ verify the date matches the accounts' reporting period (try \`dr reconciliation
       unchanged.push(row);
       continue;
     }
-    const list28 = clearsByAccount.get(row.accountId) ?? [];
-    list28.push({ row, current });
-    clearsByAccount.set(row.accountId, list28);
+    const list29 = clearsByAccount.get(row.accountId) ?? [];
+    list29.push({ row, current });
+    clearsByAccount.set(row.accountId, list29);
   }
   const clearCount = cfg.rows.length - unchanged.length;
   const n = cfg.rows.length;
@@ -55413,9 +55455,9 @@ function stepGridWarnings(steps) {
   const n = columns.length;
   const hidden = steps.filter((s) => s.index < 1 || s.index > n);
   if (hidden.length === 0) return [];
-  const list28 = hidden.map((s) => `${s.id} "${s.name}" (index ${s.index})`).join(", ");
+  const list29 = hidden.map((s) => `${s.id} "${s.name}" (index ${s.index})`).join(", ");
   return [
-    `${hidden.length} of ${steps.length} steps will render stacked at the canvas origin \u2014 step index values must be the columns 1..N with no gaps (expected 1..${n}, got ${columns.join(", ")}): ${list28}`
+    `${hidden.length} of ${steps.length} steps will render stacked at the canvas origin \u2014 step index values must be the columns 1..N with no gaps (expected 1..${n}, got ${columns.join(", ")}): ${list29}`
   ];
 }
 async function stepGridPlanLines(client, processId, change, options) {
@@ -65895,12 +65937,12 @@ function scenarioFilter(year, scenario) {
 }
 async function findScenarioById(client, scenarioId, signal) {
   for (const family of ["Forecast", "Budget"]) {
-    const list28 = await listScenarios(
+    const list29 = await listScenarios(
       client,
       { scenario: family, ids: [scenarioId] },
       { signal }
     );
-    const hit = list28.find((s) => s.id === scenarioId);
+    const hit = list29.find((s) => s.id === scenarioId);
     if (hit !== void 0) return { scenario: hit, family };
   }
   return void 0;
@@ -66256,8 +66298,8 @@ async function runCyclesSetDefault(cfg) {
   });
 }
 async function describeScenario(client, scenarioId, signal) {
-  const list28 = await listScenarios(client, { ids: [scenarioId] }, { signal });
-  const found = list28.find((s) => s.id === scenarioId) ?? (await listScenarios(client, {}, { signal })).find((s) => s.id === scenarioId);
+  const list29 = await listScenarios(client, { ids: [scenarioId] }, { signal });
+  const found = list29.find((s) => s.id === scenarioId) ?? (await listScenarios(client, {}, { signal })).find((s) => s.id === scenarioId);
   if (found === void 0) {
     return [`id: ${scenarioId}`, "(scenario not found \u2014 may already be deleted)"];
   }
@@ -67359,8 +67401,8 @@ function parseIdArg(raw2, label) {
   return n;
 }
 async function resolveNameList(singular, filePath, flagSingular, flagBulk) {
-  const list28 = singular ?? [];
-  const hasSingular = list28.length > 0;
+  const list29 = singular ?? [];
+  const hasSingular = list29.length > 0;
   const hasFile = filePath !== void 0 && filePath !== "";
   if (hasSingular && hasFile) {
     throw new Error(`pass either ${flagSingular} (repeatable) or ${flagBulk} @<path>, not both`);
@@ -67372,7 +67414,7 @@ async function resolveNameList(singular, filePath, flagSingular, flagBulk) {
   if (!hasSingular) {
     throw new Error(`at least one ${flagSingular} (repeatable) or ${flagBulk} @<path> is required`);
   }
-  return list28.join("\n");
+  return list29.join("\n");
 }
 async function resolveTagsConfig(client, opts, signal) {
   const hasSubType = opts.dateSubType !== void 0 && opts.dateSubType !== "";
@@ -69514,7 +69556,7 @@ function registerSpendControlVendorsCommands(sc) {
   });
   addServerFlag(owners);
   addAccountFlag(owners);
-  const create19 = vendors.command("create").description(
+  const create20 = vendors.command("create").description(
     "Get or create a vendor by name (POST /vendors/). Re-running with an existing name is a no-op"
   ).argument("<name>", "Vendor name (2\u2013255 chars)").option("--confirm-token <token>", "Token from a prior plan run", "").option("--json", "Output raw JSON of the vendor", false).action(async (name, opts) => {
     const serverKey = resolveServer(opts.server);
@@ -69534,8 +69576,8 @@ function registerSpendControlVendorsCommands(sc) {
       setup.cleanup();
     }
   });
-  addServerFlag(create19);
-  addAccountFlag(create19);
+  addServerFlag(create20);
+  addAccountFlag(create20);
   const visibility = vendors.command("set-visibility").description("Show or hide vendors in the App Store (PATCH /vendors/visibility, admin-only)").argument("[vendor_ids...]", "Vendor UUIDs, space- or comma-separated").requiredOption("--visible <bool>", "Target visibility (true|false)").option("--from <path>", "Read ids from a file, one per line").option("--confirm-token <token>", "Token from a prior plan run", "").option("--json", "Output raw JSON of the updated vendors", false).action(
     async (vendorIds, opts) => {
       const serverKey = resolveServer(opts.server);
@@ -69939,7 +69981,7 @@ ${items.length} change(s).
 }
 function registerSpendControlAlertsCommands(sc) {
   const alerts = sc.command("alerts").description("Spend Control alerts and the org-wide renewal-alert settings");
-  const list28 = alerts.command("list").description("List alerts (GET /alerts)").option(
+  const list29 = alerts.command("list").description("List alerts (GET /alerts)").option(
     "--status <status>",
     `Filter by status (${ALERT_STATUSES.join("|")}). Server defaults to active`
   ).option("--page <n>", "Page number (1-based)").option("--size <n>", `Page size (max ${MAX_PAGE_SIZE3})`).option("--all", "Walk every page", false).option("--json", "Output raw JSON instead of a table", false).action(async (opts) => {
@@ -69967,8 +70009,8 @@ function registerSpendControlAlertsCommands(sc) {
       setup.cleanup();
     }
   });
-  addServerFlag(list28);
-  addAccountFlag(list28);
+  addServerFlag(list29);
+  addAccountFlag(list29);
   const dismiss = alerts.command("dismiss").description("Dismiss alerts (POST /alerts/{id}/dismiss). One-way: no un-dismiss route exists").argument("[alert_ids...]", "Alert UUIDs, space- or comma-separated").option("--from <path>", "Read ids from a file, one per line").option("--confirm-token <token>", "Token from a prior plan run", "").action(async (alertIds, opts) => {
     const serverKey = resolveServer(opts.server);
     const ids = await collectResourceIds(alertIds, opts.from, {
@@ -71473,7 +71515,7 @@ function registerSpendControlCommand(root) {
   );
   addServerFlag(bulkCreate);
   addAccountFlag(bulkCreate);
-  const update12 = contracts.command("update").description("Partially update a contract by id (PATCH /contracts/{id})").argument("<contract_id>", "Contract UUID").requiredOption("--from <path>", "Path to JSON body matching ContractPartialUpdateSchema").option("--json", "Output raw JSON of the updated contract", false).action(async (contractId, opts) => {
+  const update13 = contracts.command("update").description("Partially update a contract by id (PATCH /contracts/{id})").argument("<contract_id>", "Contract UUID").requiredOption("--from <path>", "Path to JSON body matching ContractPartialUpdateSchema").option("--json", "Output raw JSON of the updated contract", false).action(async (contractId, opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
       await runContractUpdate({
@@ -71488,8 +71530,8 @@ function registerSpendControlCommand(root) {
       setup.cleanup();
     }
   });
-  addServerFlag(update12);
-  addAccountFlag(update12);
+  addServerFlag(update13);
+  addAccountFlag(update13);
   for (const spec of [
     {
       name: "archive",
@@ -74244,6 +74286,781 @@ function registerPalettesCommand(root) {
   addAccountFlag(createCmd);
 }
 
+// src/commands/templateLibrary.ts
+import { createHash as createHash17 } from "crypto";
+import { promises as fs36 } from "fs";
+import { Option as Option4 } from "commander";
+
+// src/api/templateLibrary.ts
+var BASE5 = "/api/report_library/management";
+async function list28(client, options) {
+  return await client.getJSON(BASE5, options) ?? [];
+}
+async function create19(client, body, options) {
+  const out = await client.postJSON(BASE5, body, options);
+  if (out === null) {
+    throw new Error(`unexpected empty response from POST ${BASE5}`);
+  }
+  return out;
+}
+async function update12(client, id, body, options) {
+  const out = await client.putJSON(`${BASE5}/${id}`, body, options);
+  if (out === null) {
+    throw new Error(`unexpected empty response from PUT ${BASE5}/${id}`);
+  }
+  return out;
+}
+async function uploadImage(client, id, png, filename, options) {
+  const out = await client.putMultipart(
+    `${BASE5}/${id}`,
+    {},
+    new Blob([png], { type: "image/png" }),
+    { ...options, fileFieldName: "image", filename }
+  );
+  if (out === null) {
+    throw new Error(`unexpected empty response from PUT ${BASE5}/${id} (image)`);
+  }
+  return out;
+}
+
+// src/commands/_agentCli.ts
+import { access } from "fs/promises";
+var JSON_HELP = "Emit raw JSON to stdout instead of a pretty render.";
+var CONFIRM_HELP = "Token from a prior plan run \u2014 required to actually write";
+function withTarget(cmd) {
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  return cmd;
+}
+function std() {
+  return { out: process.stdout, err: process.stderr };
+}
+function requireId(value, placeholder) {
+  const id = (value ?? "").trim();
+  if (id === "") {
+    throw new Error(`missing required option: --id ${placeholder}`);
+  }
+  return id;
+}
+function requirePositiveInt(value, flag) {
+  const n = /^\d+$/.test(value) ? Number(value) : NaN;
+  if (!Number.isSafeInteger(n) || n <= 0) {
+    throw new Error(`${flag} ${JSON.stringify(value)}: expected a positive integer`);
+  }
+  return n;
+}
+function requireBool(value, flag) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new Error(`${flag} ${JSON.stringify(value ?? "")}: expected true or false`);
+}
+function splitList(value) {
+  return [
+    ...new Set(
+      (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "")
+    )
+  ];
+}
+function isNoneSentinel(parts, flag, value, what) {
+  if (!parts.includes("none")) return false;
+  if (parts.length === 1) return true;
+  throw new Error(`${flag} ${JSON.stringify(value)}: "none" cannot be combined with ${what}`);
+}
+function shellArg(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : shellQuote(value);
+}
+function proseStream(cfg) {
+  return cfg.asJson ? cfg.err : cfg.out;
+}
+async function assertNoOverwrite(paths, force) {
+  if (force) return;
+  const existing = [];
+  for (const path13 of paths) {
+    try {
+      await access(path13);
+      existing.push(path13);
+    } catch {
+    }
+  }
+  if (existing.length > 0) {
+    throw new Error(
+      `refusing to overwrite existing file(s): ${existing.join(", ")}. Pull into another --dir, or pass --force to replace them.`
+    );
+  }
+}
+
+// src/commands/_templateLibraryImages.ts
+var TEMPLATE_LIBRARY_IMAGE_COLORS = ["pink", "purple", "yellow"];
+var TEMPLATE_LIBRARY_IMAGE_FILENAMES = {
+  pink: "pink_480.png",
+  purple: "purple_480.png",
+  yellow: "yellow_480.png"
+};
+
+// src/commands/templateLibrary.ts
+var KNOWN_REPORT_TYPES = [
+  "Financial Planning",
+  "Financial Reporting",
+  "Headcount Planning",
+  "Strategic Reporting"
+];
+var LIBRARY_SERVER = "US";
+var LIBRARY_ORG_DOMAIN = "template.library-new";
+var MAX_DESCRIPTION_FILE_BYTES = 64 * 1024;
+var MAX_SHORT_FIELD = 100;
+function assertLibraryOrg(client, after = false) {
+  const usHost = resolve(LIBRARY_SERVER).host.replace(/\/+$/, "");
+  const domain = client.getCurrentOrgDomain();
+  if (client.host !== usHost || domain !== LIBRARY_ORG_DOMAIN) {
+    const lead2 = after ? `the last template library write re-authenticated as another identity (${client.serverKey}, org ${domain}) while it was sent; check the entry with \`dr template-library list\`. ` : "";
+    throw new Error(
+      `${lead2}the template library is managed only from org ${LIBRARY_ORG_DOMAIN} on ${LIBRARY_SERVER} (this identity: ${client.serverKey}, org ${domain}). Run as that org, e.g. \`dr login-as support@${LIBRARY_ORG_DOMAIN} --server ${LIBRARY_SERVER}\`.`
+    );
+  }
+}
+async function libraryWrite(client, write2) {
+  assertLibraryOrg(client);
+  const out = await write2();
+  assertLibraryOrg(client, true);
+  return out;
+}
+function boundId(cfg, target, payload) {
+  const canonical = JSON.stringify({
+    server: cfg.serverFlag,
+    account: cfg.client.email,
+    image: cfg.image ?? null,
+    payload: Object.fromEntries(Object.entries(payload).sort(([a], [b]) => a.localeCompare(b)))
+  });
+  return `${target}#${createHash17("sha256").update(canonical).digest("hex").slice(0, 12)}`;
+}
+async function assertOwnFilebox(client, fileboxId, signal) {
+  const own2 = await list16(client, {}, { signal });
+  if (!own2.some((f) => f.id === fileboxId)) {
+    throw new Error(`filebox ${fileboxId} is not a filebox of org ${LIBRARY_ORG_DOMAIN}`);
+  }
+}
+async function ownFileboxName(client, fileboxId, signal) {
+  await assertOwnFilebox(client, fileboxId, signal);
+  let latest;
+  try {
+    latest = (await latestVersionId(client, fileboxId, { signal })).id;
+  } catch (err) {
+    const m = err instanceof Error ? err.message : String(err);
+    if (/HTTP 40[34]/.test(m)) {
+      throw new Error(`filebox ${fileboxId} is not a filebox of org ${LIBRARY_ORG_DOMAIN}`);
+    }
+    throw err;
+  }
+  if (latest === null) {
+    throw new Error(`filebox ${fileboxId} has no file yet \u2014 upload the template file first`);
+  }
+  return decodeShape((await getVersion(client, latest, { signal })).name);
+}
+function entryStatus(e) {
+  if (e.is_archive) return "archived";
+  return e.is_published ? "published" : "draft";
+}
+function imageColorOf(url) {
+  if (url === null || url === "") return "none";
+  const file = (url.split("?")[0]?.split("/").pop() ?? "").toLowerCase();
+  return TEMPLATE_LIBRARY_IMAGE_COLORS.find(
+    (c) => file.endsWith(`_${TEMPLATE_LIBRARY_IMAGE_FILENAMES[c]}`)
+  ) ?? "custom";
+}
+function parseImageColor(raw2) {
+  const v = raw2.trim().toLowerCase();
+  if (TEMPLATE_LIBRARY_IMAGE_COLORS.includes(v)) {
+    return v;
+  }
+  throw new Error(
+    `invalid --image "${raw2}" (expected one of: ${TEMPLATE_LIBRARY_IMAGE_COLORS.join(", ")})`
+  );
+}
+async function fetchEntry(client, id, signal) {
+  const rows = await list28(client, { signal });
+  const found = rows.find((r) => r.id === id);
+  if (found === void 0) {
+    throw new Error(`template library entry ${id} not found`);
+  }
+  return decodeShape(found);
+}
+async function fetchOwnEntry(client, id, signal) {
+  const e = await fetchEntry(client, id, signal);
+  if (e.domain !== LIBRARY_ORG_DOMAIN) {
+    throw new Error(
+      `template library entry ${id} belongs to org ${e.domain ?? "(none)"}, not ${LIBRARY_ORG_DOMAIN}; refusing to change it`
+    );
+  }
+  return e;
+}
+async function assertUnchangedSincePlan(client, planned, signal) {
+  const now = await fetchOwnEntry(client, planned.id, signal);
+  if (entryStatus(now) !== entryStatus(planned)) {
+    throw new Error(
+      `template library entry ${planned.id} changed from ${entryStatus(planned)} to ${entryStatus(now)} since the plan; nothing was written \u2014 plan the command again`
+    );
+  }
+  return now;
+}
+function withContext(err, prefix, suffix = "") {
+  if (err instanceof Error) {
+    err.message = `${prefix}${err.message}${suffix}`;
+    throw err;
+  }
+  throw new Error(`${prefix}${String(err)}${suffix}`);
+}
+async function uploadLibraryImage(client, id, color, signal) {
+  const { templateLibraryImageBytes } = await import("./_templateLibraryImageBytes-RHECBCOW.js");
+  return libraryWrite(
+    client,
+    () => uploadImage(
+      client,
+      id,
+      templateLibraryImageBytes(color),
+      TEMPLATE_LIBRARY_IMAGE_FILENAMES[color],
+      { signal }
+    )
+  );
+}
+async function writeMetadata(client, id, body, signal) {
+  if (Object.keys(body).length === 0) return void 0;
+  return libraryWrite(client, () => update12(client, id, body, { signal }));
+}
+function show(v) {
+  if (v === null || v === void 0 || v === "") return "(empty)";
+  if (Array.isArray(v)) return v.length === 0 ? "(empty)" : v.join(", ");
+  return String(v);
+}
+function diffLines(current, body) {
+  return Object.entries(body).map(([key, next]) => {
+    const prev = key === "creator_id" ? current.creator?.id : current[key];
+    return `${key}: ${show(prev)} -> ${show(next)}`;
+  });
+}
+function imagePlanLine(current, image) {
+  return image === void 0 ? [] : [`image: ${imageColorOf(current.report_image)} -> ${image}`];
+}
+function headerLines(e) {
+  return [
+    `entry ${e.id}: ${e.name} (filebox ${e.document.id}, domain ${e.domain ?? "?"})`,
+    `status: ${entryStatus(e)}`
+  ];
+}
+async function runTemplateLibraryList(cfg) {
+  const rows = decodeShape(
+    (await list28(cfg.client, { signal: cfg.signal })).filter(
+      (r) => cfg.status === "all" || entryStatus(r) === cfg.status
+    )
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, rows);
+    return;
+  }
+  if (rows.length === 0) {
+    cfg.out.write("(no template library entries)\n");
+    return;
+  }
+  writeTable44(cfg.out, [
+    ["ID", "FILEBOX", "STATUS", "TYPE", "INDUSTRY", "IMAGE", "DOWNLOADS", "NAME"],
+    ...rows.map((r) => [
+      String(r.id),
+      String(r.document.id),
+      entryStatus(r),
+      r.report_type ?? "",
+      r.industry ?? "",
+      imageColorOf(r.report_image),
+      String(r.downloads ?? 0),
+      r.name
+    ])
+  ]);
+}
+async function runTemplateLibraryGet(cfg) {
+  const e = await fetchEntry(cfg.client, cfg.id, cfg.signal);
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, e);
+    return;
+  }
+  const lines = [
+    ...headerLines(e),
+    `type: ${show(e.report_type)}`,
+    `industry: ${show(e.industry)}`,
+    `tags: ${show(e.tags)}`,
+    `image: ${imageColorOf(e.report_image)}`,
+    `creator: ${e.creator === null ? "(none)" : `${e.creator.email} (user ${e.creator.id})`}`,
+    `downloads: ${e.downloads ?? 0}`,
+    `description: ${show(e.description)}`,
+    "tables and fields in use:"
+  ];
+  if (e.tables_and_fields_in_use.length === 0) {
+    lines.push("  (none mapped yet)");
+  }
+  for (const t of e.tables_and_fields_in_use) {
+    lines.push(`  ${t.name} {${t.alias ?? ""}} (table ${t.id})`);
+    for (const f of t.fields) {
+      lines.push(`    ${f.name} {${f.alias ?? ""}} ${f.type ?? ""}`.trimEnd());
+    }
+  }
+  cfg.out.write(lines.join("\n") + "\n");
+}
+async function runTemplateLibraryAdd(cfg) {
+  assertLibraryOrg(cfg.client);
+  const action = {
+    resource: "template-library",
+    id: boundId(cfg, cfg.fileboxId, cfg.body),
+    verb: "add"
+  };
+  await preflightConfirmToken(action, cfg.token);
+  const fileName = await ownFileboxName(cfg.client, cfg.fileboxId, cfg.signal);
+  const rows = await list28(cfg.client, { signal: cfg.signal });
+  const existing = rows.find((r) => r.document.id === cfg.fileboxId);
+  if (existing !== void 0) {
+    throw new Error(
+      `filebox ${cfg.fileboxId} is already template library entry ${existing.id} \u2014 use \`dr template-library update ${existing.id}\``
+    );
+  }
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: cfg.confirmCmd,
+    describe: async () => [
+      `add filebox ${cfg.fileboxId} (${fileName}) to the template library as a draft (not published)`,
+      `domain: ${LIBRARY_ORG_DOMAIN}`,
+      ...Object.entries(cfg.body).map(([k, v]) => `${k}: ${show(v)}`),
+      ...cfg.image === void 0 ? [] : [`image: ${cfg.image}`]
+    ],
+    execute: async () => {
+      await assertOwnFilebox(cfg.client, cfg.fileboxId, cfg.signal);
+      assertLibraryOrg(cfg.client);
+      const created = await create19(
+        cfg.client,
+        { document_id: cfg.fileboxId },
+        { signal: cfg.signal }
+      );
+      let result = created;
+      try {
+        assertLibraryOrg(cfg.client, true);
+        result = await writeMetadata(cfg.client, created.id, cfg.body, cfg.signal) ?? result;
+        if (cfg.image !== void 0) {
+          result = await uploadLibraryImage(cfg.client, created.id, cfg.image, cfg.signal);
+        }
+      } catch (err) {
+        withContext(
+          err,
+          `created template library entry ${created.id} (draft), but filling in its card failed: `,
+          ` \u2014 finish it with \`dr template-library update ${created.id}\``
+        );
+      }
+      if (cfg.asJson) {
+        writeJSONIndented(cfg.out, result);
+        return;
+      }
+      cfg.out.write(
+        `Added filebox ${cfg.fileboxId} as template library entry ${created.id} (draft). The server maps its tables and fields in the background; check with \`dr template-library get ${created.id}\`.
+`
+      );
+    }
+  });
+}
+async function runTemplateLibraryUpdate(cfg) {
+  if (Object.keys(cfg.body).length === 0 && cfg.image === void 0) {
+    throw new Error(
+      "nothing to update \u2014 pass at least one of --description, --description-file, --type, --industry, --tags, --creator, --image"
+    );
+  }
+  assertLibraryOrg(cfg.client);
+  const current = await fetchOwnEntry(cfg.client, cfg.id, cfg.signal);
+  if (typeof cfg.body.creator_id === "number") {
+    await assertOrgContact(cfg.client, cfg.body.creator_id, cfg.signal);
+  }
+  const action = updateAction(boundId(cfg, cfg.id, cfg.body), current.is_published);
+  await preflightConfirmToken(action, cfg.token);
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: cfg.confirmCmd,
+    describe: async () => [
+      ...headerLines(current),
+      ...diffLines(current, cfg.body),
+      ...imagePlanLine(current, cfg.image)
+    ],
+    execute: async () => {
+      await assertUnchangedSincePlan(cfg.client, current, cfg.signal);
+      if (typeof cfg.body.creator_id === "number") {
+        await assertOrgContact(cfg.client, cfg.body.creator_id, cfg.signal);
+      }
+      let result = await writeMetadata(cfg.client, cfg.id, cfg.body, cfg.signal);
+      if (cfg.image !== void 0) {
+        try {
+          result = await uploadLibraryImage(cfg.client, cfg.id, cfg.image, cfg.signal);
+        } catch (err) {
+          if (result === void 0) throw err;
+          withContext(
+            err,
+            `updated the card of template library entry ${cfg.id}, but replacing its image failed: `,
+            ` \u2014 re-run with --image alone to finish`
+          );
+        }
+      }
+      if (cfg.asJson) {
+        writeJSONIndented(cfg.out, result ?? current);
+        return;
+      }
+      cfg.out.write(`Updated template library entry ${cfg.id} (${current.name}).
+`);
+    }
+  });
+}
+async function assertOrgContact(client, userId, signal) {
+  const contacts = await listContacts(client, { signal });
+  if (!contacts.some((c) => c.id === userId)) {
+    throw new Error(`--creator ${userId} is not a user of org ${LIBRARY_ORG_DOMAIN}`);
+  }
+}
+function updateAction(id, published) {
+  return published ? { resource: "template-library", id, verb: "update-published" } : { resource: "template-library", id, verb: "update" };
+}
+function stateAction(id, verb) {
+  switch (verb) {
+    case "publish":
+      return { resource: "template-library", id, verb: "publish-to-customers" };
+    case "unpublish":
+      return { resource: "template-library", id, verb: "unpublish" };
+    case "archive":
+      return { resource: "template-library", id, verb: "archive" };
+    case "restore":
+      return { resource: "template-library", id, verb: "restore" };
+  }
+}
+var STATE_BODY = {
+  publish: { is_published: true },
+  unpublish: { is_published: false },
+  archive: { is_archive: true },
+  restore: { is_archive: false }
+};
+function stateRefusal(e, verb, image) {
+  switch (verb) {
+    case "publish":
+      if (e.is_published) return `entry ${e.id} is already published`;
+      if (e.is_archive)
+        return `entry ${e.id} is archived \u2014 run \`dr template-library restore ${e.id}\` first`;
+      if (imageColorOf(e.report_image) === "none" && image === void 0) {
+        return `entry ${e.id} has no card image \u2014 pass --image ${TEMPLATE_LIBRARY_IMAGE_COLORS.join("|")}`;
+      }
+      return void 0;
+    case "unpublish":
+      return e.is_published ? void 0 : `entry ${e.id} is not published`;
+    case "archive":
+      if (e.is_archive) return `entry ${e.id} is already archived`;
+      return e.is_published ? `entry ${e.id} is published \u2014 run \`dr template-library unpublish ${e.id}\` first` : void 0;
+    case "restore":
+      return e.is_archive ? void 0 : `entry ${e.id} is not archived`;
+  }
+}
+function publishWarnings(e) {
+  const empty = ["description", "report_type", "industry"].filter(
+    (k) => e[k] === null || e[k] === ""
+  );
+  if (!e.tags?.length) empty.push("tags");
+  return empty.map((k) => `warning: ${k} is empty`);
+}
+async function runTemplateLibraryState(cfg) {
+  assertLibraryOrg(cfg.client);
+  const action = stateAction(boundId(cfg, cfg.id, {}), cfg.verb);
+  await preflightConfirmToken(action, cfg.token);
+  const current = await fetchOwnEntry(cfg.client, cfg.id, cfg.signal);
+  const refusal = stateRefusal(current, cfg.verb, cfg.image);
+  if (refusal !== void 0) {
+    throw new Error(refusal);
+  }
+  const body = STATE_BODY[cfg.verb];
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: cfg.confirmCmd,
+    describe: async () => [
+      ...headerLines(current),
+      `${cfg.verb}: ${entryStatus(current)} -> ${entryStatus({ ...current, ...body })}`,
+      ...cfg.verb === "publish" ? [
+        "a published entry is offered to every customer org on this server",
+        ...publishWarnings(current)
+      ] : [],
+      ...imagePlanLine(current, cfg.image)
+    ],
+    execute: async () => {
+      await assertUnchangedSincePlan(cfg.client, current, cfg.signal);
+      if (cfg.image !== void 0) {
+        await uploadLibraryImage(cfg.client, cfg.id, cfg.image, cfg.signal);
+      }
+      const result = await libraryWrite(
+        cfg.client,
+        () => update12(cfg.client, cfg.id, body, { signal: cfg.signal })
+      );
+      if (cfg.asJson) {
+        writeJSONIndented(cfg.out, result);
+        return;
+      }
+      cfg.out.write(
+        `Template library entry ${cfg.id} (${current.name}) is now ${entryStatus(result)}.
+`
+      );
+    }
+  });
+}
+function writeTable44(out, rows) {
+  const widths = [];
+  for (const r of rows) {
+    r.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
+  }
+  for (const r of rows) {
+    out.write(
+      r.map((cell, i) => i === r.length - 1 ? cell : cell.padEnd((widths[i] ?? 0) + 2)).join("") + "\n"
+    );
+  }
+}
+async function metadataBody(opts) {
+  if (opts.description !== void 0 && opts.descriptionFile !== void 0) {
+    throw new Error("pass --description or --description-file, not both");
+  }
+  const body = {};
+  if (opts.description !== void 0) body.description = opts.description;
+  if (opts.descriptionFile !== void 0) {
+    let size;
+    try {
+      size = (await fs36.stat(opts.descriptionFile)).size;
+    } catch (err) {
+      const m = err instanceof Error ? err.message : String(err);
+      throw new Error(`--description-file ${opts.descriptionFile}: ${m}`);
+    }
+    if (size > MAX_DESCRIPTION_FILE_BYTES) {
+      throw new Error(
+        `--description-file ${opts.descriptionFile}: ${size} bytes exceeds the ${MAX_DESCRIPTION_FILE_BYTES}-byte limit`
+      );
+    }
+    try {
+      body.description = (await fs36.readFile(opts.descriptionFile, "utf8")).trim();
+    } catch (err) {
+      const m = err instanceof Error ? err.message : String(err);
+      throw new Error(`--description-file ${opts.descriptionFile}: ${m}`);
+    }
+  }
+  if (opts.type !== void 0) body.report_type = shortField("--type", opts.type);
+  if (opts.industry !== void 0) body.industry = shortField("--industry", opts.industry);
+  if (opts.tags !== void 0) body.tags = splitList(opts.tags);
+  return body;
+}
+function shortField(flag, raw2) {
+  const v = raw2.trim();
+  if (v.length > MAX_SHORT_FIELD) {
+    throw new Error(
+      `${flag} is ${v.length} characters; the server allows at most ${MAX_SHORT_FIELD}`
+    );
+  }
+  return v;
+}
+function metadataConfirmParts(opts) {
+  return [
+    ["--description", opts.description],
+    ["--description-file", opts.descriptionFile],
+    ["--type", opts.type],
+    ["--industry", opts.industry],
+    ["--tags", opts.tags],
+    ["--image", opts.image]
+  ];
+}
+function confirmCommand(parts) {
+  const out = ["dr", "template-library"];
+  for (const p of parts) {
+    if (typeof p === "string") {
+      out.push(p);
+    } else if (p[1] !== void 0) {
+      out.push(p[0], shellQuote(p[1]));
+    }
+  }
+  return out.join(" ");
+}
+function addConfirmCommand(fileboxId, opts, serverFlag) {
+  return confirmCommand([
+    "add",
+    String(fileboxId),
+    ...metadataConfirmParts(opts),
+    ["--server", serverFlag]
+  ]);
+}
+function updateConfirmCommand(id, opts, serverFlag) {
+  return confirmCommand([
+    "update",
+    String(id),
+    ...metadataConfirmParts(opts),
+    ["--creator", opts.creator],
+    ["--server", serverFlag]
+  ]);
+}
+function stateConfirmCommand(verb, id, opts, serverFlag) {
+  return confirmCommand([verb, String(id), ["--image", opts.image], ["--server", serverFlag]]);
+}
+function addImageOption(cmd, description) {
+  return cmd.option(
+    "--image <color>",
+    `${description}: ${TEMPLATE_LIBRARY_IMAGE_COLORS.join(", ")}`,
+    parseImageColor
+  );
+}
+function addMetadataOptions(cmd) {
+  cmd.option("--description <text>", "Card description shown in the library").option("--description-file <path>", "Read the description from a file instead").option(
+    "--type <report_type>",
+    `Report type, e.g. ${KNOWN_REPORT_TYPES.map((t) => `"${t}"`).join(", ")}`
+  ).option("--industry <text>", 'Industry the template targets ("General" for cross-industry)').option("--tags <csv>", 'Comma-separated tags; replaces the whole list ("" clears it)');
+  return addImageOption(cmd, "Card image");
+}
+function addWriteFlags(cmd) {
+  cmd.option("--json", "Output raw JSON instead of a summary", false).option("--confirm-token <token>", "Token from the plan-phase output; required to apply");
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+}
+function registerTemplateLibraryCommand(root) {
+  const cmd = root.command("template-library").description(
+    `Manage the Template Library catalog (api/report_library/management): list, add, fill in description/type/industry/tags/image, publish, archive. Writes run only as org ${LIBRARY_ORG_DOMAIN} on ${LIBRARY_SERVER}.`
+  );
+  const listCmd = cmd.command("list").description("List template library entries (published, draft and archived)").addOption(
+    new Option4("--status <status>", "Which entries to show").choices(["all", "published", "draft", "archived"]).default("all")
+  ).option("--json", "Output raw JSON instead of a table", false).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runTemplateLibraryList({
+        client: setup.client,
+        status: opts.status,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(listCmd);
+  addAccountFlag(listCmd);
+  const getCmd = cmd.command("get").description("Show one entry, with the tables and fields (system names) its file reads").argument("<id>", "template library entry id").option("--json", "Output raw JSON instead of text", false).action(async (idRaw, opts) => {
+    const id = parsePositiveIntArg(idRaw, "<id>");
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runTemplateLibraryGet({
+        client: setup.client,
+        id,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(getCmd);
+  addAccountFlag(getCmd);
+  const addCmd = addMetadataOptions(
+    cmd.command("add").description(
+      `Register a filebox of org ${LIBRARY_ORG_DOMAIN} on ${LIBRARY_SERVER} as a draft library entry (two-step confirm). Refused for any other server or org.`
+    ).argument("<filebox_id>", "filebox (document) id")
+  ).action(async (fileboxRaw, opts) => {
+    const fileboxId = parsePositiveIntArg(fileboxRaw, "<filebox_id>");
+    const body = await metadataBody(opts);
+    const serverFlag = resolveServer(opts.server);
+    const confirmCmd = addConfirmCommand(fileboxId, opts, serverFlag);
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runTemplateLibraryAdd({
+        client: setup.client,
+        fileboxId,
+        body,
+        image: opts.image,
+        token: opts.confirmToken,
+        serverFlag,
+        confirmCmd,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addWriteFlags(addCmd);
+  const updateCmd = addMetadataOptions(
+    cmd.command("update").description(
+      "Fill in or change an entry's card: description, type, industry, tags, image, creator (two-step confirm)"
+    ).argument("<id>", "template library entry id")
+  ).option("--creator <user_id>", "User id of the entry's creator (who gets the import emails)").action(async (idRaw, opts) => {
+    const id = parsePositiveIntArg(idRaw, "<id>");
+    const body = await metadataBody(opts);
+    if (opts.creator !== void 0)
+      body.creator_id = parsePositiveIntArg(opts.creator, "--creator");
+    const serverFlag = resolveServer(opts.server);
+    const confirmCmd = updateConfirmCommand(id, opts, serverFlag);
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runTemplateLibraryUpdate({
+        client: setup.client,
+        id,
+        body,
+        image: opts.image,
+        token: opts.confirmToken,
+        serverFlag,
+        confirmCmd,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addWriteFlags(updateCmd);
+  const stateHelp = {
+    publish: "Publish an entry to every customer org on this server (needs a card image; two-step confirm with the production word gate)",
+    unpublish: "Take an entry out of the customer-facing library (two-step confirm)",
+    archive: "Archive an unpublished entry (two-step confirm)",
+    restore: "Un-archive an entry back to draft (two-step confirm)"
+  };
+  for (const verb of ["publish", "unpublish", "archive", "restore"]) {
+    const stateCmd = cmd.command(verb).description(stateHelp[verb]).argument("<id>", "template library entry id");
+    if (verb === "publish") {
+      addImageOption(stateCmd, "Set the card image first");
+    }
+    stateCmd.action(
+      async (idRaw, opts) => {
+        const id = parsePositiveIntArg(idRaw, "<id>");
+        const serverFlag = resolveServer(opts.server);
+        const confirmCmd = stateConfirmCommand(verb, id, opts, serverFlag);
+        const setup = await setupCall(opts.server, opts.account);
+        try {
+          await runTemplateLibraryState({
+            client: setup.client,
+            id,
+            verb,
+            image: opts.image,
+            token: opts.confirmToken,
+            serverFlag,
+            confirmCmd,
+            asJson: opts.json === true,
+            signal: setup.signal,
+            out: process.stdout
+          });
+        } finally {
+          setup.cleanup();
+        }
+      }
+    );
+    addWriteFlags(stateCmd);
+  }
+}
+
 // src/api/businessCalendars.ts
 function buildAuditQs(q) {
   if (q === void 0) return "";
@@ -74316,7 +75133,7 @@ async function runCalendarsAuditList(cfg) {
   }
   renderAuditTable(cfg.out, resp);
 }
-function writeTable44(out, rows) {
+function writeTable45(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -74367,7 +75184,7 @@ function renderAuditTable(out, resp) {
       ]
     });
   }
-  writeTable44(out, rows);
+  writeTable45(out, rows);
   if (resp.count > resp.results.length) {
     out.write(`
 (showing ${resp.results.length} of ${resp.count}; use --limit / --page)
@@ -74661,72 +75478,6 @@ function getSystemEntities(client, options) {
   return read(client, "v1/ManagedAgents/getSystemEntities", {}, options);
 }
 
-// src/commands/_agentCli.ts
-import { access } from "fs/promises";
-var JSON_HELP = "Emit raw JSON to stdout instead of a pretty render.";
-var CONFIRM_HELP = "Token from a prior plan run \u2014 required to actually write";
-function withTarget(cmd) {
-  addServerFlag(cmd);
-  addAccountFlag(cmd);
-  return cmd;
-}
-function std() {
-  return { out: process.stdout, err: process.stderr };
-}
-function requireId(value, placeholder) {
-  const id = (value ?? "").trim();
-  if (id === "") {
-    throw new Error(`missing required option: --id ${placeholder}`);
-  }
-  return id;
-}
-function requirePositiveInt(value, flag) {
-  const n = /^\d+$/.test(value) ? Number(value) : NaN;
-  if (!Number.isSafeInteger(n) || n <= 0) {
-    throw new Error(`${flag} ${JSON.stringify(value)}: expected a positive integer`);
-  }
-  return n;
-}
-function requireBool(value, flag) {
-  if (value === "true") return true;
-  if (value === "false") return false;
-  throw new Error(`${flag} ${JSON.stringify(value ?? "")}: expected true or false`);
-}
-function splitList(value) {
-  return [
-    ...new Set(
-      (value ?? "").split(",").map((part) => part.trim()).filter((part) => part !== "")
-    )
-  ];
-}
-function isNoneSentinel(parts, flag, value, what) {
-  if (!parts.includes("none")) return false;
-  if (parts.length === 1) return true;
-  throw new Error(`${flag} ${JSON.stringify(value)}: "none" cannot be combined with ${what}`);
-}
-function shellArg(value) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : shellQuote(value);
-}
-function proseStream(cfg) {
-  return cfg.asJson ? cfg.err : cfg.out;
-}
-async function assertNoOverwrite(paths, force) {
-  if (force) return;
-  const existing = [];
-  for (const path13 of paths) {
-    try {
-      await access(path13);
-      existing.push(path13);
-    } catch {
-    }
-  }
-  if (existing.length > 0) {
-    throw new Error(
-      `refusing to overwrite existing file(s): ${existing.join(", ")}. Pull into another --dir, or pass --force to replace them.`
-    );
-  }
-}
-
 // src/commands/_agentCliScopes.ts
 var DEFAULT_CLI_SCOPES = ["*:read"];
 var CLI_SCOPE_ACTIONS = ["read", "write", "destructive", "*"];
@@ -75580,12 +76331,12 @@ async function runSkillsList(cfg) {
     writeJSONIndented(cfg.out, res);
     return;
   }
-  const list28 = res.data ?? [];
-  if (list28.length === 0) {
+  const list29 = res.data ?? [];
+  if (list29.length === 0) {
     cfg.out.write("(no skills)\n");
     return;
   }
-  for (const s of list28) {
+  for (const s of list29) {
     const title = s.display_title ?? s.name ?? "(untitled)";
     const owner = s.state?.owner !== void 0 ? `  owner=${s.state.owner}` : "";
     cfg.out.write(`${s.id ?? "?"}  ${title}${owner}
@@ -75607,12 +76358,12 @@ async function runSkillsVersions(cfg) {
     writeJSONIndented(cfg.out, res);
     return;
   }
-  const list28 = res.versions ?? [];
-  if (list28.length === 0) {
+  const list29 = res.versions ?? [];
+  if (list29.length === 0) {
     cfg.out.write("(no versions)\n");
     return;
   }
-  for (const v of list28) {
+  for (const v of list29) {
     const files = v.hasContent === true ? "[files]" : "[no files]";
     cfg.out.write(`${v.version ?? "?"}  ${v.createdAt ?? ""}  ${files}  ${v.name ?? ""}
 `);
@@ -75730,7 +76481,7 @@ async function runSkillsDelete(cfg) {
 }
 function registerAgentSkillsCommand(agents) {
   const skills = agents.command("skills").description("Inspect and edit Agent Studio skills (pull to disk, publish new versions).");
-  const list28 = skills.command("list").description("List skills, with owner where known.").option("--source <s>", "Filter by source: custom | anthropic.").option("--limit <n>", "Max skills to return (1-100).").option("--page <cursor>", "Page cursor from a previous list (its nextPage).").option("--json", JSON_HELP).action(async (opts) => {
+  const list29 = skills.command("list").description("List skills, with owner where known.").option("--source <s>", "Filter by source: custom | anthropic.").option("--limit <n>", "Max skills to return (1-100).").option("--page <cursor>", "Page cursor from a previous list (its nextPage).").option("--json", JSON_HELP).action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
       await runSkillsList({
@@ -75746,7 +76497,7 @@ function registerAgentSkillsCommand(agents) {
       setup.cleanup();
     }
   });
-  withTarget(list28);
+  withTarget(list29);
   const get16 = skills.command("get").description("Fetch a skill's Anthropic metadata as raw JSON (no file contents).").option("--id <skillId>", "Skill id.").action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
@@ -75803,7 +76554,7 @@ function registerAgentSkillsCommand(agents) {
     }
   });
   withTarget(pull);
-  const create19 = skills.command("create").description("Create a new skill from a directory of files (must include a SKILL.md).").option("--title <title>", "Display title (required).").option("--dir <path>", "Directory whose files form the skill (default: current directory).").option("--json", JSON_HELP).action(async (opts) => {
+  const create20 = skills.command("create").description("Create a new skill from a directory of files (must include a SKILL.md).").option("--title <title>", "Display title (required).").option("--dir <path>", "Directory whose files form the skill (default: current directory).").option("--json", JSON_HELP).action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
       await runSkillsCreate({
@@ -75818,7 +76569,7 @@ function registerAgentSkillsCommand(agents) {
       setup.cleanup();
     }
   });
-  withTarget(create19);
+  withTarget(create20);
   const publish = skills.command("publish").description("Publish a new version of an existing skill from a directory of files.").option("--id <skillId>", "Skill id.").option(
     "--dir <path>",
     "Directory whose files become the new version (default: current directory)."
@@ -75897,7 +76648,7 @@ async function runAgentsSystemEntities(cfg) {
     writeJSONIndented(cfg.out, res);
     return;
   }
-  const ids = (list28) => (list28 ?? []).length > 0 ? (list28 ?? []).join(", ") : "(none)";
+  const ids = (list29) => (list29 ?? []).length > 0 ? (list29 ?? []).join(", ") : "(none)";
   cfg.out.write(`agents:       ${ids(res.agentIds)}
 `);
   const protectedIds = res.protectedAgentIds;
@@ -76003,12 +76754,12 @@ async function runAgentsList(cfg) {
     writeJSONIndented(cfg.out, res);
     return;
   }
-  const list28 = res.data ?? [];
-  if (list28.length === 0) {
+  const list29 = res.data ?? [];
+  if (list29.length === 0) {
     cfg.out.write("(no agents)\n");
     return;
   }
-  for (const a of list28) {
+  for (const a of list29) {
     const cells = [
       a.id ?? "?",
       versionLabel2(a.version),
@@ -76604,7 +77355,7 @@ function registerAgentsCommand(root) {
   const agents = root.command("agents").description(
     "Inspect and edit Agent Studio managed agents on dr-ai-service (writes mint a new version)."
   );
-  const list28 = agents.command("list").description("List managed agents, newest first, with reach state and runtime exposure.").option("--limit <n>", "Max agents to return (1-100).").option("--page <cursor>", "Pagination cursor from a previous page.").option("--archived", "Include archived agents.").option("--json", JSON_HELP).action(async (opts) => {
+  const list29 = agents.command("list").description("List managed agents, newest first, with reach state and runtime exposure.").option("--limit <n>", "Max agents to return (1-100).").option("--page <cursor>", "Pagination cursor from a previous page.").option("--archived", "Include archived agents.").option("--json", JSON_HELP).action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
       await runAgentsList({
@@ -76620,7 +77371,7 @@ function registerAgentsCommand(root) {
       setup.cleanup();
     }
   });
-  withTarget(list28);
+  withTarget(list29);
   const get16 = agents.command("get").description("Fetch one agent (config + studio state + derived exposure) as raw JSON.").option("--id <agentId>", "Agent id.").option("--version-number <n>", "Pin a specific version (default: latest).").action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
@@ -76729,7 +77480,7 @@ function registerAgentsCommand(root) {
     }
   );
   withTarget(pull);
-  const update12 = agents.command("update").description("Update an agent \u2192 a new version. Provide any of the fields below.").option("--id <agentId>", "Agent id.").option(
+  const update13 = agents.command("update").description("Update an agent \u2192 a new version. Provide any of the fields below.").option("--id <agentId>", "Agent id.").option(
     "--version-number <n>",
     "Base version for optimistic concurrency (default: current latest)."
   ).option("--name <name>", "New name.").option("--model <model>", "New model id.").option("--system-file <path>", "File with the new system prompt.").option("--tools-file <path>", "JSON file with the new tools[] array.").option("--skills-file <path>", "JSON file with the new skills[] array.").option(
@@ -76782,8 +77533,8 @@ function registerAgentsCommand(root) {
       }
     }
   );
-  withTarget(update12);
-  const create19 = agents.command("create").description("Create a new agent (its first version).").option("--name <name>", "Agent name (required).").option("--model <model>", "Model id (required).").option("--description <text>", "Description.").option(
+  withTarget(update13);
+  const create20 = agents.command("create").description("Create a new agent (its first version).").option("--name <name>", "Agent name (required).").option("--model <model>", "Model id (required).").option("--description <text>", "Description.").option(
     "--origin <origin>",
     "Who owns the definition: in-flow (default, the SDK upgrade pass keeps its tools current) | custom (never auto-rewritten)."
   ).option("--system-file <path>", "File with the system prompt.").option("--tools-file <path>", "JSON file with the tools[] array.").option("--skills-file <path>", "JSON file with the skills[] array.").option(
@@ -76824,7 +77575,7 @@ function registerAgentsCommand(root) {
       }
     }
   );
-  withTarget(create19);
+  withTarget(create20);
   const mcpServers = agents.command("mcp-servers").description(
     "List the MCP servers an agent may be given in this environment \u2014 the keys --mcp-servers accepts. Empty means none is configured here."
   ).option("--json", JSON_HELP).action(async (opts) => {
@@ -76957,7 +77708,7 @@ function registerAgentsCommand(root) {
 }
 
 // src/auth/versionCheck.ts
-import { promises as fs36 } from "fs";
+import { promises as fs37 } from "fs";
 import * as os4 from "os";
 import * as path12 from "path";
 var LATEST_JSON_URL = "https://drcli.datarails.com/cli/latest.json";
@@ -76983,7 +77734,7 @@ function compareSemver(a, b) {
 }
 async function readCache() {
   try {
-    const raw2 = await fs36.readFile(cachePath(), "utf8");
+    const raw2 = await fs37.readFile(cachePath(), "utf8");
     const parsed2 = JSON.parse(raw2);
     if (typeof parsed2.checked_at !== "number" || typeof parsed2.latest_version !== "string" || parsed2.latest_version === "") {
       return null;
@@ -76999,10 +77750,10 @@ async function readCache() {
 async function writeCache(entry) {
   const target = cachePath();
   const dir = path12.dirname(target);
-  await fs36.mkdir(dir, { recursive: true });
+  await fs37.mkdir(dir, { recursive: true });
   const tmp = `${target}.tmp.${process.pid}`;
-  await fs36.writeFile(tmp, JSON.stringify(entry), { mode: 384 });
-  await fs36.rename(tmp, target);
+  await fs37.writeFile(tmp, JSON.stringify(entry), { mode: 384 });
+  await fs37.rename(tmp, target);
 }
 async function fetchLatestVersion() {
   if (LATEST_JSON_URL === "") return null;
@@ -77559,6 +78310,7 @@ function buildRootCommand() {
   registerMultiProductCommand(root);
   registerDeskCommand(root);
   registerPalettesCommand(root);
+  registerTemplateLibraryCommand(root);
   registerCalendarsCommand(root);
   registerAppSpaceCommand(root);
   registerAgentsCommand(root);