@delegance/cli 0.2.2 → 0.3.0

package/dist/bin/delegance.js

@@ -27,17 +27,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_chalk4 = __toESM(require("chalk"));
 
 // src/program.ts
-var import_commander19 = require("commander");
+var import_commander20 = require("commander");
 
 // src/version.ts
-var CLI_VERSION = "0.2.2";
+var CLI_VERSION = "0.3.0";
 
 // src/commands/auth.ts
 var os4 = __toESM(require("os"));
-var import_commander2 = require("commander");
-var import_inquirer2 = __toESM(require("inquirer"));
+var import_commander3 = require("commander");
+var import_inquirer3 = __toESM(require("inquirer"));
 var import_ora2 = __toESM(require("ora"));
-var import_sdk3 = require("@delegance/sdk");
+var import_sdk4 = require("@delegance/sdk");
 
 // src/utils/config.ts
 var import_conf = __toESM(require("conf"));
@@ -502,10 +502,10 @@ function openInBrowser(url, platform = process.platform) {
 
 // src/commands/signup.ts
 var import_crypto = require("crypto");
-var import_commander = require("commander");
-var import_inquirer = __toESM(require("inquirer"));
+var import_commander2 = require("commander");
+var import_inquirer2 = __toESM(require("inquirer"));
 var import_ora = __toESM(require("ora"));
-var import_sdk2 = require("@delegance/sdk");
+var import_sdk3 = require("@delegance/sdk");
 
 // src/utils/pending-signup.ts
 var fs3 = __toESM(require("fs"));
@@ -546,6 +546,82 @@ function clearPendingSignup(home) {
   }
 }
 
+// src/commands/terms.ts
+var import_commander = require("commander");
+var import_inquirer = __toESM(require("inquirer"));
+var import_sdk2 = require("@delegance/sdk");
+function termsAcceptRefusal(prompted) {
+  if (!prompted) {
+    return { kind: "error", message: `No prompt to answer. Read the Terms, then run "${cliCommand("terms accept --yes")}".` };
+  }
+  return { kind: "warn", message: "Not accepted. You can still quote; binding needs the current Terms." };
+}
+function termsLines(t) {
+  return [
+    `Delegance Terms of Service (version ${t.version}): ${t.termsUrl}`,
+    `Privacy Policy: ${t.privacyUrl}`,
+    ...t.summaries
+  ];
+}
+async function confirmTerms(t, opts) {
+  termsLines(t).forEach((l) => (opts.print ?? info)(l));
+  if (opts.flag) return true;
+  if (!opts.interactive) return false;
+  const ask = opts.ask ?? (async () => {
+    const a = await import_inquirer.default.prompt([{
+      type: "confirm",
+      name: "ok",
+      message: "Do you accept the Terms of Service and Privacy Policy?",
+      default: false
+    }]);
+    return a.ok === true;
+  });
+  return ask();
+}
+function createTermsCommand() {
+  const cmd = new import_commander.Command("terms").description("Show the Delegance Terms of Service, or accept the current version").option("--json", "Output as JSON").action(async (options) => {
+    try {
+      const t = await (0, import_sdk2.createSignup)({ baseUrl: getBaseUrl() }).getTerms();
+      if (options.json) {
+        json(t);
+        return;
+      }
+      termsLines(t).forEach((l) => info(l));
+      info(`Broker review before you bind: ${t.brokerReview.command}, or email ${t.brokerReview.email}`);
+    } catch (err) {
+      failWith("Could not load the Terms", err);
+    }
+  });
+  cmd.command("accept").description("Accept the current Terms of Service for your account (a bind can require it)").option("-y, --yes", "Accept without the prompt (you have read the Terms)").option("--json", "Output as JSON").action(async (options) => {
+    const client = getClient();
+    try {
+      const t = await client.terms.get();
+      const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !options.json;
+      const ok = await confirmTerms(t, {
+        flag: options.yes === true,
+        interactive,
+        // --json keeps stdout to one JSON document; the Terms still print, on stderr.
+        ...options.json ? { print: (l) => console.error(l) } : {}
+      });
+      if (!ok) {
+        const refusal = termsAcceptRefusal(interactive);
+        if (refusal.kind === "error") error(refusal.message);
+        else warn(refusal.message);
+        process.exit(1);
+      }
+      const r = await client.terms.accept(t.version);
+      if (options.json) {
+        json(r);
+        return;
+      }
+      success(`Accepted the Terms of Service, version ${r.version}.`);
+    } catch (err) {
+      failWith("Could not record your acceptance", err);
+    }
+  });
+  return cmd;
+}
+
 // src/commands/signup.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var COMPANY_SIZES = ["0", "1", "2-10", "11-25", "26-50", "51-100", "100-499", "500+"];
@@ -570,8 +646,44 @@ function addressProblem(a) {
   if (!/^\d{5}(-\d{4})?$/.test(a.zip.trim())) return "ZIP must be 5 digits (or ZIP+4).";
   return null;
 }
+var TERMS_REASONS = /* @__PURE__ */ new Set(["terms_not_accepted", "terms_version_outdated"]);
+function isTermsRefusal(err) {
+  return err instanceof import_sdk3.DeleganceError && TERMS_REASONS.has(String(err.reason ?? ""));
+}
+async function loadSignupTerms(get) {
+  try {
+    return await get();
+  } catch (err) {
+    if (err instanceof import_sdk3.DeleganceError && err.statusCode === 404) return null;
+    throw err;
+  }
+}
+async function loadSignupTermsOrExit(baseUrl) {
+  try {
+    return await loadSignupTerms(() => (0, import_sdk3.createSignup)({ baseUrl }).getTerms());
+  } catch (err) {
+    failWith("Could not load the Terms of Service", err);
+  }
+}
+function nonInteractiveMissing(options, terms) {
+  const missing = missingSignupFields(options);
+  if (terms && options.acceptTerms !== true) missing.push("--accept-terms");
+  return missing;
+}
+async function acceptTermsOrExit(baseUrl, flag, preloaded) {
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const terms = preloaded === void 0 ? await loadSignupTermsOrExit(baseUrl) : preloaded;
+  if (!terms) return "";
+  const ok = await confirmTerms(terms, { flag, interactive });
+  if (!ok) {
+    if (interactive) warn("Not signed up. Delegance needs your acceptance of the Terms and Privacy Policy to open an account.");
+    else error("No terminal to ask in. Read the Terms and Privacy Policy above, then pass --accept-terms.");
+    process.exit(1);
+  }
+  return terms.version;
+}
 function exchangeRefusal(err) {
-  if (!(err instanceof import_sdk2.DeleganceError)) return null;
+  if (!(err instanceof import_sdk3.DeleganceError)) return null;
   switch (err.reason) {
     case "account_exists":
       return `This email already has a Delegance account, so signup did not attach it to a new one. Sign in and create a key at ${PORTAL_URL}/portal/settings/api-keys`;
@@ -585,19 +697,21 @@ function exchangeRefusal(err) {
 }
 async function ensureEnrolled(pending) {
   if (pending.enrollmentId) return pending;
-  const signup = (0, import_sdk2.createSignup)({ baseUrl: pending.baseUrl });
+  const signup = (0, import_sdk3.createSignup)({ baseUrl: pending.baseUrl });
   const hash = (0, import_crypto.createHash)("sha256").update(pending.deviceSecret).digest("hex");
   const enrollment = await signup.enroll(pending.bootstrapKey, {
     deviceSecretHash: hash,
     firstName: pending.firstName ?? "",
-    lastName: pending.lastName ?? ""
+    lastName: pending.lastName ?? "",
+    termsAccepted: true,
+    termsVersion: pending.termsVersion ?? ""
   });
   const next = { ...pending, enrollmentId: enrollment.enrollmentId, verificationSent: false };
   savePendingSignup(next);
   return sendVerification(next);
 }
 async function sendVerification(pending) {
-  await (0, import_sdk2.createSignup)({ baseUrl: pending.baseUrl }).requestVerification(pending.bootstrapKey);
+  await (0, import_sdk3.createSignup)({ baseUrl: pending.baseUrl }).requestVerification(pending.bootstrapKey);
   const next = { ...pending, verificationSent: true };
   savePendingSignup(next);
   return next;
@@ -614,7 +728,7 @@ function storeOrPrintKey(apiKey, store = storeApiKey) {
   }
 }
 async function waitAndStore(pending, timeoutMs) {
-  const signup = (0, import_sdk2.createSignup)({ baseUrl: pending.baseUrl });
+  const signup = (0, import_sdk3.createSignup)({ baseUrl: pending.baseUrl });
   const spinner = (0, import_ora.default)(`Waiting for you to click the link sent to ${pending.email} (Ctrl-C is safe: resume with "${cliInvocation()} verify")`).start();
   const started = Date.now();
   try {
@@ -665,21 +779,24 @@ function signupPrompts(options, interactive) {
   return all.filter((q) => q.when !== false).map(({ when: _when, ...q }) => q);
 }
 function createSignupCommand() {
-  return new import_commander.Command("signup").description("Create a Delegance account and get an API key, from the terminal").option("-e, --email <email>", "Your work email (the confirm link goes here)").option("-b, --business <name>", "Business name").option("--first <name>", "Your first name").option("--last <name>", "Your last name").option("-i, --industry <industry>", 'What the business does, e.g. "commercial bakery"').option("--size <size>", `Employees: ${COMPANY_SIZES.join(", ")}`).option("-w, --website <url>", "Website (full URL)").option("--street <street>", "Business street address").option("--city <city>", "City").option("--state <state>", "State, 2-letter code (carriers quote by state)").option("--zip <zip>", "ZIP code").option("-d, --description <text>", "A sentence on what the business does (helps carriers classify it)").option("--timeout <minutes>", "How long to wait for the email click", "15").option("--no-wait", 'Send the email and exit; collect later with "delegance verify"').action(async (options) => {
+  return new import_commander2.Command("signup").description("Create a Delegance account and get an API key, from the terminal").option("-e, --email <email>", "Your work email (the confirm link goes here)").option("-b, --business <name>", "Business name").option("--first <name>", "Your first name").option("--last <name>", "Your last name").option("-i, --industry <industry>", 'What the business does, e.g. "commercial bakery"').option("--size <size>", `Employees: ${COMPANY_SIZES.join(", ")}`).option("-w, --website <url>", "Website (full URL)").option("--street <street>", "Business street address").option("--city <city>", "City").option("--state <state>", "State, 2-letter code (carriers quote by state)").option("--zip <zip>", "ZIP code").option("-d, --description <text>", "A sentence on what the business does (helps carriers classify it)").option("--accept-terms", "Accept the Terms of Service and Privacy Policy (shown before the account is created)").option("--timeout <minutes>", "How long to wait for the email click", "15").option("--no-wait", 'Send the email and exit; collect later with "delegance verify"').action(async (options) => {
     const existing = loadPendingSignup();
     if (existing) {
       warn(`A signup for ${existing.email} is already waiting for its email confirmation.`);
       info(`Run "${cliInvocation()} verify" to finish it, or "${cliInvocation()} verify --cancel" to start over.`);
       process.exit(1);
     }
+    const baseUrl = getBaseUrl();
+    let preloadedTerms;
     if (!(process.stdin.isTTY && process.stdout.isTTY)) {
-      const missing = missingSignupFields(options);
+      preloadedTerms = await loadSignupTermsOrExit(baseUrl);
+      const missing = nonInteractiveMissing(options, preloadedTerms);
       if (missing.length) {
         error(`No terminal to ask in. Missing: ${missing.join(" ")}`);
         process.exit(1);
       }
     }
-    const answers = await import_inquirer.default.prompt(signupPrompts(options, Boolean(process.stdin.isTTY && process.stdout.isTTY)));
+    const answers = await import_inquirer2.default.prompt(signupPrompts(options, Boolean(process.stdin.isTTY && process.stdout.isTTY)));
     const address = {
       street: String(options.street ?? answers.street).trim(),
       city: String(options.city ?? answers.city).trim(),
@@ -702,8 +819,8 @@ function createSignupCommand() {
       error(`--size must be one of: ${COMPANY_SIZES.join(", ")}`);
       process.exit(1);
     }
-    const baseUrl = getBaseUrl();
-    const signup = (0, import_sdk2.createSignup)({ baseUrl });
+    const termsVersion = await acceptTermsOrExit(baseUrl, options.acceptTerms === true, preloadedTerms);
+    const signup = (0, import_sdk3.createSignup)({ baseUrl });
     const spinner = (0, import_ora.default)("Creating your account...").start();
     try {
       const account = await signup.createAccount({
@@ -715,7 +832,7 @@ function createSignupCommand() {
         ...description ? { description } : {},
         ...options.website ? { website: options.website } : {}
       });
-      const device = (0, import_sdk2.newDeviceSecret)();
+      const device = (0, import_sdk3.newDeviceSecret)();
       let pending = {
         enrollmentId: "",
         deviceSecret: device.secret,
@@ -724,6 +841,7 @@ function createSignupCommand() {
         email,
         firstName: String(options.first ?? answers.first).trim(),
         lastName: String(options.last ?? answers.last).trim(),
+        termsVersion,
         baseUrl,
         createdAt: (/* @__PURE__ */ new Date()).toISOString()
       };
@@ -745,14 +863,14 @@ function createSignupCommand() {
   });
 }
 function resendFailureMessage(err) {
-  if (err instanceof import_sdk2.DeleganceError && (err.statusCode === 401 || err.statusCode === 403)) {
+  if (err instanceof import_sdk3.DeleganceError && (err.statusCode === 401 || err.statusCode === 403)) {
     return "Your email is already confirmed, so there is nothing to re-send. Collecting your key now.";
   }
   const why = err instanceof Error ? err.message : String(err);
   return `Could not re-send the email (${why}). Still waiting for the link you already have.`;
 }
 function createVerifyCommand() {
-  return new import_commander.Command("verify").description("Finish a signup: wait for the email click and store your API key").option("--resend", "Send the confirm email again").option("--cancel", "Forget the in-progress signup on this machine").option("--timeout <minutes>", "How long to wait", "15").action(async (options) => {
+  return new import_commander2.Command("verify").description("Finish a signup: wait for the email click and store your API key").option("--resend", "Send the confirm email again").option("--cancel", "Forget the in-progress signup on this machine").option("--accept-terms", "Accept the Terms of Service, if this signup has not recorded an acceptance yet").option("--timeout <minutes>", "How long to wait", "15").action(async (options) => {
     const pending = loadPendingSignup();
     if (!pending) {
       info(`No signup is waiting on this machine. Start one with "${cliInvocation()} signup".`);
@@ -772,8 +890,21 @@ function createVerifyCommand() {
         failWith("Could not send the confirm email", err);
       }
     } else if (!pending.enrollmentId) {
+      let toEnroll = pending;
+      if (!pending.termsVersion) {
+        toEnroll = { ...pending, termsVersion: await acceptTermsOrExit(pending.baseUrl, options.acceptTerms === true) };
+        savePendingSignup(toEnroll);
+      }
       try {
-        resumed = await ensureEnrolled(pending);
+        try {
+          resumed = await ensureEnrolled(toEnroll);
+        } catch (err) {
+          if (!isTermsRefusal(err)) throw err;
+          warn("The Terms of Service changed since this signup started. Review them again.");
+          toEnroll = { ...toEnroll, termsVersion: await acceptTermsOrExit(pending.baseUrl, options.acceptTerms === true) };
+          savePendingSignup(toEnroll);
+          resumed = await ensureEnrolled(toEnroll);
+        }
         success(`Finished setting up the signup. We emailed a confirm link to ${pending.email}.`);
       } catch (err) {
         failWith("Could not finish the signup", err);
@@ -781,7 +912,7 @@ function createVerifyCommand() {
     }
     if (options.resend && resumed === pending) {
       try {
-        await (0, import_sdk2.createSignup)({ baseUrl: pending.baseUrl }).requestVerification(pending.bootstrapKey);
+        await (0, import_sdk3.createSignup)({ baseUrl: pending.baseUrl }).requestVerification(pending.bootstrapKey);
         success(`Sent the confirm link to ${pending.email} again.`);
       } catch (err) {
         info(resendFailureMessage(err));
@@ -812,7 +943,7 @@ function describeExpiry(expiresAt, now = /* @__PURE__ */ new Date()) {
   return `${date} (in ${days} day${days === 1 ? "" : "s"})`;
 }
 function deviceLoginRefusal(err) {
-  if (!(err instanceof import_sdk3.DeleganceError)) return null;
+  if (!(err instanceof import_sdk4.DeleganceError)) return null;
   switch (err.reason) {
     case "access_denied":
       return "The request was denied in the portal. Nothing was stored.";
@@ -825,14 +956,14 @@ function deviceLoginRefusal(err) {
   }
 }
 function notAvailable(err) {
-  return err instanceof import_sdk3.DeleganceError && (err.statusCode === 404 || err.reason === "not_available");
+  return err instanceof import_sdk4.DeleganceError && (err.statusCode === 404 || err.reason === "not_available");
 }
 function pasteFallbackHint() {
   info(`Create a key at ${PORTAL_URL}/portal/settings/api-keys, then run "${cliInvocation()} auth login --key <key>".`);
 }
 async function readKeyInfo(apiKey, timeoutMs = 5e3) {
   try {
-    const client = new import_sdk3.DeleganceClient({ apiKey, baseUrl: getBaseUrl(), timeout: timeoutMs, retries: 0 });
+    const client = new import_sdk4.DeleganceClient({ apiKey, baseUrl: getBaseUrl(), timeout: timeoutMs, retries: 0 });
     return await client.auth.keyInfo();
   } catch {
     return null;
@@ -853,7 +984,7 @@ async function loginWithKey(apiKey, skipVerify) {
   }
   const spinner = (0, import_ora2.default)("Verifying API key...").start();
   try {
-    const client = new import_sdk3.DeleganceClient({ apiKey, baseUrl: getBaseUrl() });
+    const client = new import_sdk4.DeleganceClient({ apiKey, baseUrl: getBaseUrl() });
     const isValid = await client.verifyApiKey();
     if (!isValid) {
       spinner.fail("API key verification failed");
@@ -874,8 +1005,8 @@ async function loginWithKey(apiKey, skipVerify) {
   }
 }
 async function loginWithBrowser(openBrowser) {
-  const login = (0, import_sdk3.createDeviceLogin)({ baseUrl: getBaseUrl() });
-  const device = (0, import_sdk3.newDeviceSecret)();
+  const login = (0, import_sdk4.createDeviceLogin)({ baseUrl: getBaseUrl() });
+  const device = (0, import_sdk4.newDeviceSecret)();
   let start;
   try {
     start = await login.start({ deviceSecretHash: device.hash, deviceName: defaultDeviceName() });
@@ -929,7 +1060,7 @@ async function loginWithBrowser(openBrowser) {
   }
 }
 function createAuthCommand() {
-  const auth = new import_commander2.Command("auth").description("Manage authentication");
+  const auth = new import_commander3.Command("auth").description("Manage authentication");
   auth.command("login").description("Sign in: approve this terminal in the portal, or store an API key").option("-k, --key <apiKey>", "Store this API key instead of signing in with the browser").option("--paste", "Prompt for an API key instead of signing in with the browser").option("--no-browser", "Print the approval link without opening a browser").option("--skip-verify", "With --key or --paste: store without verification (useful when API is not reachable)").action(async (options) => {
     try {
       if (options.key) {
@@ -937,7 +1068,7 @@ function createAuthCommand() {
         return;
       }
       if (options.paste) {
-        const answers = await import_inquirer2.default.prompt([
+        const answers = await import_inquirer3.default.prompt([
           {
             type: "password",
             name: "apiKey",
@@ -972,13 +1103,13 @@ function createAuthCommand() {
     let origin = null;
     let refused = null;
     try {
-      const client = new import_sdk3.DeleganceClient({ apiKey, baseUrl: getBaseUrl(), timeout: 5e3, retries: 0 });
+      const client = new import_sdk4.DeleganceClient({ apiKey, baseUrl: getBaseUrl(), timeout: 5e3, retries: 0 });
       const keyInfo = await client.auth.keyInfo();
       origin = keyInfo.origin;
       expiryLine = describeExpiry(keyInfo.expiresAt);
       if (!fromEnv) setStoredKeyExpiry(keyInfo.expiresAt);
     } catch (err) {
-      if (err instanceof import_sdk3.DeleganceError && err.statusCode === 401) {
+      if (err instanceof import_sdk4.DeleganceError && err.statusCode === 401) {
         refused = err.reason === "key_expired" ? "Your API key expired" : err.reason === "key_membership_revoked" ? "Your API key was revoked: its user is no longer an active member of the company" : "Your API key was rejected by the server";
         expiryLine = err.reason === "key_expired" ? "Expired" : "Not valid";
       }
@@ -1008,13 +1139,13 @@ function createAuthCommand() {
     }
     const spinner = (0, import_ora2.default)("Refreshing your key...").start();
     try {
-      const client = new import_sdk3.DeleganceClient({ apiKey, baseUrl: getBaseUrl() });
+      const client = new import_sdk4.DeleganceClient({ apiKey, baseUrl: getBaseUrl() });
       const { expiresAt } = await client.auth.refresh();
       if (!process.env.DELEGANCE_API_KEY) setStoredKeyExpiry(expiresAt);
       spinner.succeed(`Key refreshed. Expires ${describeExpiry(expiresAt)}.`);
     } catch (err) {
       spinner.stop();
-      if (err instanceof import_sdk3.DeleganceError && err.reason === "not_refreshable") {
+      if (err instanceof import_sdk4.DeleganceError && err.reason === "not_refreshable") {
         info("This key came from the portal and keeps the expiry it was created with. Nothing changed.");
         return;
       }
@@ -1031,7 +1162,7 @@ function createAuthCommand() {
       return;
     }
     if (!options.force) {
-      const { confirm } = await import_inquirer2.default.prompt([
+      const { confirm } = await import_inquirer3.default.prompt([
         {
           type: "confirm",
           name: "confirm",
@@ -1061,7 +1192,7 @@ function createAuthCommand() {
     }
     const spinner = (0, import_ora2.default)("Fetching account info...").start();
     try {
-      const client = new import_sdk3.DeleganceClient({
+      const client = new import_sdk4.DeleganceClient({
         apiKey,
         baseUrl: getBaseUrl()
       });
@@ -1089,11 +1220,11 @@ function createAuthCommand() {
 }
 
 // src/commands/company.ts
-var import_commander3 = require("commander");
-var import_inquirer3 = __toESM(require("inquirer"));
+var import_commander4 = require("commander");
+var import_inquirer4 = __toESM(require("inquirer"));
 var import_ora3 = __toESM(require("ora"));
 function createCompanyCommand() {
-  const company = new import_commander3.Command("company").alias("companies").description("Manage companies");
+  const company = new import_commander4.Command("company").alias("companies").description("Manage companies");
   company.command("list").description("List companies").option("--include-created", "Include companies created via this API key").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     const spinner = (0, import_ora3.default)("Fetching companies...").start();
@@ -1129,7 +1260,7 @@ function createCompanyCommand() {
   company.command("create").description("Create a new company").option("-n, --name <name>", "Company name").option("-i, --industry <industry>", "Industry").option("-s, --size <size>", "Company size (1, 2-10, 11-25, 26-50, 51-100, 100-499, 500+)").option("-e, --email <email>", "Contact email").option("--fein <fein>", "FEIN (XX-XXXXXXX)").option("--website <url>", "Website URL").option("--external-id <id>", "External ID for deduplication").option("--interactive", "Interactive mode with prompts").option("--json", "Output as JSON").action(async (options) => {
     let companyData;
     if (options.interactive || !options.name && !options.industry) {
-      const answers = await import_inquirer3.default.prompt([
+      const answers = await import_inquirer4.default.prompt([
         {
           type: "input",
           name: "name",
@@ -1275,7 +1406,7 @@ function createCompanyCommand() {
 }
 
 // src/commands/document.ts
-var import_commander4 = require("commander");
+var import_commander5 = require("commander");
 var import_ora4 = __toESM(require("ora"));
 var fs4 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
@@ -1286,7 +1417,7 @@ function extractionOutcome(status) {
   return "pending";
 }
 function createDocumentCommand() {
-  const doc = new import_commander4.Command("doc").alias("docs").alias("document").alias("documents").description("Manage documents");
+  const doc = new import_commander5.Command("doc").alias("docs").alias("document").alias("documents").description("Manage documents");
   doc.command("upload <files...>").description("Upload one or more documents").option("-c, --company <id>", "Company ID (or use default)").option("-t, --type <type>", "Document type (policy, loss_run, financial_statement, sov, application, certificate, endorsement, bor, other)").option("--external-id <id>", "External ID for reference").option("-w, --wait", "Wait for extraction to complete").option("--timeout <ms>", "Timeout for waiting (default: 120000)", "120000").option("--json", "Output as JSON").action(async (filePatterns, options) => {
     const companyId = getCompanyId(options);
     const client = getClient();
@@ -1564,11 +1695,11 @@ function createDocumentCommand() {
 }
 
 // src/commands/chat.ts
-var import_commander5 = require("commander");
+var import_commander6 = require("commander");
 var import_ora5 = __toESM(require("ora"));
-var import_inquirer4 = __toESM(require("inquirer"));
+var import_inquirer5 = __toESM(require("inquirer"));
 function createChatCommand() {
-  const chat = new import_commander5.Command("ask").alias("chat").description("Ask the Orin insurance assistant a question");
+  const chat = new import_commander6.Command("ask").alias("chat").description("Ask the Orin insurance assistant a question");
   chat.command("query <question...>").alias("q").description("Ask a single question").option("-c, --conversation <id>", "Continue a previous conversation").option("--json", "Output as JSON").action(async (questionParts, options) => {
     const question = questionParts.join(" ");
     const client = getClient();
@@ -1604,7 +1735,7 @@ function createChatCommand() {
     console.log('Type your questions. Enter "exit" or "quit" to end the session.');
     console.log();
     while (true) {
-      const { question } = await import_inquirer4.default.prompt([
+      const { question } = await import_inquirer5.default.prompt([
         {
           type: "input",
           name: "question",
@@ -1664,18 +1795,18 @@ function createChatCommand() {
 }
 
 // src/commands/quote.ts
-var import_commander6 = require("commander");
+var import_commander7 = require("commander");
 var import_ora7 = __toESM(require("ora"));
-var import_inquirer6 = __toESM(require("inquirer"));
-var import_sdk5 = require("@delegance/sdk");
+var import_inquirer7 = __toESM(require("inquirer"));
+var import_sdk6 = require("@delegance/sdk");
 
 // src/commands/instant-quote.ts
 var fs5 = __toESM(require("fs"));
 var import_crypto2 = require("crypto");
 var import_chalk2 = __toESM(require("chalk"));
-var import_inquirer5 = __toESM(require("inquirer"));
+var import_inquirer6 = __toESM(require("inquirer"));
 var import_ora6 = __toESM(require("ora"));
-var import_sdk4 = require("@delegance/sdk");
+var import_sdk5 = require("@delegance/sdk");
 
 // src/utils/coverage-names.ts
 var NAMES = {
@@ -2014,16 +2145,11 @@ var DEMO_STATUS = {
 };
 
 // src/commands/instant-quote.ts
-function shellArg(value) {
-  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function activeRequestLines(err, coverageFlag, ctx = {}) {
-  if (!(err instanceof import_sdk4.DeleganceError) || err.statusCode !== 409 || !err.body) return null;
+function activeRequestLines(err, coverageFlag) {
+  if (!(err instanceof import_sdk5.DeleganceError) || err.statusCode !== 409 || !err.body) return null;
   const { body } = err;
   const code = body.message;
-  const answersArg = ctx.answersFile ? ` --answers ${shellArg(ctx.answersFile)}` : "";
-  const requote = `${cliInvocation()} quote start --coverage ${coverageFlag}${answersArg} --replace`;
-  const replaceCmd = ctx.submit ? `${cliInvocation()} quote submit ${shellArg(ctx.submit.submissionId)} --session-version ${shellArg(ctx.submit.sessionVersion)} --answers ${ctx.answersFile ? shellArg(ctx.answersFile) : "<file>"} --replace` : requote;
+  const requote = `${cliInvocation()} quote start --coverage ${coverageFlag} --replace`;
   if (code === "active_request_exists") {
     const active = Array.isArray(body.active) ? body.active : [];
     const first = active[0];
@@ -2031,7 +2157,7 @@ function activeRequestLines(err, coverageFlag, ctx = {}) {
     const carriers = Array.isArray(first?.carriers) ? first.carriers.map((c) => `${c.carrierId}${c.state ? ` (${c.state.toLowerCase()})` : ""}`).join(", ") : "";
     return [
       `Already with carriers${id ? `: ${id}` : ""}${carriers ? `, ${carriers}` : ""}.`,
-      `Check it: ${id ? `${cliInvocation()} quote status ${id}` : `${cliInvocation()} quote status <id>`}   Replace it: ${replaceCmd}`
+      `Check it: ${id ? `${cliInvocation()} quote status ${id}` : `${cliInvocation()} quote status <id>`}   Replace it: ${requote}`
     ];
   }
   if (code === "replace_conflict") {
@@ -2083,7 +2209,7 @@ async function askOne(q, answers, fallback) {
       }
     };
   }
-  const { v } = await import_inquirer5.default.prompt([prompt]);
+  const { v } = await import_inquirer6.default.prompt([prompt]);
   const c = coerceAnswer(q, v);
   if (c.ok && c.value !== void 0) answers[q.id] = c.value;
 }
@@ -2094,7 +2220,7 @@ async function askQuestions(questions, answers = {}) {
     const round = planQuestionRound(questions, answers, handled);
     if (round.confirm.length + round.checklist.length + round.ask.length === 0) break;
     if (round.confirm.length) {
-      const { keep } = await import_inquirer5.default.prompt([
+      const { keep } = await import_inquirer6.default.prompt([
         {
           type: "checkbox",
           name: "keep",
@@ -2123,7 +2249,7 @@ async function askQuestions(questions, answers = {}) {
       }
     }
     if (round.checklist.length) {
-      const { yes } = await import_inquirer5.default.prompt([
+      const { yes } = await import_inquirer6.default.prompt([
         {
           type: "checkbox",
           name: "yes",
@@ -2134,7 +2260,7 @@ async function askQuestions(questions, answers = {}) {
       ]);
       const yn = checklistAnswers(round.checklist, yes);
       const yesCount = Object.values(yn).filter((v) => v === "yes").length;
-      const { ok } = await import_inquirer5.default.prompt([
+      const { ok } = await import_inquirer6.default.prompt([
         { type: "confirm", name: "ok", message: `Yes to ${yesCount}, No to ${round.checklist.length - yesCount}. Correct?`, default: true }
       ]);
       if (ok) {
@@ -2168,7 +2294,7 @@ async function runBrokerHandoff(submissionId, instantAnswers, opts) {
   try {
     plan = await client.instantQuotes.brokerHandoffQuestions(submissionId, instantAnswers);
   } catch (err) {
-    if (err instanceof import_sdk4.DeleganceError && err.statusCode === 503) {
+    if (err instanceof import_sdk5.DeleganceError && err.statusCode === 503) {
       say("A broker can still market it: reply to the confirmation email, or start in the portal.");
       return;
     }
@@ -2434,7 +2560,7 @@ function addInstantQuoteCommands(quote) {
         ...options.replace ? { replace: true } : {}
       });
     } catch (err) {
-      const guardLines = activeRequestLines(err, String(options.coverage), { answersFile: options.answers });
+      const guardLines = activeRequestLines(err, String(options.coverage));
       if (guardLines) {
         submitSpinner.fail("Nothing was sent.");
         guardLines.forEach((l) => options.json ? console.error(l) : info(l));
@@ -2502,10 +2628,7 @@ function addInstantQuoteCommands(quote) {
       }
       await waitAndPrint(submissionId, Number(options.timeout) * 6e4 || 6e5, !!options.json);
     } catch (err) {
-      const guardLines = activeRequestLines(err, "<list>", {
-        answersFile: options.answers,
-        submit: { submissionId, sessionVersion: String(options.sessionVersion) }
-      });
+      const guardLines = activeRequestLines(err, "<list>");
       if (guardLines) {
         error("Nothing was sent.");
         guardLines.forEach((l) => options.json ? console.error(l) : info(l));
@@ -2557,7 +2680,7 @@ async function waitAndPrint(submissionId, timeoutMs, asJson) {
 // src/commands/quote.ts
 var QUOTE_SUBMISSION_UNAVAILABLE = "Quote submission via API isn't available yet";
 function createQuoteCommand() {
-  const quote = new import_commander6.Command("quote").alias("quotes").description("Request and manage insurance quotes");
+  const quote = new import_commander7.Command("quote").alias("quotes").description("Request and manage insurance quotes");
   quote.command("carriers").description("List available carriers for quoting").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     const spinner = (0, import_ora7.default)("Fetching carriers...").start();
@@ -2604,7 +2727,7 @@ function createQuoteCommand() {
       process.exit(1);
     }
     if (options.interactive || carrierIds.length === 0 && !options.all) {
-      const { selectedCarriers } = await import_inquirer6.default.prompt([
+      const { selectedCarriers } = await import_inquirer7.default.prompt([
         {
           type: "checkbox",
           name: "selectedCarriers",
@@ -2664,7 +2787,7 @@ function createQuoteCommand() {
       }
     } catch (err) {
       spinner.fail("Failed to submit quote request");
-      if (err instanceof import_sdk5.NotImplementedError) {
+      if (err instanceof import_sdk6.NotImplementedError) {
         error(QUOTE_SUBMISSION_UNAVAILABLE);
         info(`For an instant quote from the terminal: ${cliInvocation()} quote start --coverage gl`);
         info(`Or start a quote at ${PORTAL_URL}`);
@@ -2797,11 +2920,11 @@ function formatQuoteStatus(status) {
 }
 
 // src/commands/policy.ts
-var import_commander7 = require("commander");
-var import_inquirer7 = __toESM(require("inquirer"));
+var import_commander8 = require("commander");
+var import_inquirer8 = __toESM(require("inquirer"));
 var import_ora8 = __toESM(require("ora"));
 function createPolicyCommand() {
-  const policy = new import_commander7.Command("policy").alias("policies").description("Manage insurance policies");
+  const policy = new import_commander8.Command("policy").alias("policies").description("Manage insurance policies");
   policy.command("list").alias("ls").description("List all policies").option("-s, --status <status>", "Filter by status (active, expired, all)", "active").option("-t, --type <type>", "Filter by policy type").option("-l, --limit <n>", "Maximum results", "50").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     const spinner = (0, import_ora8.default)("Fetching policies...").start();
@@ -3053,7 +3176,7 @@ async function signWithStepUp(client, requestId, sig, stepUpId, presetCode) {
       warn(`No terminal to type the code in. Finish with: ${cliInvocation()} policy sign ${requestId} --signer-name "${sig.signerName}" --signer-title "${sig.signerTitle}" --attest --step-up ${id} --code <code>`);
       return;
     }
-    const answer = await import_inquirer7.default.prompt([{
+    const answer = await import_inquirer8.default.prompt([{
       type: "input",
       name: "code",
       message: "Code from your email:",
@@ -3080,11 +3203,11 @@ function formatPolicyStatus(isActive, daysUntilExpiry) {
 }
 
 // src/commands/coi.ts
-var import_commander8 = require("commander");
+var import_commander9 = require("commander");
 var import_ora9 = __toESM(require("ora"));
-var import_inquirer8 = __toESM(require("inquirer"));
+var import_inquirer9 = __toESM(require("inquirer"));
 function createCOICommand() {
-  const coi = new import_commander8.Command("coi").description("Generate and manage Certificates of Insurance");
+  const coi = new import_commander9.Command("coi").description("Generate and manage Certificates of Insurance");
   coi.command("generate").alias("create").description("Generate a Certificate of Insurance").option("-p, --policies <ids...>", "Policy IDs to include").option("-n, --holder-name <name>", "Certificate holder name").option("-a, --holder-address <address>", "Certificate holder address").option("--city <city>", "Certificate holder city").option("--state <state>", "Certificate holder state (2-letter)").option("--zip <zip>", "Certificate holder ZIP").option("-t, --type <type>", "Certificate type (additional_insured, certificate_holder)", "certificate_holder").option("-i, --interactive", "Interactive mode").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     let policyIds = options.policies || [];
@@ -3103,7 +3226,7 @@ function createCOICommand() {
         info(`Upload policy documents first with "${cliInvocation()} doc upload"`);
         process.exit(1);
       }
-      const answers = await import_inquirer8.default.prompt([
+      const answers = await import_inquirer9.default.prompt([
         {
           type: "checkbox",
           name: "selectedPolicies",
@@ -3239,12 +3362,12 @@ function createCOICommand() {
 }
 
 // src/commands/sov.ts
-var import_commander9 = require("commander");
+var import_commander10 = require("commander");
 var import_ora10 = __toESM(require("ora"));
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
 function createSOVCommand() {
-  const sov = new import_commander9.Command("sov").description("Manage Schedules of Values (property schedules)");
+  const sov = new import_commander10.Command("sov").description("Manage Schedules of Values (property schedules)");
   sov.command("upload <file>").description("Upload a Schedule of Values file").option("-l, --line <line>", "Line of business (property, inland_marine, etc)", "property").option("--effective <date>", "Effective date (YYYY-MM-DD)").option("--expiration <date>", "Expiration date (YYYY-MM-DD)").option("-w, --wait", "Wait for parsing to complete").option("--json", "Output as JSON").action(async (file, options) => {
     const client = getClient();
     const filePath = import_path.default.resolve(file);
@@ -3402,7 +3525,7 @@ function showSOVDetails(s) {
 }
 
 // src/commands/appetite.ts
-var import_commander10 = require("commander");
+var import_commander11 = require("commander");
 var import_ora11 = __toESM(require("ora"));
 function num(value) {
   if (value === void 0) return void 0;
@@ -3450,7 +3573,7 @@ function printResult(result) {
   for (const w of result.warnings) warn(w);
 }
 function createAppetiteCommand() {
-  const appetite = new import_commander10.Command("appetite").description("Check which carriers will write a risk");
+  const appetite = new import_commander11.Command("appetite").description("Check which carriers will write a risk");
   appetite.command("match").description("Match a business to carrier appetite").requiredOption("-s, --state <state>", "Two-letter state code").option("-i, --industry <industry>", 'Industry, e.g. "bakery"').option("-d, --description <text>", "What the business does").option("--naics <code>", "NAICS code").option("--sic <code>", "SIC code").option("-c, --coverage <types>", "Comma-separated coverage types, e.g. general_liability,workers_comp").option("--carriers <names>", "Comma-separated carriers to limit the match to").option("--market-size <size>", '"Small Business" or "Middle Market"').option("--revenue <usd>", "Annual revenue").option("--payroll <usd>", "Annual payroll").option("--property-value <usd>", "Total property value").option("--min-fit <fit>", "Raise the quality floor: possible or strong").option("--top <n>", "Maximum matches (1-50)").option("--no-wait", "Return the job id instead of waiting for a cold match").option("--timeout <ms>", "How long to wait for a cold match", "120000").option("--json", "Output as JSON").action(async (options) => {
     const input = buildMatchInput(options);
     const timeoutMs = positiveInt(options.timeout, "--timeout");
@@ -3511,7 +3634,7 @@ function createAppetiteCommand() {
 }
 
 // src/commands/lead.ts
-var import_commander11 = require("commander");
+var import_commander12 = require("commander");
 var import_ora12 = __toESM(require("ora"));
 function buildLeadInput(options) {
   const input = {
@@ -3542,7 +3665,7 @@ function buildLeadInput(options) {
   return input;
 }
 function createLeadCommand() {
-  const lead = new import_commander11.Command("lead").alias("leads").description("Send prospect businesses to Delegance");
+  const lead = new import_commander12.Command("lead").alias("leads").description("Send prospect businesses to Delegance");
   lead.command("create").description("Create a lead (idempotent on --external-id and contact email)").requiredOption("-n, --name <name>", "Business name").requiredOption("-e, --email <email>", "Contact email").option("--legal-name <name>", "Legal name, if different").option("-i, --industry <industry>", "Industry").option("-p, --phone <phone>", "Contact phone").option("-w, --website <url>", "Website (full URL)").option("--size <size>", "Company size").option("-d, --description <text>", "What the business does").option("--naics <code>", "NAICS code").option("--sic <code>", "SIC code").option("-s, --state <state>", "Two-letter state code").option("--street <street>", "Street address").option("--suite <suite>", "Suite").option("--city <city>", "City").option("--address-state <state>", "Address state (defaults to --state)").option("--zip <zip>", "ZIP code").option("--external-id <id>", "Your id for this lead").option("--source <source>", "Lead source label").option("--notes <notes>", "Notes for the broker").option("--json", "Output as JSON").action(async (options) => {
     const input = buildLeadInput(options);
     if (input.address && (!input.address.street || !input.address.city || !input.address.state || !input.address.zip)) {
@@ -3565,11 +3688,11 @@ function createLeadCommand() {
 }
 
 // src/commands/knowledge.ts
-var import_commander12 = require("commander");
+var import_commander13 = require("commander");
 var import_ora13 = __toESM(require("ora"));
 var SEARCH_TYPES = ["notecard", "document_chunk"];
 function createKnowledgeCommand() {
-  const knowledge = new import_commander12.Command("knowledge").alias("kb").description("Search notecards and document facts");
+  const knowledge = new import_commander13.Command("knowledge").alias("kb").description("Search notecards and document facts");
   knowledge.command("search <query...>").description("Search notecards and document text").option("-t, --type <type>", `Limit to one result type (${SEARCH_TYPES.join(", ")})`).option("-l, --limit <n>", "Maximum results", "10").option("--json", "Output as JSON").action(async (queryParts, options) => {
     const client = getClient();
     const query = queryParts.join(" ");
@@ -3671,7 +3794,7 @@ function createKnowledgeCommand() {
 }
 
 // src/commands/onboarding.ts
-var import_commander13 = require("commander");
+var import_commander14 = require("commander");
 var import_ora14 = __toESM(require("ora"));
 var ONBOARDING_STATES = [
   "created",
@@ -3681,7 +3804,7 @@ var ONBOARDING_STATES = [
   "ready"
 ];
 function createOnboardingCommand() {
-  const onboarding = new import_commander13.Command("onboarding").alias("onboard").description("Check account setup and onboarding state");
+  const onboarding = new import_commander14.Command("onboarding").alias("onboard").description("Check account setup and onboarding state");
   onboarding.command("status").description("Show the setup checklist and the next step").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     const spinner = (0, import_ora14.default)("Fetching onboarding status...").start();
@@ -3772,7 +3895,7 @@ function createOnboardingCommand() {
 }
 
 // src/commands/usage.ts
-var import_commander14 = require("commander");
+var import_commander15 = require("commander");
 var import_ora15 = __toESM(require("ora"));
 function isoDay(daysAgo, now = /* @__PURE__ */ new Date()) {
   const d = new Date(now.getTime() - daysAgo * 24 * 60 * 60 * 1e3);
@@ -3782,7 +3905,7 @@ function cents(n) {
   return `$${(n / 100).toFixed(2)}`;
 }
 function createUsageCommand() {
-  const usage = new import_commander14.Command("usage").description("Show API usage, billing, and rate limits");
+  const usage = new import_commander15.Command("usage").description("Show API usage, billing, and rate limits");
   usage.command("summary").description("Usage for the current billing period").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     const spinner = (0, import_ora15.default)("Fetching usage summary...").start();
@@ -3862,10 +3985,10 @@ function createUsageCommand() {
 }
 
 // src/commands/keys.ts
-var import_commander15 = require("commander");
+var import_commander16 = require("commander");
 var import_ora16 = __toESM(require("ora"));
 var import_crypto3 = require("crypto");
-var import_sdk6 = require("@delegance/sdk");
+var import_sdk7 = require("@delegance/sdk");
 var KEYS_PORTAL_URL = `${PORTAL_URL}/portal/settings/api-keys`;
 function parseExpiresInDays(raw) {
   if (raw === void 0 || raw === "") return void 0;
@@ -3874,9 +3997,9 @@ function parseExpiresInDays(raw) {
 }
 function parseScopes(raw) {
   const parts = (Array.isArray(raw) ? raw : [raw ?? "read,write"]).flatMap((p) => p.split(/[\s,]+/)).map((p) => p.trim()).filter(Boolean);
-  const unknown = parts.filter((p) => !import_sdk6.API_KEY_SCOPES.includes(p));
+  const unknown = parts.filter((p) => !import_sdk7.API_KEY_SCOPES.includes(p));
   if (unknown.length > 0) {
-    throw new Error(`Unknown scope(s): ${unknown.join(", ")}. Allowed: ${import_sdk6.API_KEY_SCOPES.join(", ")}`);
+    throw new Error(`Unknown scope(s): ${unknown.join(", ")}. Allowed: ${import_sdk7.API_KEY_SCOPES.join(", ")}`);
   }
   return Array.from(new Set(parts));
 }
@@ -3905,7 +4028,7 @@ function printCreatedKey(created) {
   console.log(`  ${created.key}`);
 }
 function createKeysCommand() {
-  const keys = new import_commander15.Command("keys").alias("api-keys").description("Manage API keys");
+  const keys = new import_commander16.Command("keys").alias("api-keys").description("Manage API keys");
   keys.command("list").alias("ls").description("List API keys for your company").option("-l, --limit <n>", "Maximum results", "50").option("--cursor <cursor>", "Page cursor from a previous list").option("--json", "Output as JSON").action(async (options) => {
     const client = getClient();
     const spinner = (0, import_ora16.default)("Fetching API keys...").start();
@@ -3941,7 +4064,7 @@ function createKeysCommand() {
       failWith("API error", err);
     }
   });
-  keys.command("create <name>").description("Create an API key (needs a key with the admin scope)").option("-s, --scopes <scopes>", `Comma-separated scopes (${import_sdk6.API_KEY_SCOPES.join(", ")})`, "read,write").option("-e, --expires-in-days <days>", 'Expire the key after N days (1-365; default 90), or "never" for a read-only key').option("--json", "Output as JSON").action(async (name, options) => {
+  keys.command("create <name>").description("Create an API key (needs a key with the admin scope)").option("-s, --scopes <scopes>", `Comma-separated scopes (${import_sdk7.API_KEY_SCOPES.join(", ")})`, "read,write").option("-e, --expires-in-days <days>", 'Expire the key after N days (1-365; default 90), or "never" for a read-only key').option("--json", "Output as JSON").action(async (name, options) => {
     let scopes;
     try {
       scopes = parseScopes(options.scopes);
@@ -4020,7 +4143,7 @@ function createKeysCommand() {
       spinner.succeed("API key revoked");
     } catch (err) {
       spinner.fail("Failed to revoke API key");
-      if (err instanceof import_sdk6.AuthenticationError) {
+      if (err instanceof import_sdk7.AuthenticationError) {
         error("Revoking a key needs a signed-in portal session today");
         info(`Revoke it at ${KEYS_PORTAL_URL}`);
         process.exit(1);
@@ -4032,10 +4155,10 @@ function createKeysCommand() {
 }
 
 // src/commands/config.ts
-var import_commander16 = require("commander");
-var import_inquirer9 = __toESM(require("inquirer"));
+var import_commander17 = require("commander");
+var import_inquirer10 = __toESM(require("inquirer"));
 function createConfigCommand() {
-  const config2 = new import_commander16.Command("config").description("Manage CLI configuration");
+  const config2 = new import_commander17.Command("config").description("Manage CLI configuration");
   config2.command("show").alias("list").description("Show current configuration").option("--json", "Output as JSON").action((options) => {
     const currentConfig = getConfig();
     const apiKey = getApiKey();
@@ -4079,7 +4202,7 @@ function createConfigCommand() {
   });
   config2.command("reset").description("Reset all configuration to defaults").option("-f, --force", "Skip confirmation").action(async (options) => {
     if (!options.force) {
-      const { confirm } = await import_inquirer9.default.prompt([
+      const { confirm } = await import_inquirer10.default.prompt([
         {
           type: "confirm",
           name: "confirm",
@@ -4164,9 +4287,9 @@ function createConfigCommand() {
 }
 
 // src/commands/feedback.ts
-var import_commander17 = require("commander");
-var import_inquirer10 = __toESM(require("inquirer"));
-var import_sdk7 = require("@delegance/sdk");
+var import_commander18 = require("commander");
+var import_inquirer11 = __toESM(require("inquirer"));
+var import_sdk8 = require("@delegance/sdk");
 var TYPES = ["bug", "idea", "question"];
 var MESSAGE_MAX = 500;
 var USAGE = `${cliInvocation()} feedback "what happened" [--type bug|idea|question] [--include-last]`;
@@ -4183,7 +4306,7 @@ function buildFeedbackContext(last) {
     ctx.at = last.at;
   }
   ctx.cliVersion = CLI_VERSION;
-  ctx.sdkVersion = import_sdk7.SDK_VERSION;
+  ctx.sdkVersion = import_sdk8.SDK_VERSION;
   return ctx;
 }
 function usageError(message) {
@@ -4192,14 +4315,14 @@ function usageError(message) {
   process.exit(2);
 }
 function createFeedbackCommand() {
-  return new import_commander17.Command("feedback").alias("bug").description("Report a bug, an idea, or a question to Delegance").argument("[message...]", "What happened (asked for when left out on a terminal)").option("-t, --type <type>", "bug, idea, or question", "bug").option("--include-last", "Attach the last command name, exit code, trace id, and CLI/SDK versions (never its arguments)").option("--json", "Output as JSON").action(async (words, options) => {
+  return new import_commander18.Command("feedback").alias("bug").description("Report a bug, an idea, or a question to Delegance").argument("[message...]", "What happened (asked for when left out on a terminal)").option("-t, --type <type>", "bug, idea, or question", "bug").option("--include-last", "Attach the last command name, exit code, trace id, and CLI/SDK versions (never its arguments)").option("--json", "Output as JSON").action(async (words, options) => {
     const type = String(options.type ?? "bug").toLowerCase();
     if (!TYPES.includes(type)) usageError(`--type must be bug, idea, or question, got "${options.type}"`);
     let message = (words ?? []).join(" ").trim();
     const mode = feedbackInputMode({ message, isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY) });
     if (mode === "usage_error") usageError(`Say what happened: ${USAGE}`);
     if (mode === "prompt") {
-      const answer = await import_inquirer10.default.prompt([
+      const answer = await import_inquirer11.default.prompt([
         { type: "input", name: "message", message: type === "bug" ? "What went wrong?" : "What would you like to tell us?" }
       ]);
       message = String(answer.message ?? "").trim();
@@ -4221,7 +4344,7 @@ function createFeedbackCommand() {
 }
 
 // src/utils/checkbox-prompt.ts
-var import_inquirer11 = __toESM(require("inquirer"));
+var import_inquirer12 = __toESM(require("inquirer"));
 var import_chalk3 = __toESM(require("chalk"));
 var CHECKBOX_HINT = "(space to select, Enter to continue)";
 var registered = false;
@@ -4243,19 +4366,19 @@ function minimalCheckboxPrompt(Base) {
 }
 function registerMinimalCheckbox() {
   if (registered) return;
-  const prompts = import_inquirer11.default.prompt.prompts;
+  const prompts = import_inquirer12.default.prompt.prompts;
   const Base = prompts?.checkbox;
   if (!Base) return;
-  import_inquirer11.default.registerPrompt("checkbox", minimalCheckboxPrompt(Base));
+  import_inquirer12.default.registerPrompt("checkbox", minimalCheckboxPrompt(Base));
   registered = true;
 }
 
 // src/commands/commerce.ts
-var import_commander18 = require("commander");
+var import_commander19 = require("commander");
 var fs7 = __toESM(require("fs"));
-var import_inquirer12 = __toESM(require("inquirer"));
+var import_inquirer13 = __toESM(require("inquirer"));
 var import_ora17 = __toESM(require("ora"));
-var import_sdk8 = require("@delegance/sdk");
+var import_sdk9 = require("@delegance/sdk");
 function formatCents(cents2, currency = "usd") {
   return currency.toLowerCase() === "usd" ? formatCurrency(cents2 / 100) : `${(cents2 / 100).toFixed(2)} ${currency.toUpperCase()}`;
 }
@@ -4281,6 +4404,35 @@ function describeBindResult(r) {
   lines.push(r.next);
   return lines;
 }
+var BROKER_REVIEW_EMAIL = "support@delegancebrokerage.com";
+function selfDirectedAckLines(submissionId, offerId) {
+  return [
+    "This is a self-directed placement: Delegance binds the coverage you chose and does not advise on whether it fits your needs (Terms Section 9A).",
+    `Want a licensed broker to review it first? Run: ${cliInvocation()} bind ${submissionId} ${offerId} --broker-review`
+  ];
+}
+function brokerReviewMailto(submissionId, offerId) {
+  const subject = encodeURIComponent(`Broker review before bind: submission ${submissionId}, offer ${offerId}`);
+  return `mailto:${BROKER_REVIEW_EMAIL}?subject=${subject}`;
+}
+function brokerReviewLines(submissionId, offerId) {
+  return [
+    "Nothing was bound, and no review has been requested yet.",
+    `To request a review by a licensed Delegance broker, send an email to ${BROKER_REVIEW_EMAIL}`,
+    `naming submission ${submissionId} and offer ${offerId}: ${brokerReviewMailto(submissionId, offerId)}`,
+    "Wait for the broker to reply before you bind. A reviewed placement is not self-directed."
+  ];
+}
+function brokerReviewResult(submissionId, offerId) {
+  return {
+    bound: false,
+    reviewRequested: false,
+    submissionId,
+    offerId,
+    brokerReview: { email: BROKER_REVIEW_EMAIL, mailto: brokerReviewMailto(submissionId, offerId) },
+    message: brokerReviewLines(submissionId, offerId)
+  };
+}
 function exactDollars(cents2) {
   return `$${(cents2 / 100).toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
 }
@@ -4303,7 +4455,7 @@ function describeFinancing(f) {
 }
 async function askCode() {
   if (!process.stdin.isTTY) return null;
-  const answer = await import_inquirer12.default.prompt([{
+  const answer = await import_inquirer13.default.prompt([{
     type: "input",
     name: "code",
     message: "Code from your email:",
@@ -4312,11 +4464,19 @@ async function askCode() {
   return String(answer.code).trim();
 }
 function createBindCommand() {
-  return new import_commander18.Command("bind").description('Bind one offer from "quote status": the carrier checkout when the carrier offers it, otherwise a broker review').argument("<submissionId>", "The quote submission id").argument("<offerId>", "The offer id from the quote table").option("--attest", "Confirm the application answers are accurate (asked interactively when omitted)").option("--step-up <id>", "Finish an earlier attempt: the stepUpId the code email belongs to").option("--code <code>", "The 6-digit code from the email").option("--json", "Output as JSON").action(async (submissionId, offerId, options) => {
+  return new import_commander19.Command("bind").description('Bind one offer from "quote status": the carrier checkout when the carrier offers it, otherwise a broker review').argument("<submissionId>", "The quote submission id").argument("<offerId>", "The offer id from the quote table").option("--attest", "Confirm the application answers are accurate (asked interactively when omitted)").option("--broker-review", "Do not bind; ask a licensed broker to review this coverage first").option("--step-up <id>", "Finish an earlier attempt: the stepUpId the code email belongs to").option("--code <code>", "The 6-digit code from the email").option("--json", "Output as JSON").action(async (submissionId, offerId, options) => {
+    if (options.brokerReview) {
+      if (options.json) json(brokerReviewResult(submissionId, offerId));
+      else brokerReviewLines(submissionId, offerId).forEach((l) => info(l));
+      return;
+    }
     const client = getClient();
+    const ack = selfDirectedAckLines(submissionId, offerId);
+    if (options.json) ack.forEach((l) => console.error(l));
+    else ack.forEach((l) => info(l));
     let attest = options.attest === true;
     if (!attest && process.stdin.isTTY && !options.json) {
-      const a = await import_inquirer12.default.prompt([{
+      const a = await import_inquirer13.default.prompt([{
         type: "confirm",
         name: "ok",
         message: "Are the answers on this application accurate? Binding relies on them.",
@@ -4350,7 +4510,7 @@ function createBindCommand() {
         }
       }
       if (options.json) {
-        json(r);
+        json({ ...r, selfDirected: true, disclosure: ack[0] });
         return;
       }
       if (r.existing) warn(`A bind for this coverage is already open (${r.carrierName}). Showing it.`);
@@ -4360,7 +4520,7 @@ function createBindCommand() {
       describeFinancing(r.financing).forEach((l) => info(l));
     } catch (err) {
       spinner?.stop();
-      if (err instanceof import_sdk8.DeleganceError && [400, 403, 409].includes(err.statusCode ?? 0)) {
+      if (err instanceof import_sdk9.DeleganceError && [400, 403, 409].includes(err.statusCode ?? 0)) {
         error(err.message);
         process.exit(1);
       }
@@ -4381,7 +4541,7 @@ function summarizeBilling(payments) {
   return { openCents, paidCents, openCount };
 }
 function createBillingCommand() {
-  return new import_commander18.Command("billing").description("What you owe and what you paid: every premium payment request on the account").option("--json", "Output as JSON").action(async (options) => {
+  return new import_commander19.Command("billing").description("What you owe and what you paid: every premium payment request on the account").option("--json", "Output as JSON").action(async (options) => {
     try {
       const payments = await getClient().payments.list();
       const sum = summarizeBilling(payments);
@@ -4405,7 +4565,7 @@ function createBillingCommand() {
   });
 }
 function createPayCommand() {
-  return new import_commander18.Command("pay").description("Pay a premium: list payment requests, or get a checkout link for one").argument("[paymentId]", "Payment request to pay (omit to list them)").option("--json", "Output as JSON").action(async (paymentId, options) => {
+  return new import_commander19.Command("pay").description("Pay a premium: list payment requests, or get a checkout link for one").argument("[paymentId]", "Payment request to pay (omit to list them)").option("--json", "Output as JSON").action(async (paymentId, options) => {
     const client = getClient();
     try {
       if (!paymentId) {
@@ -4490,7 +4650,7 @@ function bondStartLines(r, ctx = {}) {
   return out;
 }
 function createBondCommand() {
-  const bond = new import_commander18.Command("bond").alias("bonds").description("Surety bond quotes");
+  const bond = new import_commander19.Command("bond").alias("bonds").description("Surety bond quotes");
   bond.command("quote").description("Start a bond quote and list its questions").requiredOption("-s, --state <state>", "Two-letter state, e.g. TX").option("-b, --bond <name>", 'Bond name or keyword, e.g. "notary", "contractor license"').option("--entity-id <id>", "Exact bond id, when you have it").option("--contract-amount <amount>", "Contract value, for contract bonds").option("--bond-amount <amount>", "Bond penal sum").option("--json", "Output as JSON").action(async (options) => {
     try {
       const r = await getClient().bonds.start({
@@ -4536,7 +4696,7 @@ function createBondCommand() {
   return bond;
 }
 function createClaimCommand() {
-  const claim = new import_commander18.Command("claim").alias("claims").description("File and track claims");
+  const claim = new import_commander19.Command("claim").alias("claims").description("File and track claims");
   claim.command("file").description("File a claim. The first time, accept the claims disclaimer in the portal").option("-d, --description <text>", "What happened (visible in shell history; prefer --description-file)").option("--description-file <file>", "Read what happened from a file, or - for stdin").option("--date <yyyy-mm-dd>", "When it happened").option("--policy <id>", "Policy id, if you know it").option("--json", "Output as JSON").action(async (options) => {
     let description = options.description;
     if (options.descriptionFile) {
@@ -4560,7 +4720,7 @@ function createClaimCommand() {
       success(r.message);
       keyValue({ Claim: r.claimId, Status: r.status, Portal: r.portalUrl });
     } catch (err) {
-      if (err instanceof import_sdk8.DeleganceError && err.reason === "gate_not_acknowledged") {
+      if (err instanceof import_sdk9.DeleganceError && err.reason === "gate_not_acknowledged") {
         error("Accept the claims disclaimer once in the portal, then file again. It cannot be accepted for you.");
         info(String(err.body?.portalUrl ?? ""));
         process.exit(1);
@@ -4593,7 +4753,7 @@ function createClaimCommand() {
 // src/program.ts
 function createProgram() {
   registerMinimalCheckbox();
-  const program2 = new import_commander19.Command();
+  const program2 = new import_commander20.Command();
   program2.name("delegance").description("CLI for the Delegance Brokerage platform").version(CLI_VERSION).enablePositionalOptions().option("-v, --verbose", "Enable verbose output").option("--json", "Output in JSON format").hook("preAction", () => {
     migrateLegacyConfigKey();
   });
@@ -4619,6 +4779,7 @@ function createProgram() {
   program2.addCommand(createBondCommand());
   program2.addCommand(createClaimCommand());
   program2.addCommand(createFeedbackCommand());
+  program2.addCommand(createTermsCommand());
   program2.addCommand(createConfigCommand());
   return program2;
 }