npm - @dura-run/cli - Versions diffs - 0.2.1 → 0.3.1 - Mend

@dura-run/cli 0.2.1 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/dura.js CHANGED Viewed

@@ -2356,13 +2356,44 @@ var init_config_store = () => {};
 var exports_login = {};
 __export(exports_login, {
   startCallbackServer: () => startCallbackServer,
-  registerLoginCommand: () => registerLoginCommand
+  registerLoginCommand: () => registerLoginCommand,
+  isAllowedReferer: () => isAllowedReferer,
+  CLI_CALLBACK_PORT_MIN: () => CLI_CALLBACK_PORT_MIN,
+  CLI_CALLBACK_PORT_MAX: () => CLI_CALLBACK_PORT_MAX
 });
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import {
   createServer
 } from "node:http";
 import { URL as URL2 } from "node:url";
-function startCallbackServer() {
+function safeEqual(a, b) {
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length)
+    return false;
+  return timingSafeEqual(aBuf, bBuf);
+}
+function isAllowedReferer(referer, consoleUrl, apiUrl) {
+  if (!referer)
+    return true;
+  let refOrigin;
+  try {
+    refOrigin = new URL2(referer).origin;
+  } catch {
+    return false;
+  }
+  const allowed = new Set;
+  for (const u of [consoleUrl, apiUrl]) {
+    try {
+      allowed.add(new URL2(u).origin);
+    } catch {}
+  }
+  return allowed.has(refOrigin);
+}
+function startCallbackServer(opts) {
+  const consoleUrl = opts?.consoleUrl ?? getConsoleUrl();
+  const apiUrl = opts?.apiUrl ?? getApiUrl();
+  const state = randomBytes(32).toString("hex");
   return new Promise((resolveSetup, rejectSetup) => {
     let resolveCode;
     let rejectCode;
@@ -2377,14 +2408,29 @@ function startCallbackServer() {
         res.end("Not found");
         return;
       }
+      const referer = req.headers["referer"] || req.headers["referrer"];
+      const refererValue = Array.isArray(referer) ? referer[0] : referer;
+      if (!isAllowedReferer(refererValue, consoleUrl, apiUrl)) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h1>Invalid callback</h1><p>Unexpected referrer.</p></body></html>");
+        rejectCode(new Error("Invalid callback: referrer is not from the dura.run console"));
+        return;
+      }
       const code = url.searchParams.get("code");
       const error = url.searchParams.get("error");
+      const callbackState = url.searchParams.get("state");
       if (error) {
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Login failed</h1><p>You can close this window.</p></body></html>");
         rejectCode(new Error(`Login failed: ${error}`));
         return;
       }
+      if (!callbackState || !safeEqual(callbackState, state)) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h1>Invalid callback</h1><p>Missing or invalid state parameter.</p></body></html>");
+        rejectCode(new Error("Invalid callback: missing or invalid state parameter"));
+        return;
+      }
       if (!code) {
         res.writeHead(400, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Invalid callback</h1><p>Missing code parameter.</p></body></html>");
@@ -2395,15 +2441,24 @@ function startCallbackServer() {
       res.end("<html><body><h1>Login successful!</h1><p>You can close this window and return to your terminal.</p></body></html>");
       resolveCode(code);
     });
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      if (!addr || typeof addr === "string") {
-        rejectSetup(new Error("Failed to bind callback server"));
-        return;
-      }
-      resolveSetup({ server, port: addr.port, codePromise });
-    });
-    server.on("error", rejectSetup);
+    const tryPort = (p) => {
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && p < CLI_CALLBACK_PORT_MAX) {
+          tryPort(p + 1);
+        } else {
+          rejectSetup(err);
+        }
+      });
+      server.listen(p, "127.0.0.1", () => {
+        const addr = server.address();
+        if (!addr || typeof addr === "string") {
+          rejectSetup(new Error("Failed to bind callback server"));
+          return;
+        }
+        resolveSetup({ server, port: addr.port, state, codePromise });
+      });
+    };
+    tryPort(CLI_CALLBACK_PORT_MIN);
   });
 }
 async function openBrowser(url) {
@@ -2440,10 +2495,13 @@ function registerLoginCommand(program2) {
     const consoleUrl = getConsoleUrl();
     let server;
     try {
-      const callbackResult = await startCallbackServer();
+      const callbackResult = await startCallbackServer({
+        consoleUrl,
+        apiUrl
+      });
       server = callbackResult.server;
-      const { port } = callbackResult;
-      const loginUrl = `${consoleUrl}/cli-auth?port=${port}`;
+      const { port, state } = callbackResult;
+      const loginUrl = `${consoleUrl}/cli-auth?port=${port}&state=${state}`;
       output.info("Opening browser for login...");
       output.info(`If the browser doesn't open, visit: ${loginUrl}`);
       await openBrowser(loginUrl);
@@ -2491,6 +2549,7 @@ function registerLoginCommand(program2) {
     }
   });
 }
+var CLI_CALLBACK_PORT_MIN = 31180, CLI_CALLBACK_PORT_MAX = 31199;
 var init_login = __esm(() => {
   init_src3();
   init_config_store();
@@ -2775,6 +2834,22 @@ var init_hello = __esm(() => {
   HELLO_TEMPLATE = GET_TEMPLATE;
 });
+// src/lib/handle-api-error.ts
+function reportApiError(output, err, fallbackCode) {
+  if (err instanceof ApiClientError) {
+    output.error(err.code, err.message, err.suggestion);
+    return;
+  }
+  if (err instanceof Error) {
+    output.error(fallbackCode, err.message);
+    return;
+  }
+  output.error(fallbackCode, String(err));
+}
+var init_handle_api_error = __esm(() => {
+  init_api_client();
+});
 // src/commands/new.ts
 var exports_new = {};
 __export(exports_new, {
@@ -2831,11 +2906,7 @@ function registerNewCommand(program2) {
 Set required secrets: ${result.requiredSecrets.join(", ")}`);
         }
       } catch (err) {
-        if (err instanceof ApiClientError) {
-          output.error(err.code, err.message, err.suggestion);
-        } else if (err instanceof Error) {
-          output.error("FORK_FAILED", err.message);
-        }
+        reportApiError(output, err, "FORK_FAILED");
       }
       return;
     }
@@ -2889,6 +2960,7 @@ var init_new = __esm(() => {
   init_hello();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/lib/project-id.ts
@@ -2943,9 +3015,7 @@ function registerSecretsCommand(program2) {
       const result = await client.put(`/api/v1/projects/${projectId}/secrets`, { name, value });
       output.success(result);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("SECRET_SET_FAILED", err.message);
-      }
+      reportApiError(output, err, "SECRET_SET_FAILED");
     }
   });
   secrets.command("list").description("List secret names (values never shown)").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -2958,9 +3028,7 @@ function registerSecretsCommand(program2) {
       const result = await client.get(`/api/v1/projects/${projectId}/secrets`);
       output.table(["Name", "Created", "Updated"], result.map((s) => [s.name, s.createdAt, s.updatedAt]));
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("SECRET_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "SECRET_LIST_FAILED");
     }
   });
   secrets.command("remove <name>").description("Remove a secret").option("--project <id>", "Project ID (defaults to dura.json)").option("--confirm", "Confirm this destructive operation").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (name, opts, cmd) => {
@@ -2977,9 +3045,7 @@ function registerSecretsCommand(program2) {
       await client.delete(`/api/v1/projects/${projectId}/secrets/${name}`);
       output.success({ deleted: true, name });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("SECRET_REMOVE_FAILED", err.message);
-      }
+      reportApiError(output, err, "SECRET_REMOVE_FAILED");
     }
   });
   secrets.command("pull").description("Write secrets to .env.local for local development").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").option("--dir <path>", "Directory to write .env.local to", ".").action(async (opts, cmd) => {
@@ -3000,9 +3066,7 @@ function registerSecretsCommand(program2) {
         count: Object.keys(values).length
       });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("SECRET_PULL_FAILED", err.message);
-      }
+      reportApiError(output, err, "SECRET_PULL_FAILED");
     }
   });
 }
@@ -3010,6 +3074,7 @@ var init_secrets = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
   init_project_id();
 });
@@ -7187,7 +7252,7 @@ var init_marketplace = __esm(() => {
     entrypoint: exports_external.string().min(1, "Entrypoint is required"),
     configSchema: exports_external.record(exports_external.unknown()).optional(),
     readme: exports_external.string().max(50000).optional()
-  });
+  }).strict();
   installAdapterSchema = exports_external.object({
     adapterId: exports_external.string().min(1, "Adapter ID is required"),
     config: exports_external.record(exports_external.unknown()).optional()
@@ -7201,7 +7266,7 @@ var init_marketplace = __esm(() => {
   });
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/query.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/query.js
 function cachedError(xs) {
   if (originCache.has(xs))
     return originCache.get(xs);
@@ -7341,7 +7406,7 @@ var init_query = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/errors.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/errors.js
 function connection(x, options, socket) {
   const { host, port } = socket || options;
   const error = Object.assign(new Error("write " + x + " " + (options.path || host + ":" + port)), {
@@ -7387,7 +7452,7 @@ var init_errors2 = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/types.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/types.js
 class NotTagged {
   then() {
     notTagged();
@@ -7658,7 +7723,7 @@ var init_types2 = __esm(() => {
   kebab.column.to = fromKebab;
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/result.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/result.js
 var Result;
 var init_result = __esm(() => {
   Result = class Result extends Array {
@@ -7678,7 +7743,7 @@ var init_result = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/queue.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/queue.js
 function Queue(initial = []) {
   let xs = initial.slice();
   let index = 0;
@@ -7708,7 +7773,7 @@ var init_queue = __esm(() => {
   queue_default = Queue;
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/bytes.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/bytes.js
 function fit(x) {
   if (buffer.length - b.i < x) {
     const prev = buffer, length = prev.length;
@@ -7783,7 +7848,7 @@ var init_bytes = __esm(() => {
   bytes_default = b;
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/connection.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/connection.js
 import net from "net";
 import tls from "tls";
 import crypto from "crypto";
@@ -8518,7 +8583,7 @@ var init_connection = __esm(() => {
   };
 });
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/subscribe.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/subscribe.js
 function Subscribe(postgres2, options) {
   const subscribers = new Map, slot = "postgresjs_" + Math.random().toString(36).slice(2), state = {};
   let connection2, stream, ended = false;
@@ -8714,7 +8779,7 @@ function parseEvent(x) {
 }
 var noop2 = () => {};
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/large.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/large.js
 import Stream2 from "stream";
 function largeObject(sql, oid, mode = 131072 | 262144) {
   return new Promise(async (resolve2, reject) => {
@@ -8781,7 +8846,7 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
 }
 var init_large = () => {};
-// ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/index.js
+// ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/index.js
 import os from "os";
 import fs from "fs";
 function Postgres(a, b2) {
@@ -9185,7 +9250,7 @@ var init_src = __esm(() => {
   });
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/entity.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/entity.js
 function is(value, type) {
   if (!value || typeof value !== "object") {
     return false;
@@ -9213,10 +9278,10 @@ var init_entity = __esm(() => {
   hasOwnEntityKind = Symbol.for("drizzle:hasOwnEntityKind");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/logger.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/logger.js
 var init_logger = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/query-promise.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/query-promise.js
 var QueryPromise;
 var init_query_promise = __esm(() => {
   init_entity();
@@ -9241,7 +9306,7 @@ var init_query_promise = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/column.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/column.js
 var Column;
 var init_column = __esm(() => {
   init_entity();
@@ -9295,7 +9360,7 @@ var init_column = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/column-builder.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/column-builder.js
 var ColumnBuilder;
 var init_column_builder = __esm(() => {
   init_entity();
@@ -9355,13 +9420,13 @@ var init_column_builder = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/table.utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/table.utils.js
 var TableName;
 var init_table_utils = __esm(() => {
   TableName = Symbol.for("drizzle:Name");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/foreign-keys.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/foreign-keys.js
 var ForeignKeyBuilder, ForeignKey;
 var init_foreign_keys = __esm(() => {
   init_entity();
@@ -9419,13 +9484,13 @@ var init_foreign_keys = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/tracing-utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/tracing-utils.js
 function iife(fn, ...args) {
   return fn(...args);
 }
 var init_tracing_utils = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/unique-constraint.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/unique-constraint.js
 function uniqueKeyName(table, columns) {
   return `${table[TableName]}_${columns.join("_")}_unique`;
 }
@@ -9433,7 +9498,7 @@ var init_unique_constraint = __esm(() => {
   init_table_utils();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/utils/array.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/utils/array.js
 function parsePgArrayValue(arrayString, startFrom, inQuotes) {
   for (let i = startFrom;i < arrayString.length; i++) {
     const char = arrayString[i];
@@ -9510,7 +9575,7 @@ function makePgArray(array) {
 }
 var init_array = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/common.js
 var PgColumnBuilder, PgColumn, ExtraConfigColumn, IndexedColumn, PgArrayBuilder, PgArray;
 var init_common = __esm(() => {
   init_column_builder();
@@ -9663,7 +9728,7 @@ var init_common = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/enum.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/enum.js
 function isPgEnum(obj) {
   return !!obj && typeof obj === "function" && isPgEnumSym in obj && obj[isPgEnumSym] === true;
 }
@@ -9708,7 +9773,7 @@ var init_enum = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/subquery.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/subquery.js
 var Subquery;
 var init_subquery = __esm(() => {
   init_entity();
@@ -9726,11 +9791,11 @@ var init_subquery = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/version.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/version.js
 var version = "0.39.3";
 var init_version = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/tracing.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/tracing.js
 var otel, rawTracer, tracer;
 var init_tracing = __esm(() => {
   init_tracing_utils();
@@ -9760,13 +9825,13 @@ var init_tracing = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/view-common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/view-common.js
 var ViewBaseConfig;
 var init_view_common = __esm(() => {
   ViewBaseConfig = Symbol.for("drizzle:ViewBaseConfig");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/table.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/table.js
 function getTableName(table) {
   return table[TableName];
 }
@@ -9811,7 +9876,7 @@ var init_table = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/sql.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/sql.js
 function isSQLWrapper(value) {
   return value !== null && value !== undefined && typeof value.getSQL === "function";
 }
@@ -10168,7 +10233,7 @@ var init_sql = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/alias.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/alias.js
 var ColumnAliasProxyHandler, TableAliasProxyHandler;
 var init_alias = __esm(() => {
   init_column();
@@ -10230,7 +10295,7 @@ var init_alias = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/selection-proxy.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/selection-proxy.js
 var SelectionProxyHandler;
 var init_selection_proxy = __esm(() => {
   init_alias();
@@ -10291,7 +10356,7 @@ var init_selection_proxy = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/utils.js
 function orderSelectedFields(fields, pathPrefix) {
   return Object.entries(fields).reduce((result, [name, field]) => {
     if (typeof name !== "string") {
@@ -10348,13 +10413,13 @@ var init_utils = __esm(() => {
   init_view_common();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/delete.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/delete.js
 var init_delete = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/errors.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/errors.js
 var init_errors3 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/int.common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/int.common.js
 var PgIntColumnBaseBuilder;
 var init_int_common = __esm(() => {
   init_entity();
@@ -10398,7 +10463,7 @@ var init_int_common = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/bigint.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/bigint.js
 function bigint(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config.mode === "number") {
@@ -10453,7 +10518,7 @@ var init_bigint = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/bigserial.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/bigserial.js
 function bigserial(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config.mode === "number") {
@@ -10510,7 +10575,7 @@ var init_bigserial = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/boolean.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/boolean.js
 function boolean(name) {
   return new PgBooleanBuilder(name ?? "");
 }
@@ -10535,7 +10600,7 @@ var init_boolean = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/char.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/char.js
 function char(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgCharBuilder(name, config);
@@ -10566,7 +10631,7 @@ var init_char = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/cidr.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/cidr.js
 function cidr(name) {
   return new PgCidrBuilder(name ?? "");
 }
@@ -10591,7 +10656,7 @@ var init_cidr = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/custom.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/custom.js
 function customType(customTypeParams) {
   return (a, b2) => {
     const { name, config } = getColumnNameAndConfig(a, b2);
@@ -10637,7 +10702,7 @@ var init_custom = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/date.common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/date.common.js
 var PgDateColumnBaseBuilder;
 var init_date_common = __esm(() => {
   init_entity();
@@ -10651,7 +10716,7 @@ var init_date_common = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/date.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/date.js
 function date(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config?.mode === "date") {
@@ -10703,7 +10768,7 @@ var init_date = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/double-precision.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/double-precision.js
 function doublePrecision(name) {
   return new PgDoublePrecisionBuilder(name ?? "");
 }
@@ -10734,7 +10799,7 @@ var init_double_precision = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/inet.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/inet.js
 function inet(name) {
   return new PgInetBuilder(name ?? "");
 }
@@ -10759,7 +10824,7 @@ var init_inet = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/integer.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/integer.js
 function integer(name) {
   return new PgIntegerBuilder(name ?? "");
 }
@@ -10791,7 +10856,7 @@ var init_integer = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/interval.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/interval.js
 function interval(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgIntervalBuilder(name, config);
@@ -10823,7 +10888,7 @@ var init_interval = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/json.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/json.js
 function json(name) {
   return new PgJsonBuilder(name ?? "");
 }
@@ -10864,7 +10929,7 @@ var init_json = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/jsonb.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/jsonb.js
 function jsonb(name) {
   return new PgJsonbBuilder(name ?? "");
 }
@@ -10905,7 +10970,7 @@ var init_jsonb = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/line.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/line.js
 function line(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (!config?.mode || config.mode === "tuple") {
@@ -10964,7 +11029,7 @@ var init_line = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/macaddr.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/macaddr.js
 function macaddr(name) {
   return new PgMacaddrBuilder(name ?? "");
 }
@@ -10989,7 +11054,7 @@ var init_macaddr = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/macaddr8.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/macaddr8.js
 function macaddr8(name) {
   return new PgMacaddr8Builder(name ?? "");
 }
@@ -11014,7 +11079,7 @@ var init_macaddr8 = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/numeric.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/numeric.js
 function numeric(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgNumericBuilder(name, config?.precision, config?.scale);
@@ -11056,7 +11121,7 @@ var init_numeric = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/point.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/point.js
 function point(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (!config?.mode || config.mode === "tuple") {
@@ -11121,7 +11186,7 @@ var init_point = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/postgis_extension/utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/postgis_extension/utils.js
 function hexToBytes(hex) {
   const bytes = [];
   for (let c = 0;c < hex.length; c += 2) {
@@ -11161,7 +11226,7 @@ function parseEWKB(hex) {
 }
 var init_utils2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/postgis_extension/geometry.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/postgis_extension/geometry.js
 function geometry(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (!config?.mode || config.mode === "tuple") {
@@ -11220,7 +11285,7 @@ var init_geometry = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/real.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/real.js
 function real(name) {
   return new PgRealBuilder(name ?? "");
 }
@@ -11255,7 +11320,7 @@ var init_real = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/serial.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/serial.js
 function serial(name) {
   return new PgSerialBuilder(name ?? "");
 }
@@ -11282,7 +11347,7 @@ var init_serial = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/smallint.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/smallint.js
 function smallint(name) {
   return new PgSmallIntBuilder(name ?? "");
 }
@@ -11314,7 +11379,7 @@ var init_smallint = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/smallserial.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/smallserial.js
 function smallserial(name) {
   return new PgSmallSerialBuilder(name ?? "");
 }
@@ -11341,7 +11406,7 @@ var init_smallserial = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/text.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/text.js
 function text(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgTextBuilder(name, config);
@@ -11370,7 +11435,7 @@ var init_text = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/time.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/time.js
 function time(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgTimeBuilder(name, config.withTimezone ?? false, config.precision);
@@ -11410,7 +11475,7 @@ var init_time = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/timestamp.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/timestamp.js
 function timestamp(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   if (config?.mode === "string") {
@@ -11482,7 +11547,7 @@ var init_timestamp = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/uuid.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/uuid.js
 function uuid(name) {
   return new PgUUIDBuilder(name ?? "");
 }
@@ -11511,7 +11576,7 @@ var init_uuid = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/varchar.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/varchar.js
 function varchar(a, b2 = {}) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgVarcharBuilder(name, config);
@@ -11542,7 +11607,7 @@ var init_varchar = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/bit.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/bit.js
 function bit(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgBinaryVectorBuilder(name, config);
@@ -11571,7 +11636,7 @@ var init_bit = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/halfvec.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/halfvec.js
 function halfvec(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgHalfVectorBuilder(name, config);
@@ -11606,7 +11671,7 @@ var init_halfvec = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/sparsevec.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/sparsevec.js
 function sparsevec(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgSparseVectorBuilder(name, config);
@@ -11635,7 +11700,7 @@ var init_sparsevec = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/vector_extension/vector.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/vector_extension/vector.js
 function vector(a, b2) {
   const { name, config } = getColumnNameAndConfig(a, b2);
   return new PgVectorBuilder(name, config);
@@ -11670,7 +11735,7 @@ var init_vector = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/index.js
 var init_columns = __esm(() => {
   init_bigint();
   init_bigserial();
@@ -11709,7 +11774,7 @@ var init_columns = __esm(() => {
   init_vector();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/columns/all.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/columns/all.js
 function getPgColumnBuilders() {
   return {
     bigint,
@@ -11781,7 +11846,7 @@ var init_all = __esm(() => {
   init_vector();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/table.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/table.js
 function pgTableWithSchema(name, columns, extraConfig, schema, baseName = name) {
   const rawTable = new PgTable(name, schema, baseName);
   const parsedColumns = typeof columns === "function" ? columns(getPgColumnBuilders()) : columns;
@@ -11832,7 +11897,7 @@ var init_table2 = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/primary-keys.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/primary-keys.js
 function primaryKey(...config) {
   if (config[0].columns) {
     return new PrimaryKeyBuilder(config[0].columns, config[0].name);
@@ -11870,44 +11935,49 @@ var init_primary_keys = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/expressions/conditions.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/expressions/conditions.js
 var init_conditions = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/expressions/select.js
-var init_select = () => {};
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/expressions/select.js
+function desc(column) {
+  return sql`${column} desc`;
+}
+var init_select = __esm(() => {
+  init_sql();
+});
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/expressions/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/expressions/index.js
 var init_expressions = __esm(() => {
   init_conditions();
   init_select();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/relations.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/relations.js
 var init_relations = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/functions/aggregate.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/functions/aggregate.js
 var init_aggregate = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/functions/vector.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/functions/vector.js
 var init_vector2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/functions/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/functions/index.js
 var init_functions = __esm(() => {
   init_aggregate();
   init_vector2();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/sql/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/sql/index.js
 var init_sql2 = __esm(() => {
   init_expressions();
   init_functions();
   init_sql();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/dialect.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/dialect.js
 var init_dialect = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/query-builders/query-builder.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/query-builders/query-builder.js
 var TypedQueryBuilder;
 var init_query_builder = __esm(() => {
   init_entity();
@@ -11919,7 +11989,7 @@ var init_query_builder = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/select.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/select.js
 function createSetOperator(type, isAll) {
   return (leftSelect, rightSelect, ...restSelects) => {
     const setOperators = [rightSelect, ...restSelects].map((select3) => ({
@@ -12172,16 +12242,16 @@ var init_select2 = __esm(() => {
   exceptAll = createSetOperator("except", true);
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/query-builder.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/query-builder.js
 var init_query_builder2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/insert.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/insert.js
 var init_insert = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/refresh-materialized-view.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/refresh-materialized-view.js
 var init_refresh_materialized_view = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/update.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/update.js
 var PgUpdateBase;
 var init_update = __esm(() => {
   init_entity();
@@ -12325,7 +12395,7 @@ var init_update = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/query-builders/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/query-builders/index.js
 var init_query_builders = __esm(() => {
   init_delete();
   init_insert();
@@ -12335,13 +12405,13 @@ var init_query_builders = __esm(() => {
   init_update();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/db.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/db.js
 var init_db = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/alias.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/alias.js
 var init_alias2 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/checks.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/checks.js
 function check(name, value) {
   return new CheckBuilder(name, value);
 }
@@ -12371,7 +12441,7 @@ var init_checks = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/indexes.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/indexes.js
 function index(name) {
   return new IndexBuilderOn(false, name);
 }
@@ -12460,42 +12530,42 @@ var init_indexes = __esm(() => {
   };
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/policies.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/policies.js
 var init_policies = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/roles.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/roles.js
 var init_roles = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/sequence.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/sequence.js
 var init_sequence = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/view-common.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/view-common.js
 var PgViewConfig;
 var init_view_common2 = __esm(() => {
   PgViewConfig = Symbol.for("drizzle:PgViewConfig");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/view.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/view.js
 var PgMaterializedViewConfig;
 var init_view = __esm(() => {
   PgMaterializedViewConfig = Symbol.for("drizzle:PgMaterializedViewConfig");
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/schema.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/schema.js
 var init_schema = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/session.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/session.js
 var init_session = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/utils.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/utils.js
 var init_utils3 = () => {};
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/utils/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/utils/index.js
 var init_utils4 = __esm(() => {
   init_array();
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/pg-core/index.js
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/pg-core/index.js
 var init_pg_core = __esm(() => {
   init_alias2();
   init_checks();
@@ -12531,6 +12601,7 @@ var init_users = __esm(() => {
     emailVerified: boolean("email_verified").notNull().default(false),
     image: text("image"),
     twoFactorEnabled: boolean("two_factor_enabled").default(false),
+    isSuperadmin: boolean("is_superadmin").notNull().default(false),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   });
@@ -12647,9 +12718,33 @@ var init_triggers = __esm(() => {
   }, (table2) => [index("triggers_automation_idx").on(table2.automationId)]);
 });
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/expressions.js
+var init_expressions2 = __esm(() => {
+  init_expressions();
+});
+// ../../node_modules/.bun/drizzle-orm@0.39.3+a324ea3b81409b9a/node_modules/drizzle-orm/index.js
+var init_drizzle_orm = __esm(() => {
+  init_alias();
+  init_column_builder();
+  init_column();
+  init_entity();
+  init_errors3();
+  init_expressions2();
+  init_logger();
+  init_query_promise();
+  init_relations();
+  init_sql2();
+  init_subquery();
+  init_table();
+  init_utils();
+  init_view_common();
+});
 // ../shared/src/db/schema/deployments.ts
 var deploymentStatusEnum, deployments;
 var init_deployments = __esm(() => {
+  init_drizzle_orm();
   init_pg_core();
   init_projects();
   deploymentStatusEnum = pgEnum("deployment_status", [
@@ -12672,10 +12767,11 @@ var init_deployments = __esm(() => {
     activatedAt: timestamp("activated_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("deployments_project_idx").on(table2.projectId),
-    index("deployments_project_status_idx").on(table2.projectId, table2.status),
-    index("deployments_environment_idx").on(table2.environmentId)
+  }, (table3) => [
+    index("deployments_project_idx").on(table3.projectId),
+    index("deployments_project_status_idx").on(table3.projectId, table3.status),
+    index("deployments_environment_idx").on(table3.environmentId),
+    index("deployments_project_created_idx").on(table3.projectId, desc(table3.createdAt))
   ]);
 });
@@ -12720,14 +12816,14 @@ var init_execution_records = __esm(() => {
     replayOverrides: jsonb("replay_overrides").$type(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     completedAt: timestamp("completed_at", { withTimezone: true })
-  }, (table2) => [
-    index("execution_records_automation_idx").on(table2.automationId),
-    index("execution_records_deployment_idx").on(table2.deploymentId),
-    index("execution_records_status_idx").on(table2.status),
-    index("execution_records_trace_idx").on(table2.traceId),
-    index("execution_records_created_idx").on(table2.createdAt),
-    index("execution_records_automation_created_idx").on(table2.automationId, table2.createdAt),
-    index("execution_records_replay_of_idx").on(table2.replayOf)
+  }, (table3) => [
+    index("execution_records_automation_idx").on(table3.automationId),
+    index("execution_records_deployment_idx").on(table3.deploymentId),
+    index("execution_records_status_idx").on(table3.status),
+    index("execution_records_trace_idx").on(table3.traceId),
+    index("execution_records_created_idx").on(table3.createdAt),
+    index("execution_records_automation_created_idx").on(table3.automationId, table3.createdAt),
+    index("execution_records_replay_of_idx").on(table3.replayOf)
   ]);
 });
@@ -12751,10 +12847,10 @@ var init_log_entries = __esm(() => {
     level: logLevelEnum("level").notNull(),
     message: text("message").notNull(),
     fields: jsonb("fields")
-  }, (table2) => [
-    index("log_entries_execution_idx").on(table2.executionId),
-    index("log_entries_project_idx").on(table2.projectId),
-    index("log_entries_timestamp_idx").on(table2.timestamp)
+  }, (table3) => [
+    index("log_entries_execution_idx").on(table3.executionId),
+    index("log_entries_project_idx").on(table3.projectId),
+    index("log_entries_timestamp_idx").on(table3.timestamp)
   ]);
 });
@@ -12772,11 +12868,11 @@ var init_metrics = __esm(() => {
     name: text("name").notNull(),
     value: doublePrecision("value").notNull(),
     tags: jsonb("tags")
-  }, (table2) => [
-    index("metrics_execution_idx").on(table2.executionId),
-    index("metrics_project_idx").on(table2.projectId),
-    index("metrics_name_idx").on(table2.name),
-    index("metrics_timestamp_idx").on(table2.timestamp)
+  }, (table3) => [
+    index("metrics_execution_idx").on(table3.executionId),
+    index("metrics_project_idx").on(table3.projectId),
+    index("metrics_name_idx").on(table3.name),
+    index("metrics_timestamp_idx").on(table3.timestamp)
   ]);
 });
@@ -12797,9 +12893,9 @@ var init_artifacts = __esm(() => {
     storageUrl: text("storage_url").notNull(),
     metadata: jsonb("metadata"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("artifacts_execution_idx").on(table2.executionId),
-    index("artifacts_project_idx").on(table2.projectId)
+  }, (table3) => [
+    index("artifacts_execution_idx").on(table3.executionId),
+    index("artifacts_project_idx").on(table3.projectId)
   ]);
 });
@@ -12822,10 +12918,10 @@ var init_secrets2 = __esm(() => {
     nonce: bytea("nonce").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    uniqueIndex("secrets_project_name_idx").on(table2.projectId, table2.name),
-    index("secrets_project_idx").on(table2.projectId),
-    index("secrets_environment_idx").on(table2.environmentId)
+  }, (table3) => [
+    uniqueIndex("secrets_project_name_idx").on(table3.projectId, table3.name),
+    index("secrets_project_idx").on(table3.projectId),
+    index("secrets_environment_idx").on(table3.environmentId)
   ]);
 });
@@ -12847,11 +12943,11 @@ var init_api_keys = __esm(() => {
     lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("api_keys_org_idx").on(table2.organizationId),
-    index("api_keys_user_idx").on(table2.userId),
-    index("api_keys_prefix_idx").on(table2.keyPrefix),
-    uniqueIndex("api_keys_hash_idx").on(table2.keyHash)
+  }, (table3) => [
+    index("api_keys_org_idx").on(table3.organizationId),
+    index("api_keys_user_idx").on(table3.userId),
+    index("api_keys_prefix_idx").on(table3.keyPrefix),
+    uniqueIndex("api_keys_hash_idx").on(table3.keyHash)
   ]);
 });
@@ -12876,10 +12972,10 @@ var init_endpoint_keys = __esm(() => {
     revokedAt: timestamp("revoked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("endpoint_keys_project_idx").on(table2.projectId),
-    index("endpoint_keys_prefix_idx").on(table2.keyPrefix),
-    uniqueIndex("endpoint_keys_hash_idx").on(table2.keyHash)
+  }, (table3) => [
+    index("endpoint_keys_project_idx").on(table3.projectId),
+    index("endpoint_keys_prefix_idx").on(table3.keyPrefix),
+    uniqueIndex("endpoint_keys_hash_idx").on(table3.keyHash)
   ]);
 });
@@ -12901,11 +12997,11 @@ var init_audit_log = __esm(() => {
     metadata: jsonb("metadata"),
     ipAddress: text("ip_address"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    index("audit_log_org_idx").on(table2.organizationId),
-    index("audit_log_user_idx").on(table2.userId),
-    index("audit_log_action_idx").on(table2.action),
-    index("audit_log_created_idx").on(table2.createdAt)
+  }, (table3) => [
+    index("audit_log_org_idx").on(table3.organizationId),
+    index("audit_log_user_idx").on(table3.userId),
+    index("audit_log_action_idx").on(table3.action),
+    index("audit_log_created_idx").on(table3.createdAt)
   ]);
 });
@@ -12942,40 +13038,17 @@ var init_metering_rollups = __esm(() => {
     }).notNull().default(0),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  }, (table2) => [
-    uniqueIndex("metering_rollups_natural_key").on(table2.automationId, table2.granularity, table2.bucketStart),
-    index("metering_rollups_org_idx").on(table2.organizationId),
-    index("metering_rollups_project_idx").on(table2.projectId),
-    index("metering_rollups_automation_idx").on(table2.automationId),
-    index("metering_rollups_granularity_idx").on(table2.granularity),
-    index("metering_rollups_bucket_idx").on(table2.bucketStart),
-    index("metering_rollups_project_bucket_idx").on(table2.projectId, table2.granularity, table2.bucketStart)
+  }, (table3) => [
+    uniqueIndex("metering_rollups_natural_key").on(table3.automationId, table3.granularity, table3.bucketStart),
+    index("metering_rollups_org_idx").on(table3.organizationId),
+    index("metering_rollups_project_idx").on(table3.projectId),
+    index("metering_rollups_automation_idx").on(table3.automationId),
+    index("metering_rollups_granularity_idx").on(table3.granularity),
+    index("metering_rollups_bucket_idx").on(table3.bucketStart),
+    index("metering_rollups_project_bucket_idx").on(table3.projectId, table3.granularity, table3.bucketStart)
   ]);
 });
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/expressions.js
-var init_expressions2 = __esm(() => {
-  init_expressions();
-});
-// ../../node_modules/.bun/drizzle-orm@0.39.3+7505325c0ab11955/node_modules/drizzle-orm/index.js
-var init_drizzle_orm = __esm(() => {
-  init_alias();
-  init_column_builder();
-  init_column();
-  init_entity();
-  init_errors3();
-  init_expressions2();
-  init_logger();
-  init_query_promise();
-  init_relations();
-  init_sql2();
-  init_subquery();
-  init_table();
-  init_utils();
-  init_view_common();
-});
 // ../shared/src/db/schema/credit-ledger.ts
 var creditLedgerEntryTypeEnum, creditLedger;
 var init_credit_ledger = __esm(() => {
@@ -13591,6 +13664,56 @@ var init_auth = __esm(() => {
   });
 });
+// ../shared/src/db/schema/admin-sessions.ts
+var bytea2, adminSessions;
+var init_admin_sessions = __esm(() => {
+  init_pg_core();
+  init_users();
+  bytea2 = customType({
+    dataType() {
+      return "bytea";
+    }
+  });
+  adminSessions = pgTable("admin_sessions", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    sessionTokenHash: bytea2("session_token_hash").notNull(),
+    userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    issuedAt: timestamp("issued_at", { withTimezone: true }).notNull().defaultNow(),
+    lastActivityAt: timestamp("last_activity_at", { withTimezone: true }).notNull().defaultNow(),
+    stepUpVerifiedAt: timestamp("step_up_verified_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [
+    uniqueIndex("admin_sessions_token_idx").on(table3.sessionTokenHash),
+    index("admin_sessions_user_idx").on(table3.userId)
+  ]);
+});
+// ../shared/src/db/schema/admin-audit-log.ts
+var adminAuditLog;
+var init_admin_audit_log = __esm(() => {
+  init_pg_core();
+  init_users();
+  adminAuditLog = pgTable("admin_audit_log", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    userId: uuid("user_id").references(() => users.id, {
+      onDelete: "set null"
+    }),
+    actorLabel: text("actor_label").notNull(),
+    route: text("route").notNull(),
+    method: text("method").notNull(),
+    queryParams: jsonb("query_params").$type(),
+    statusCode: integer("status_code").notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    actionPayload: jsonb("action_payload").$type(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [
+    index("admin_audit_log_user_idx").on(table3.userId),
+    index("admin_audit_log_created_idx").on(table3.createdAt),
+    index("admin_audit_log_route_idx").on(table3.route)
+  ]);
+});
 // ../shared/src/db/schema/index.ts
 var init_schema2 = __esm(() => {
   init_users();
@@ -13625,6 +13748,8 @@ var init_schema2 = __esm(() => {
   init_healing();
   init_playground();
   init_auth();
+  init_admin_sessions();
+  init_admin_audit_log();
 });
 // ../shared/src/db/index.ts
@@ -13639,6 +13764,22 @@ var init_url_validator = __esm(() => {
   BLOCKED_HOSTNAMES = new Set(["localhost", "metadata.google.internal"]);
 });
+// ../shared/src/crypto/session-token.ts
+var init_session_token = () => {};
+// ../shared/src/http/parse-body.ts
+function parseHttpBody(body, _headers) {
+  if (typeof body !== "string")
+    return body;
+  if (body === "")
+    return null;
+  try {
+    return JSON.parse(body);
+  } catch {
+    return body;
+  }
+}
 // ../shared/src/index.ts
 var init_src2 = __esm(() => {
   init_billing();
@@ -13650,6 +13791,7 @@ var init_src2 = __esm(() => {
   init_marketplace();
   init_db2();
   init_url_validator();
+  init_session_token();
 });
 // src/lib/manifest.ts
@@ -13748,9 +13890,7 @@ function registerConfigCommand(program2) {
       setManifestValue(opts.dir, path, parsed);
       output.success({ path, value: parsed });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("CONFIG_SET_FAILED", err.message);
-      }
+      reportApiError(output, err, "CONFIG_SET_FAILED");
     }
   });
   config.command("get <path>").description("Get a config value using dot-path notation").option("--dir <path>", "Project directory", ".").action((path, opts, cmd) => {
@@ -13763,15 +13903,14 @@ function registerConfigCommand(program2) {
       }
       output.success({ path, value });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("CONFIG_GET_FAILED", err.message);
-      }
+      reportApiError(output, err, "CONFIG_GET_FAILED");
     }
   });
 }
 var init_config = __esm(() => {
   init_src3();
   init_manifest2();
+  init_handle_api_error();
 });
 // src/commands/status.ts
@@ -13793,9 +13932,7 @@ function registerStatusCommand(program2) {
       const project = await client.get(`/api/v1/orgs/${opts.org}/projects/${opts.project}`);
       output.success(project);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("STATUS_FAILED", err.message);
-      }
+      reportApiError(output, err, "STATUS_FAILED");
     }
   });
 }
@@ -13803,6 +13940,7 @@ var init_status = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/audit.ts
@@ -13834,9 +13972,7 @@ function registerAuditCommand(program2) {
         e.userId
       ]));
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("AUDIT_FAILED", err.message);
-      }
+      reportApiError(output, err, "AUDIT_FAILED");
     }
   });
 }
@@ -13844,6 +13980,7 @@ var init_audit = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/lib/manifest-generator.ts
@@ -14094,11 +14231,7 @@ Live at:`);
         }
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("DEPLOY_FAILED", err.message);
-      }
+      reportApiError(output, err, "DEPLOY_FAILED");
     }
   });
 }
@@ -14108,6 +14241,7 @@ var init_deploy = __esm(() => {
   init_config_store();
   init_bundler();
   init_manifest2();
+  init_handle_api_error();
 });
 // src/commands/rollback.ts
@@ -14137,11 +14271,7 @@ function registerRollbackCommand(program2) {
         activatedAt: deployment.activatedAt
       });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("ROLLBACK_FAILED", err.message);
-      }
+      reportApiError(output, err, "ROLLBACK_FAILED");
     }
   });
 }
@@ -14149,6 +14279,7 @@ var init_rollback = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/openapi.ts
@@ -14170,9 +14301,7 @@ function registerOpenApiCommand(program2) {
       const spec = await client.get(`/api/v1/projects/${opts.project}/openapi/_dura/openapi.json`, { projectId: opts.project });
       output.success(spec);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("OPENAPI_FAILED", err.message);
-      }
+      reportApiError(output, err, "OPENAPI_FAILED");
     }
   });
 }
@@ -14180,6 +14309,7 @@ var init_openapi = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/logs.ts
@@ -14443,11 +14573,7 @@ Error: ${name}
         ]));
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("LOGS_FAILED", err.message);
-      }
+      reportApiError(output, err, "LOGS_FAILED");
     }
   });
 }
@@ -14456,6 +14582,7 @@ var init_logs = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/run.ts
@@ -14489,11 +14616,7 @@ function registerRunCommand(program2) {
       });
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("RUN_FAILED", err.message);
-      }
+      reportApiError(output, err, "RUN_FAILED");
     }
   });
 }
@@ -14501,6 +14624,7 @@ var init_run = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/schedule.ts
@@ -14536,11 +14660,7 @@ function registerScheduleCommand(program2) {
       });
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("SCHEDULE_FAILED", err.message);
-      }
+      reportApiError(output, err, "SCHEDULE_FAILED");
     }
   });
   schedule.command("list").description("List cron schedules for a project").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -14559,11 +14679,7 @@ function registerScheduleCommand(program2) {
       const result = await auth.client.get(`/api/v1/projects/${projectId}/schedules`);
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("SCHEDULE_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "SCHEDULE_LIST_FAILED");
     }
   });
   schedule.command("remove <schedule-id>").description("Remove a cron schedule").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").option("--confirm", "Confirm the destructive delete operation").action(async (scheduleId, opts, cmd) => {
@@ -14586,11 +14702,7 @@ function registerScheduleCommand(program2) {
       const result = await auth.client.delete(`/api/v1/projects/${projectId}/schedules/${scheduleId}`);
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("SCHEDULE_REMOVE_FAILED", err.message);
-      }
+      reportApiError(output, err, "SCHEDULE_REMOVE_FAILED");
     }
   });
 }
@@ -14599,6 +14711,115 @@ var init_schedule = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
+});
+// src/lib/dev-trust.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname, join as join7 } from "node:path";
+function hasStoredCredentials() {
+  try {
+    const cfg = readConfig();
+    const apiKey = typeof cfg.apiKey === "string" ? cfg.apiKey : "";
+    const authToken = typeof cfg.authToken === "string" ? cfg.authToken : "";
+    return apiKey.length > 0 || authToken.length > 0;
+  } catch {
+    return false;
+  }
+}
+function hasProjectTrustMarker(projectDir) {
+  return existsSync6(join7(projectDir, TRUST_MARKER_RELATIVE_PATH));
+}
+function grantProjectTrust(projectDir) {
+  const markerPath = join7(projectDir, TRUST_MARKER_RELATIVE_PATH);
+  const dir = dirname(markerPath);
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  const note = [
+    "# dura dev trust marker",
+    "#",
+    "# This file records that you accepted the risk of running `dura dev`",
+    "# in-process with access to your local credentials (see GH #118).",
+    "# Delete this file to revoke trust for this project.",
+    `# Granted: ${new Date().toISOString()}`,
+    ""
+  ].join(`
+`);
+  writeFileSync6(markerPath, note, { mode: 384 });
+}
+function isEnvTruthy(val) {
+  if (!val)
+    return false;
+  const v = val.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+function evaluateDevTrust(input) {
+  if (!hasStoredCredentials()) {
+    return { allow: true, warn: false, reason: "NO_CREDENTIALS" };
+  }
+  if (input.trustFlag) {
+    grantProjectTrust(input.projectDir);
+    return { allow: true, warn: true, reason: "TRUST_GRANTED_FLAG" };
+  }
+  if (isEnvTruthy(input.trustEnv)) {
+    grantProjectTrust(input.projectDir);
+    return { allow: true, warn: true, reason: "TRUST_GRANTED_ENV" };
+  }
+  if (hasProjectTrustMarker(input.projectDir)) {
+    return { allow: true, warn: true, reason: "MARKER_PRESENT" };
+  }
+  return { allow: false, warn: true, reason: "TRUST_REQUIRED" };
+}
+function renderTrustWarning(opts) {
+  const color = opts?.color ?? process.stderr.isTTY ?? false;
+  const red = color ? RED : "";
+  const yellow = color ? YELLOW : "";
+  const bold = color ? BOLD : "";
+  const reset2 = color ? RESET : "";
+  const lines = [
+    `${red}${bold}╔══════════════════════════════════════════════════════════════════════╗${reset2}`,
+    `${red}${bold}║  SECURITY WARNING — dura dev runs automation code with your local   ║${reset2}`,
+    `${red}${bold}║  filesystem privileges. A malicious npm dependency in your handler  ║${reset2}`,
+    `${red}${bold}║  graph can read ~/.dura/config (your API key), ~/.ssh, ~/.aws, etc. ║${reset2}`,
+    `${red}${bold}║  See https://github.com/dura-run/dura-run/issues/118 for details.   ║${reset2}`,
+    `${red}${bold}╚══════════════════════════════════════════════════════════════════════╝${reset2}`,
+    `${yellow}  Tip: audit your dependencies before trusting this project.${reset2}`,
+    ""
+  ];
+  return lines.join(`
+`);
+}
+function renderTrustRefusal() {
+  const color = process.stderr.isTTY ?? false;
+  const yellow = color ? YELLOW : "";
+  const bold = color ? BOLD : "";
+  const reset2 = color ? RESET : "";
+  return [
+    `${bold}${yellow}dura dev refuses to start.${reset2}`,
+    "",
+    "Your local machine has stored dura credentials, and `dura dev` currently",
+    "loads your handler code with full filesystem access. Until we ship an",
+    "isolated-vm sandbox for local dev, you must explicitly accept this risk.",
+    "",
+    "To proceed, pick ONE of:",
+    "",
+    "  1. Run with --trust (one-time; remembered via .dura/dev-trust):",
+    "       dura dev --trust",
+    "",
+    "  2. Set the env var (same effect):",
+    "       DURA_DEV_TRUST=1 dura dev",
+    "",
+    "  3. Log out first (removes the credentials being protected):",
+    "       dura logout",
+    ""
+  ].join(`
+`);
+}
+var TRUST_MARKER_RELATIVE_PATH, RED = "\x1B[31m", YELLOW = "\x1B[33m", BOLD = "\x1B[1m", RESET = "\x1B[0m";
+var init_dev_trust = __esm(() => {
+  init_config_store();
+  TRUST_MARKER_RELATIVE_PATH = join7(".dura", "dev-trust");
 });
 // src/dev/server.ts
@@ -14680,7 +14901,7 @@ function createDevServer(options) {
       headers,
       query,
       params: match.params,
-      body
+      body: parseHttpBody(body, headers)
     });
     return options.onRequest(match.route, duraReq);
   }
@@ -14711,12 +14932,7 @@ function createDevServer(options) {
           resolve3(null);
           return;
         }
-        const raw = Buffer.concat(chunks).toString("utf-8");
-        try {
-          resolve3(JSON.parse(raw));
-        } catch {
-          resolve3(raw);
-        }
+        resolve3(Buffer.concat(chunks).toString("utf-8"));
       });
     });
   }
@@ -14788,6 +15004,7 @@ function createDevServer(options) {
 }
 var CORS_HEADERS;
 var init_server = __esm(() => {
+  init_src2();
   CORS_HEADERS = {
     "access-control-allow-origin": "*",
     "access-control-allow-methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
@@ -15131,8 +15348,8 @@ __export(exports_file_watcher, {
   resolveAffectedAutomation: () => resolveAffectedAutomation,
   createFileWatcher: () => createFileWatcher
 });
-import { watch, existsSync as existsSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { watch, existsSync as existsSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 function resolveAffectedAutomation(manifest, changedPath) {
   const normalized = changedPath.replace(/\\/g, "/");
   const directMatch = manifest.automations.filter((a) => a.entrypoint.replace(/\\/g, "/") === normalized);
@@ -15151,7 +15368,7 @@ function createFileWatcher(options) {
       return;
     if (!/\.(ts|tsx|js|jsx|mjs|mts)$/.test(filename))
       return;
-    const relativePath = join7(dir, filename).replace(/\\/g, "/");
+    const relativePath = join8(dir, filename).replace(/\\/g, "/");
     const existing = debounceTimers.get(relativePath);
     if (existing) {
       clearTimeout(existing);
@@ -15167,8 +15384,8 @@ function createFileWatcher(options) {
         return;
       watching = true;
       for (const dir of watchDirs) {
-        const fullDir = join7(projectDir, dir);
-        if (!existsSync6(fullDir))
+        const fullDir = join8(projectDir, dir);
+        if (!existsSync7(fullDir))
           continue;
         try {
           const fsWatcher = watch(fullDir, { recursive: true }, (_eventType, filename) => {
@@ -15249,9 +15466,22 @@ function extractCronTriggers(manifest) {
   return entries;
 }
 function registerDevCommand(program2) {
-  program2.command("dev").description("Start the local development server with hot-reload").option("--dir <path>", "Project directory", ".").option("--port <port>", "Dev server port", "3000").action(async (opts, cmd) => {
+  program2.command("dev").description("Start the local development server with hot-reload").option("--dir <path>", "Project directory", ".").option("--port <port>", "Dev server port", "3000").option("--trust", "Acknowledge that `dura dev` runs user code with your local filesystem privileges (see GH #118). Required when credentials are stored locally; remembered in .dura/dev-trust.").action(async (opts, cmd) => {
     const output = getOutput(cmd);
     const projectDir = opts.dir ?? ".";
+    const trustDecision = evaluateDevTrust({
+      projectDir,
+      trustFlag: opts.trust === true,
+      trustEnv: process.env["DURA_DEV_TRUST"]
+    });
+    if (trustDecision.warn) {
+      process.stderr.write(renderTrustWarning());
+    }
+    if (!trustDecision.allow) {
+      process.stderr.write(renderTrustRefusal());
+      output.error("DEV_TRUST_REQUIRED", "dura dev refused to start — credentials are stored locally and trust was not granted.", "Re-run with --trust or set DURA_DEV_TRUST=1 after reviewing the warning above.");
+      return;
+    }
     const port = parseInt(opts.port ?? "3000", 10);
     if (isNaN(port) || port < 1 || port > 65535) {
       output.error("INVALID_PORT", `Invalid port: "${opts.port}". Must be a number between 1 and 65535.`);
@@ -15267,11 +15497,11 @@ function registerDevCommand(program2) {
       }
       throw err;
     }
-    const { existsSync: existsSync7, readFileSync: readFileSync6 } = await import("node:fs");
-    const { join: join8 } = await import("node:path");
-    const envPath = join8(projectDir, ".env.local");
+    const { existsSync: existsSync8, readFileSync: readFileSync6 } = await import("node:fs");
+    const { join: join9 } = await import("node:path");
+    const envPath = join9(projectDir, ".env.local");
     let secrets2 = {};
-    if (existsSync7(envPath)) {
+    if (existsSync8(envPath)) {
       const content = readFileSync6(envPath, "utf-8");
       secrets2 = parseEnvFile(content);
       output.info(`Loaded ${Object.keys(secrets2).length} secret(s) from .env.local`);
@@ -15375,6 +15605,7 @@ Shutting down...`);
 var init_dev = __esm(() => {
   init_src3();
   init_manifest2();
+  init_dev_trust();
 });
 // src/snapshot/comparator.ts
 function getAtPath(obj, path) {
@@ -15622,14 +15853,14 @@ var init_comparator = __esm(() => {
 // src/snapshot/file-manager.ts
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync5,
   readFileSync as readFileSync6,
-  writeFileSync as writeFileSync6,
+  writeFileSync as writeFileSync7,
   readdirSync as readdirSync2,
   unlinkSync
 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function automationNameToFileName(automationName) {
   return automationName.replace(/\//g, "-") + ".snap.json";
 }
@@ -15640,19 +15871,19 @@ function fileNameToAutomationName(fileName) {
 class SnapshotFileManager {
   snapshotsDir;
   constructor(projectDir) {
-    this.snapshotsDir = join8(projectDir, SNAPSHOTS_DIR);
+    this.snapshotsDir = join9(projectDir, SNAPSHOTS_DIR);
   }
   filePath(automationName) {
-    return join8(this.snapshotsDir, automationNameToFileName(automationName));
+    return join9(this.snapshotsDir, automationNameToFileName(automationName));
   }
   ensureDir() {
-    if (!existsSync7(this.snapshotsDir)) {
-      mkdirSync4(this.snapshotsDir, { recursive: true });
+    if (!existsSync8(this.snapshotsDir)) {
+      mkdirSync5(this.snapshotsDir, { recursive: true });
     }
   }
   read(automationName) {
     const path = this.filePath(automationName);
-    if (!existsSync7(path))
+    if (!existsSync8(path))
       return null;
     try {
       const raw = readFileSync6(path, "utf-8");
@@ -15664,7 +15895,7 @@ class SnapshotFileManager {
   write(automationName, snapshotFile) {
     this.ensureDir();
     const path = this.filePath(automationName);
-    writeFileSync6(path, JSON.stringify(snapshotFile, null, 2) + `
+    writeFileSync7(path, JSON.stringify(snapshotFile, null, 2) + `
 `, "utf-8");
   }
   updateSnapshot(automationName, snapshot) {
@@ -15685,12 +15916,12 @@ class SnapshotFileManager {
     });
   }
   listAutomationNames() {
-    if (!existsSync7(this.snapshotsDir))
+    if (!existsSync8(this.snapshotsDir))
       return [];
     const files = readdirSync2(this.snapshotsDir).filter((f) => f.endsWith(".snap.json"));
     const names = [];
     for (const file of files) {
-      const path = join8(this.snapshotsDir, file);
+      const path = join9(this.snapshotsDir, file);
       try {
         const raw = readFileSync6(path, "utf-8");
         const parsed = JSON.parse(raw);
@@ -15703,7 +15934,7 @@ class SnapshotFileManager {
   }
   delete(automationName) {
     const path = this.filePath(automationName);
-    if (existsSync7(path)) {
+    if (existsSync8(path)) {
       unlinkSync(path);
     }
   }
@@ -15712,15 +15943,15 @@ var SNAPSHOTS_DIR = "__snapshots__";
 var init_file_manager = () => {};
 // src/snapshot/config-reader.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { join as join10 } from "node:path";
 function readSnapshotConfig(projectDir) {
-  const durajsonPath = join9(projectDir, "dura.json");
-  const testjsonPath = join9(projectDir, "dura.test.json");
+  const durajsonPath = join10(projectDir, "dura.json");
+  const testjsonPath = join10(projectDir, "dura.test.json");
   let fromDuraJson = {};
   let fromTestJson = {};
   let mocks;
-  if (existsSync8(durajsonPath)) {
+  if (existsSync9(durajsonPath)) {
     try {
       const raw = JSON.parse(readFileSync7(durajsonPath, "utf-8"));
       if (raw["snapshots"] && typeof raw["snapshots"] === "object" && !Array.isArray(raw["snapshots"])) {
@@ -15728,7 +15959,7 @@ function readSnapshotConfig(projectDir) {
       }
     } catch {}
   }
-  if (existsSync8(testjsonPath)) {
+  if (existsSync9(testjsonPath)) {
     try {
       const raw = JSON.parse(readFileSync7(testjsonPath, "utf-8"));
       if (raw["snapshots"] && typeof raw["snapshots"] === "object" && !Array.isArray(raw["snapshots"])) {
@@ -16328,9 +16559,7 @@ Add this TXT record to your DNS:
 Then run: dura domains verify ${result.id} --project ${projectId}`);
       }
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("DOMAIN_ADD_FAILED", err.message);
-      }
+      reportApiError(output, err, "DOMAIN_ADD_FAILED");
     }
   });
   domains.command("list").description("List custom domains").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -16348,9 +16577,7 @@ Then run: dura domains verify ${result.id} --project ${projectId}`);
         d.createdAt
       ]));
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("DOMAIN_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "DOMAIN_LIST_FAILED");
     }
   });
   domains.command("remove <domainId>").description("Remove a custom domain").option("--project <id>", "Project ID (defaults to dura.json)").option("--confirm", "Confirm this destructive operation").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (domainId, opts, cmd) => {
@@ -16367,9 +16594,7 @@ Then run: dura domains verify ${result.id} --project ${projectId}`);
       await client.delete(`/api/v1/projects/${projectId}/domains/${domainId}`);
       output.success({ deleted: true, domainId });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("DOMAIN_REMOVE_FAILED", err.message);
-      }
+      reportApiError(output, err, "DOMAIN_REMOVE_FAILED");
     }
   });
   domains.command("verify <domainId>").description("Verify a domain's DNS TXT record").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (domainId, opts, cmd) => {
@@ -16382,9 +16607,7 @@ Then run: dura domains verify ${result.id} --project ${projectId}`);
       const result = await client.post(`/api/v1/projects/${projectId}/domains/${domainId}/verify`, {});
       output.success(result);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("DOMAIN_VERIFY_FAILED", err.message);
-      }
+      reportApiError(output, err, "DOMAIN_VERIFY_FAILED");
     }
   });
 }
@@ -16393,6 +16616,7 @@ var init_domains = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/endpoint-keys.ts
@@ -16432,9 +16656,7 @@ function registerEndpointKeysCommand(program2) {
         output.warn("Save the key now — it will not be shown again.");
       }
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("ENDPOINT_KEY_CREATE_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENDPOINT_KEY_CREATE_FAILED");
     }
   });
   keys.command("list").description("List endpoint keys for a project").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -16454,9 +16676,7 @@ function registerEndpointKeysCommand(program2) {
         k.createdAt
       ]));
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("ENDPOINT_KEY_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENDPOINT_KEY_LIST_FAILED");
     }
   });
   keys.command("revoke <keyId>").description("Revoke an endpoint key").option("--project <id>", "Project ID (defaults to dura.json)").option("--confirm", "Confirm this destructive operation").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (keyId, opts, cmd) => {
@@ -16473,9 +16693,7 @@ function registerEndpointKeysCommand(program2) {
       await client.post(`/api/v1/projects/${projectId}/endpoint-keys/${keyId}/revoke`, {});
       output.success({ revoked: true, keyId });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("ENDPOINT_KEY_REVOKE_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENDPOINT_KEY_REVOKE_FAILED");
     }
   });
 }
@@ -16484,6 +16702,81 @@ var init_endpoint_keys2 = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
+});
+// src/commands/events.ts
+var exports_events = {};
+__export(exports_events, {
+  resolvePayload: () => resolvePayload,
+  registerEventsCommand: () => registerEventsCommand
+});
+import { readFileSync as readFileSync8 } from "node:fs";
+function resolvePayload(opts) {
+  if (opts.payload !== undefined && opts.payloadFile !== undefined) {
+    throw new Error("Use either --payload or --payload-file, not both");
+  }
+  if (opts.payload === undefined && opts.payloadFile === undefined) {
+    throw new Error("--payload or --payload-file is required");
+  }
+  const raw = opts.payload !== undefined ? opts.payload : readFileSync8(opts.payloadFile, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid JSON in payload: ${err.message}`);
+  }
+}
+function registerEventsCommand(program2) {
+  const events = program2.command("events").description("Emit and inspect project events");
+  events.command("emit <source>").description("Emit an event to all matching event triggers").option("--payload <json>", "Inline JSON payload").option("--payload-file <path>", "Path to a JSON file containing the payload").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (source, opts, cmd) => {
+    const output = getOutput(cmd);
+    let payload;
+    try {
+      payload = resolvePayload(opts);
+    } catch (err) {
+      output.error("INVALID_PAYLOAD", err.message);
+      return;
+    }
+    const projectId = resolveProjectId({ project: opts.project });
+    if (!projectId) {
+      output.error("PROJECT_REQUIRED", "No project ID. Use --project or run this command inside a dura.json project.");
+      return;
+    }
+    const token = opts.token || getAuthToken();
+    if (!token) {
+      output.error("AUTH_REQUIRED", "Not logged in", "Run: dura login");
+      return;
+    }
+    const apiUrl = opts.apiUrl || getApiUrl();
+    const client = new ApiClient(apiUrl, token);
+    try {
+      const result = await client.post(`/api/v1/projects/${projectId}/events`, { source, payload });
+      if (output.isJson()) {
+        output.success(result);
+        return;
+      }
+      if (result.jobs.length === 0) {
+        process.stdout.write(`Event "${source}" emitted — no subscribers matched.
+`);
+        return;
+      }
+      process.stdout.write(`Event "${source}" emitted — enqueued ${result.jobs.length} execution(s):
+`);
+      for (const job of result.jobs) {
+        process.stdout.write(`  • ${job.automationName} → execution ${job.trigger.executionId}
+`);
+      }
+    } catch (err) {
+      const e = err;
+      output.error(e.code ?? "EMIT_FAILED", e.message);
+    }
+  });
+}
+var init_events = __esm(() => {
+  init_src3();
+  init_api_client();
+  init_config_store();
+  init_project_id();
 });
 // src/commands/usage.ts
@@ -16570,11 +16863,7 @@ function registerUsageCommand(program2) {
         browserTime: formatMs(summary.totals.totalBrowserSessionMs)
       });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("USAGE_QUERY_FAILED", err.message);
-      }
+      reportApiError(output, err, "USAGE_QUERY_FAILED");
     }
   });
 }
@@ -16582,6 +16871,7 @@ var init_usage = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/marketplace.ts
@@ -16619,11 +16909,7 @@ function registerMarketplaceCommand(program2) {
         status: adapter.status
       });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("PUBLISH_FAILED", err.message);
-      }
+      reportApiError(output, err, "PUBLISH_FAILED");
     }
   });
   marketplace.command("install").description("Install an adapter into a project").requiredOption("--project <id>", "Project ID").requiredOption("--adapter <id>", "Adapter ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -16644,11 +16930,7 @@ function registerMarketplaceCommand(program2) {
         version: install.adapterVersion
       });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("INSTALL_FAILED", err.message);
-      }
+      reportApiError(output, err, "INSTALL_FAILED");
     }
   });
   marketplace.command("list").description("List available adapters").option("--category <cat>", "Filter by category").option("--query <q>", "Search query").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -16684,11 +16966,7 @@ function registerMarketplaceCommand(program2) {
         a.status
       ]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "LIST_FAILED");
     }
   });
   marketplace.command("uninstall").description("Uninstall an adapter from a project").requiredOption("--project <id>", "Project ID").requiredOption("--adapter <id>", "Adapter ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").option("--confirm", "Confirm the destructive uninstall operation").action(async (opts, cmd) => {
@@ -16708,11 +16986,7 @@ function registerMarketplaceCommand(program2) {
       await client.post(`/api/v1/projects/${opts.project}/adapters/uninstall`, { adapterId: opts.adapter });
       output.success({ uninstalled: true, adapterId: opts.adapter });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("UNINSTALL_FAILED", err.message);
-      }
+      reportApiError(output, err, "UNINSTALL_FAILED");
     }
   });
 }
@@ -16720,6 +16994,7 @@ var init_marketplace2 = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/export.ts
@@ -16730,19 +17005,19 @@ __export(exports_export, {
   collectExportFiles: () => collectExportFiles
 });
 import {
-  existsSync as existsSync9,
-  readFileSync as readFileSync8,
+  existsSync as existsSync10,
+  readFileSync as readFileSync9,
   readdirSync as readdirSync3,
   statSync,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
-import { join as join10, relative, resolve as resolve4 } from "node:path";
+import { join as join11, relative, resolve as resolve4 } from "node:path";
 function collectExportFiles(baseDir, currentDir) {
   const dir = currentDir ?? baseDir;
   const entries = [];
   const items = readdirSync3(dir);
   for (const item of items) {
-    const fullPath = join10(dir, item);
+    const fullPath = join11(dir, item);
     const relPath = relative(baseDir, fullPath);
     const stat = statSync(fullPath);
     if (stat.isDirectory()) {
@@ -16751,7 +17026,7 @@ function collectExportFiles(baseDir, currentDir) {
       }
     } else if (stat.isFile()) {
       if (!EXCLUDED_FILES.has(item)) {
-        const content = readFileSync8(fullPath, "utf-8");
+        const content = readFileSync9(fullPath, "utf-8");
         entries.push({ relativePath: relPath, content });
       }
     }
@@ -16775,14 +17050,14 @@ function registerExportCommand(program2) {
   program2.command("export").description("Export project source + config into a portable archive").option("--dir <path>", "Project directory", ".").option("--output <path>", "Output file path").action(async (opts, cmd) => {
     const output = getOutput(cmd);
     const projectDir = resolve4(opts.dir ?? ".");
-    const manifestPath = join10(projectDir, "dura.json");
-    if (!existsSync9(manifestPath)) {
+    const manifestPath = join11(projectDir, "dura.json");
+    if (!existsSync10(manifestPath)) {
       output.error("EXPORT_NO_MANIFEST", "No dura.json found in project directory", "Run this command from a dura project directory or use --dir");
       return;
     }
     let projectName;
     try {
-      const manifestContent = readFileSync8(manifestPath, "utf-8");
+      const manifestContent = readFileSync9(manifestPath, "utf-8");
       const manifest = JSON.parse(manifestContent);
       projectName = manifest.name ?? "unnamed-project";
     } catch {
@@ -16796,9 +17071,9 @@ function registerExportCommand(program2) {
       return;
     }
     const archive = createArchive(projectName, files);
-    const outputPath = opts.output ?? join10(projectDir, `${projectName}-export.json`);
+    const outputPath = opts.output ?? join11(projectDir, `${projectName}-export.json`);
     try {
-      writeFileSync7(outputPath, archive, "utf-8");
+      writeFileSync8(outputPath, archive, "utf-8");
     } catch (err) {
       output.error("EXPORT_FAILED", `Failed to write archive: ${err instanceof Error ? err.message : String(err)}`);
       return;
@@ -16870,11 +17145,7 @@ function registerReplayCommand(program2) {
       const result = await client.post(`/api/v1/projects/${projectId}/executions/${executionId}/replay`, { overrides });
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("REPLAY_FAILED", err.message);
-      }
+      reportApiError(output, err, "REPLAY_FAILED");
     }
   });
 }
@@ -16911,11 +17182,7 @@ function registerReplaysCommand(program2) {
         r.replayOf ?? "-"
       ]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("REPLAYS_FAILED", err.message);
-      }
+      reportApiError(output, err, "REPLAYS_FAILED");
     }
   });
 }
@@ -16924,6 +17191,7 @@ var init_replay = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/kv.ts
@@ -16970,11 +17238,7 @@ function registerKvCommand(program2) {
       }
       output.table(["Key"], keys.map((k) => [k]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("KV_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "KV_LIST_FAILED");
     }
   });
   kv.command("get <key>").description("Get the value for a key").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (key, opts, cmd) => {
@@ -16987,11 +17251,7 @@ function registerKvCommand(program2) {
       const result = await client.get(`/api/v1/projects/${projectId}/kv/${encodeURIComponent(key)}`);
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("KV_GET_FAILED", err.message);
-      }
+      reportApiError(output, err, "KV_GET_FAILED");
     }
   });
   kv.command("set <key> <value>").description("Set a value for a key").option("--project <id>", "Project ID (defaults to dura.json)").option("--ttl <seconds>", "Time-to-live in seconds (0 = no expiry)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (key, valueStr, opts, cmd) => {
@@ -17014,11 +17274,7 @@ function registerKvCommand(program2) {
       const result = await client.put(`/api/v1/projects/${projectId}/kv/${encodeURIComponent(key)}`, body);
       output.success(result);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("KV_SET_FAILED", err.message);
-      }
+      reportApiError(output, err, "KV_SET_FAILED");
     }
   });
   kv.command("delete <key>").description("Delete a key from the KV namespace").option("--project <id>", "Project ID (defaults to dura.json)").option("--confirm", "Required to actually perform the delete").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (key, opts, cmd) => {
@@ -17035,11 +17291,7 @@ function registerKvCommand(program2) {
       await client.delete(`/api/v1/projects/${projectId}/kv/${encodeURIComponent(key)}`);
       output.success({ deleted: true, key });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("KV_DELETE_FAILED", err.message);
-      }
+      reportApiError(output, err, "KV_DELETE_FAILED");
     }
   });
   kv.command("flush").description("Remove all keys in the project KV namespace").option("--project <id>", "Project ID (defaults to dura.json)").option("--confirm", "Required to actually perform the flush").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -17056,11 +17308,7 @@ function registerKvCommand(program2) {
       await client.delete(`/api/v1/projects/${projectId}/kv`);
       output.success({ flushed: true });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("KV_FLUSH_FAILED", err.message);
-      }
+      reportApiError(output, err, "KV_FLUSH_FAILED");
     }
   });
   kv.command("stats").description("Show KV usage statistics for the project").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -17073,11 +17321,7 @@ function registerKvCommand(program2) {
       const stats = await client.get(`/api/v1/projects/${projectId}/kv/stats`);
       output.success(stats);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("KV_STATS_FAILED", err.message);
-      }
+      reportApiError(output, err, "KV_STATS_FAILED");
     }
   });
 }
@@ -17086,6 +17330,7 @@ var init_kv2 = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/webhook.ts
@@ -17152,9 +17397,7 @@ Webhook relay "${result.name}" created.
 ` + `ID: ${result.id}`);
       }
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_CREATE_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_CREATE_FAILED");
     }
   });
   webhook.command("list").description("List webhook relays").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -17177,9 +17420,7 @@ Webhook relay "${result.name}" created.
         ]));
       }
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_LIST_FAILED");
     }
   });
   webhook.command("show <nameOrId>").description("Show webhook relay details").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17192,9 +17433,7 @@ Webhook relay "${result.name}" created.
       const result = await client.get(`${webhookBase(opts.project)}/${nameOrId}`);
       output.success(result);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_SHOW_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_SHOW_FAILED");
     }
   });
   webhook.command("update <nameOrId>").description("Update a webhook relay").requiredOption("--project <id>", "Project ID").option("--name <name>", "New relay name").option("--events <events>", "New comma-separated event types").option("--forward <url>", "New destination URL").option("--transform <json>", "New transform template JSON").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17228,9 +17467,7 @@ Webhook relay "${result.name}" created.
       const result = await client.patch(`${webhookBase(opts.project)}/${nameOrId}`, patch);
       output.success(result);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_UPDATE_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_UPDATE_FAILED");
     }
   });
   webhook.command("delete <nameOrId>").description("Delete a webhook relay").requiredOption("--project <id>", "Project ID").option("--confirm", "Confirm this destructive operation").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17247,9 +17484,7 @@ Webhook relay "${result.name}" created.
       await client.delete(`${webhookBase(opts.project)}/${nameOrId}`);
       output.success({ deleted: true, nameOrId });
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_DELETE_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_DELETE_FAILED");
     }
   });
   webhook.command("enable <nameOrId>").description("Enable a webhook relay").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17262,9 +17497,7 @@ Webhook relay "${result.name}" created.
       const result = await client.patch(`${webhookBase(opts.project)}/${nameOrId}`, { enabled: true });
       output.success(result);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_ENABLE_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_ENABLE_FAILED");
     }
   });
   webhook.command("disable <nameOrId>").description("Disable a webhook relay").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17277,9 +17510,7 @@ Webhook relay "${result.name}" created.
       const result = await client.patch(`${webhookBase(opts.project)}/${nameOrId}`, { enabled: false });
       output.success(result);
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_DISABLE_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_DISABLE_FAILED");
     }
   });
   webhook.command("test <nameOrId>").description("Test a webhook relay with a sample payload").requiredOption("--project <id>", "Project ID").option("--payload <json>", "JSON payload to send", "{}").option("--event <type>", "Event type (sets X-GitHub-Event header for github sources)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17316,9 +17547,7 @@ Webhook relay "${result.name}" created.
         }
       }
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_TEST_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_TEST_FAILED");
     }
   });
   webhook.command("deliveries <nameOrId>").description("Show recent deliveries for a webhook relay").requiredOption("--project <id>", "Project ID").option("--last <n>", "Number of recent deliveries to show", "10").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (nameOrId, opts, cmd) => {
@@ -17351,9 +17580,7 @@ Webhook relay "${result.name}" created.
         ]));
       }
     } catch (err) {
-      if (err instanceof Error) {
-        output.error("WEBHOOK_DELIVERIES_FAILED", err.message);
-      }
+      reportApiError(output, err, "WEBHOOK_DELIVERIES_FAILED");
     }
   });
 }
@@ -17361,6 +17588,7 @@ var init_webhook = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/template.ts
@@ -17402,11 +17630,7 @@ function registerTemplateCommand(program2) {
         String(t.starCount)
       ]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "LIST_FAILED");
     }
   });
   const template = program2.command("template").description("Manage project templates");
@@ -17435,11 +17659,7 @@ function registerTemplateCommand(program2) {
       }
       output.success({ slug: t.slug, bundleRef: t.bundleRef });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("SHOW_FAILED", err.message);
-      }
+      reportApiError(output, err, "SHOW_FAILED");
     }
   });
   template.command("publish").description("Publish a project as a template").requiredOption("--name <name>", "Template name").requiredOption("--slug <slug>", "Unique slug").requiredOption("--description <desc>", "Short description").requiredOption("--version <ver>", "Semver version (e.g. 1.0.0)").requiredOption("--bundle-ref <ref>", "Bundle storage reference (bucket/key)").option("--category <cat>", "Category", "general").option("--tags <tags>", "Comma-separated tags").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -17471,11 +17691,7 @@ function registerTemplateCommand(program2) {
         status: t.status
       });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("PUBLISH_FAILED", err.message);
-      }
+      reportApiError(output, err, "PUBLISH_FAILED");
     }
   });
   program2.command("fork <slug>").description("Fork a template into a new project").requiredOption("--name <name>", "New project name").option("--org <id>", "Organization ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (slug, opts, cmd) => {
@@ -17511,11 +17727,7 @@ Set required secrets: ${result.requiredSecrets.join(", ")}`);
         output.info("Run: dura secrets set <name> <value>");
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("FORK_FAILED", err.message);
-      }
+      reportApiError(output, err, "FORK_FAILED");
     }
   });
 }
@@ -17523,6 +17735,7 @@ var init_template = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/deployments.ts
@@ -17564,11 +17777,7 @@ function registerDeploymentsCommand(program2) {
       }
       output.table(["ID", "Status", "Created At"], deploymentList.map((d) => [d.id, d.status, d.createdAt]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("DEPLOYMENTS_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "DEPLOYMENTS_LIST_FAILED");
     }
   });
   deployments2.command("get").description("Show details for a specific deployment").option("--project <id>", "Project ID (defaults to dura.json)").requiredOption("--id <deploymentId>", "Deployment ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -17581,11 +17790,7 @@ function registerDeploymentsCommand(program2) {
       const deployment = await client.get(`/api/v1/projects/${projectId}/deployments/${opts.id}`);
       output.success(deployment);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("DEPLOYMENTS_GET_FAILED", err.message);
-      }
+      reportApiError(output, err, "DEPLOYMENTS_GET_FAILED");
     }
   });
 }
@@ -17594,6 +17799,7 @@ var init_deployments2 = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/diagnose.ts
@@ -17703,11 +17909,7 @@ Analyzing execution ${targetExecutionId}...`);
         output.info(formatDiagnosisHuman(diagnosis));
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("DIAGNOSE_FAILED", err.message);
-      }
+      reportApiError(output, err, "DIAGNOSE_FAILED");
     }
   });
 }
@@ -17716,6 +17918,7 @@ var init_diagnose = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/create.ts
@@ -17725,27 +17928,27 @@ __export(exports_create, {
   registerAddCommand: () => registerAddCommand
 });
 import {
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync5,
-  writeFileSync as writeFileSync8,
-  readFileSync as readFileSync9,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync6,
+  writeFileSync as writeFileSync9,
+  readFileSync as readFileSync10,
   readdirSync as readdirSync4
 } from "node:fs";
-import { join as join11, resolve as resolve5, dirname } from "node:path";
+import { join as join12, resolve as resolve5, dirname as dirname2 } from "node:path";
 function slugifyDescription(description) {
   return description.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30).replace(/-+$/, "");
 }
 function getExistingRoutes(projectDir) {
-  const routesDir = join11(projectDir, "routes");
-  const jobsDir = join11(projectDir, "jobs");
+  const routesDir = join12(projectDir, "routes");
+  const jobsDir = join12(projectDir, "jobs");
   const routes = [];
-  if (existsSync10(routesDir)) {
+  if (existsSync11(routesDir)) {
     try {
       const files = readdirSync4(routesDir);
       routes.push(...files.map((f) => `routes/${f}`));
     } catch {}
   }
-  if (existsSync10(jobsDir)) {
+  if (existsSync11(jobsDir)) {
     try {
       const files = readdirSync4(jobsDir);
       routes.push(...files.map((f) => `jobs/${f}`));
@@ -17755,12 +17958,12 @@ function getExistingRoutes(projectDir) {
 }
 function writeGeneratedFiles(projectDir, files) {
   for (const file of files) {
-    const filePath = join11(projectDir, file.path);
-    const dir = dirname(filePath);
-    if (!existsSync10(dir)) {
-      mkdirSync5(dir, { recursive: true });
+    const filePath = join12(projectDir, file.path);
+    const dir = dirname2(filePath);
+    if (!existsSync11(dir)) {
+      mkdirSync6(dir, { recursive: true });
     }
-    writeFileSync8(filePath, file.content, "utf-8");
+    writeFileSync9(filePath, file.content, "utf-8");
   }
 }
 async function confirm(question) {
@@ -17789,8 +17992,8 @@ function registerCreateCommand(program2) {
     }
     const projectName = opts.name || slugifyDescription(description);
     const parentDir = opts.dir ? resolve5(opts.dir) : process.cwd();
-    const projectDir = join11(parentDir, projectName);
-    if (existsSync10(projectDir)) {
+    const projectDir = join12(parentDir, projectName);
+    if (existsSync11(projectDir)) {
       output.error("DIRECTORY_EXISTS", `Directory "${projectName}" already exists`, "Choose a different name with --name or remove the existing directory");
       return;
     }
@@ -17801,11 +18004,7 @@ function registerCreateCommand(program2) {
     try {
       generateResult = await client.post(`/api/v1/projects/${projectId}/ai/generate`, { description });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("GENERATE_FAILED", err.message);
-      }
+      reportApiError(output, err, "GENERATE_FAILED");
       return;
     }
     output.info(`Generated ${generateResult.files.length} file(s): ${generateResult.files.map((f) => f.path).join(", ")}`);
@@ -17819,8 +18018,8 @@ function registerCreateCommand(program2) {
         return;
       }
     }
-    mkdirSync5(join11(projectDir, "routes"), { recursive: true });
-    mkdirSync5(join11(projectDir, "jobs"), { recursive: true });
+    mkdirSync6(join12(projectDir, "routes"), { recursive: true });
+    mkdirSync6(join12(projectDir, "jobs"), { recursive: true });
     writeGeneratedFiles(projectDir, generateResult.files);
     output.info(`Files written to ${projectDir}`);
     if (opts.deploy !== false) {
@@ -17851,15 +18050,15 @@ function registerAddCommand(program2) {
       return;
     }
     const projectDir = opts.dir ? resolve5(opts.dir) : process.cwd();
-    const duraJsonPath = join11(projectDir, "dura.json");
-    if (!existsSync10(duraJsonPath)) {
+    const duraJsonPath = join12(projectDir, "dura.json");
+    if (!existsSync11(duraJsonPath)) {
       output.error("NOT_A_DURA_PROJECT", "No dura.json found in the current directory", "Run this command from a dura project directory or use --dir");
       return;
     }
     const existingRoutes = getExistingRoutes(projectDir);
     let projectConfig = {};
     try {
-      projectConfig = JSON.parse(readFileSync9(duraJsonPath, "utf-8"));
+      projectConfig = JSON.parse(readFileSync10(duraJsonPath, "utf-8"));
     } catch {}
     const apiUrl = getApiUrl();
     const client = new ApiClient(apiUrl, token);
@@ -17874,11 +18073,7 @@ function registerAddCommand(program2) {
         }
       });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("GENERATE_FAILED", err.message);
-      }
+      reportApiError(output, err, "GENERATE_FAILED");
       return;
     }
     output.info(`Generated ${generateResult.files.length} file(s): ${generateResult.files.map((f) => f.path).join(", ")}`);
@@ -17909,6 +18104,7 @@ var init_create = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/workflow.ts
@@ -17953,11 +18149,7 @@ function registerWorkflowsCommand(program2) {
         d.createdAt
       ]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("WORKFLOWS_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "WORKFLOWS_LIST_FAILED");
     }
   });
 }
@@ -17986,11 +18178,7 @@ function registerWorkflowCommand(program2) {
       }
       output.info(`Workflow run started: ${result.runId}`);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("WORKFLOW_RUN_FAILED", err.message);
-      }
+      reportApiError(output, err, "WORKFLOW_RUN_FAILED");
     }
   });
   workflow.command("runs <name>").description("List workflow runs").requiredOption("--project <id>", "Project ID").option("--status <status>", "Filter by status (pending/running/completed/failed)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (name, opts, cmd) => {
@@ -18014,11 +18202,7 @@ function registerWorkflowCommand(program2) {
       }
       output.table(["ID", "Status", "Trigger", "Created"], runs.map((r) => [r.id, r.status, r.triggerType, r.createdAt]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("WORKFLOW_RUNS_FAILED", err.message);
-      }
+      reportApiError(output, err, "WORKFLOW_RUNS_FAILED");
     }
   });
   workflow.command("cancel <run-id>").description("Cancel a running workflow").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").option("--confirm", "Confirm the destructive cancel operation").action(async (runId, opts, cmd) => {
@@ -18035,11 +18219,7 @@ function registerWorkflowCommand(program2) {
       await client.post(`/api/v1/projects/${opts.project}/workflow-runs/${encodeURIComponent(runId)}/cancel`, {});
       output.info(`Workflow run ${runId} cancelled.`);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("WORKFLOW_CANCEL_FAILED", err.message);
-      }
+      reportApiError(output, err, "WORKFLOW_CANCEL_FAILED");
     }
   });
 }
@@ -18071,11 +18251,7 @@ function registerApprovalsCommand(program2) {
         a.createdAt
       ]));
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("APPROVALS_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "APPROVALS_LIST_FAILED");
     }
   });
 }
@@ -18090,11 +18266,7 @@ function registerApproveCommand(program2) {
       await client.post(`/api/v1/projects/${opts.project}/approvals/${encodeURIComponent(approvalId)}/approve`, { decidedBy: opts.decidedBy });
       output.info(`Approval ${approvalId} approved.`);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("APPROVE_FAILED", err.message);
-      }
+      reportApiError(output, err, "APPROVE_FAILED");
     }
   });
 }
@@ -18109,11 +18281,7 @@ function registerRejectCommand(program2) {
       await client.post(`/api/v1/projects/${opts.project}/approvals/${encodeURIComponent(approvalId)}/reject`, { decidedBy: opts.decidedBy, reason: opts.reason });
       output.info(`Approval ${approvalId} rejected.`);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("REJECT_FAILED", err.message);
-      }
+      reportApiError(output, err, "REJECT_FAILED");
     }
   });
 }
@@ -18121,6 +18289,7 @@ var init_workflow = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/env.ts
@@ -18162,11 +18331,7 @@ function registerEnvCommand(program2) {
       });
       output.success(env2);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("ENV_CREATE_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENV_CREATE_FAILED");
     }
   });
   env.command("list").description("List all environments for a project").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -18179,11 +18344,7 @@ function registerEnvCommand(program2) {
       const envs = await client.get(`/api/v1/projects/${projectId}/environments`);
       output.success(envs);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("ENV_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENV_LIST_FAILED");
     }
   });
   env.command("delete <name>").description("Delete an environment").option("--project <id>", "Project ID (defaults to dura.json)").option("--env-id <id>", "Environment ID (alternative to name)").option("--confirm", "Confirm deletion (required for destructive operation)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (name, opts, cmd) => {
@@ -18210,11 +18371,7 @@ function registerEnvCommand(program2) {
       await client.delete(`/api/v1/projects/${projectId}/environments/${envId}`);
       output.success({ deleted: true, name });
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("ENV_DELETE_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENV_DELETE_FAILED");
     }
   });
   env.command("diff <env1> <env2>").description("Compare two environments").option("--project <id>", "Project ID (defaults to dura.json)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (env1, env2, opts, cmd) => {
@@ -18242,11 +18399,7 @@ function registerEnvCommand(program2) {
       };
       output.success(diff);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("ENV_DIFF_FAILED", err.message);
-      }
+      reportApiError(output, err, "ENV_DIFF_FAILED");
     }
   });
 }
@@ -18299,11 +18452,7 @@ function registerPromoteCommand(program2) {
       });
       output.success(promotion);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("PROMOTE_FAILED", err.message);
-      }
+      reportApiError(output, err, "PROMOTE_FAILED");
     }
   });
 }
@@ -18327,11 +18476,7 @@ function registerCanaryCommand(program2) {
       const canary2 = await client.get(`/api/v1/projects/${projectId}/canary?envId=${opts.env}`);
       output.success(canary2);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("CANARY_STATUS_FAILED", err.message);
-      }
+      reportApiError(output, err, "CANARY_STATUS_FAILED");
     }
   });
   canary.command("complete").description("Force-complete an active canary (100% traffic to new)").option("--project <id>", "Project ID (defaults to dura.json)").requiredOption("--canary-id <id>", "Canary deployment ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -18352,11 +18497,7 @@ function registerCanaryCommand(program2) {
       const canary2 = await client.post(`/api/v1/projects/${projectId}/canary/complete`, { canaryId: opts.canaryId });
       output.success(canary2);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("CANARY_COMPLETE_FAILED", err.message);
-      }
+      reportApiError(output, err, "CANARY_COMPLETE_FAILED");
     }
   });
   canary.command("rollback").description("Force-rollback an active canary (restore old deployment)").option("--project <id>", "Project ID (defaults to dura.json)").requiredOption("--canary-id <id>", "Canary deployment ID").option("--reason <reason>", "Reason for rollback").option("--confirm", "Confirm rollback (required)").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -18381,11 +18522,7 @@ function registerCanaryCommand(program2) {
       const canary2 = await client.post(`/api/v1/projects/${projectId}/canary/rollback`, { canaryId: opts.canaryId, reason: opts.reason });
       output.success(canary2);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("CANARY_ROLLBACK_FAILED", err.message);
-      }
+      reportApiError(output, err, "CANARY_ROLLBACK_FAILED");
     }
   });
 }
@@ -18413,6 +18550,7 @@ var init_env = __esm(() => {
   init_api_client();
   init_config_store();
   init_project_id();
+  init_handle_api_error();
 });
 // src/commands/reports.ts
@@ -18729,16 +18867,13 @@ function parseChannelSpec(spec) {
   return null;
 }
 function handleError(err, output, defaultCode) {
-  if (err instanceof ApiClientError) {
-    output.error(err.code, err.message, err.suggestion);
-  } else if (err instanceof Error) {
-    output.error(defaultCode, err.message);
-  }
+  reportApiError(output, err, defaultCode);
 }
 var init_reports = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/commands/heal.ts
@@ -18856,11 +18991,7 @@ Healing configuration:
         }
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_CONFIG_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_CONFIG_FAILED");
     }
   });
   heal.command("list").description("List healing records").requiredOption("--project <id>", "Project ID").option("--status <status>", "Filter by status (e.g. suggested, deployed)").option("--limit <n>", "Max records to show", parseInt).option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -18892,11 +19023,7 @@ ${records.length} healing record(s):
         }
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_LIST_FAILED");
     }
   });
   heal.command("show <record-id>").description("Show healing record details").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (recordId, opts, cmd) => {
@@ -18915,11 +19042,7 @@ ${records.length} healing record(s):
 ${formatRecord(record)}`);
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_SHOW_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_SHOW_FAILED");
     }
   });
   heal.command("trigger <execution-id>").description("Manually trigger healing for a failed execution").requiredOption("--project <id>", "Project ID").requiredOption("--automation <name>", "Automation name").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (executionId, opts, cmd) => {
@@ -18939,11 +19062,7 @@ Healing triggered. Record: ${record.id}`);
         output.info(`Status: ${record.status}`);
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_TRIGGER_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_TRIGGER_FAILED");
     }
   });
   heal.command("approve <record-id>").description("Approve a suggested fix and deploy it").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (recordId, opts, cmd) => {
@@ -18961,11 +19080,7 @@ Healing triggered. Record: ${record.id}`);
         output.info(`Fix ${recordId} approved and queued for deployment.`);
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_APPROVE_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_APPROVE_FAILED");
     }
   });
   heal.command("reject <record-id>").description("Reject a suggested fix").requiredOption("--project <id>", "Project ID").option("--reason <reason>", "Reason for rejection").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (recordId, opts, cmd) => {
@@ -18983,11 +19098,7 @@ Healing triggered. Record: ${record.id}`);
         output.info(`Fix ${recordId} rejected.`);
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_REJECT_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_REJECT_FAILED");
     }
   });
   heal.command("rollback <record-id>").description("Rollback a deployed fix").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (recordId, opts, cmd) => {
@@ -19005,11 +19116,7 @@ Healing triggered. Record: ${record.id}`);
         output.info(`Fix ${recordId} rolled back.`);
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_ROLLBACK_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_ROLLBACK_FAILED");
     }
   });
   heal.command("diff <record-id>").description("Show the generated code patch (diff view)").requiredOption("--project <id>", "Project ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (recordId, opts, cmd) => {
@@ -19033,11 +19140,7 @@ Healing triggered. Record: ${record.id}`);
 ${formatDiff(record)}`);
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("HEAL_DIFF_FAILED", err.message);
-      }
+      reportApiError(output, err, "HEAL_DIFF_FAILED");
     }
   });
 }
@@ -19045,34 +19148,35 @@ var init_heal = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/lib/skill-installer.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join12, dirname as dirname2 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join13, dirname as dirname3 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { fileURLToPath } from "node:url";
 function getSkillSourceDir() {
   const __filename2 = fileURLToPath(import.meta.url);
-  return join12(dirname2(dirname2(__filename2)), "skills");
+  return join13(dirname3(dirname3(__filename2)), "skills");
 }
 function getGlobalSkillsDir() {
-  return join12(homedir2(), ".claude", "skills", "dura");
+  return join13(homedir2(), ".claude", "skills", "dura");
 }
 function getLocalSkillsDir(projectDir) {
-  return join12(projectDir, ".claude", "skills", "dura");
+  return join13(projectDir, ".claude", "skills", "dura");
 }
 function installSkills(targetDir) {
   const sourceDir = getSkillSourceDir();
-  if (!existsSync11(targetDir)) {
-    mkdirSync6(targetDir, { recursive: true });
+  if (!existsSync12(targetDir)) {
+    mkdirSync7(targetDir, { recursive: true });
   }
   const installedFiles = [];
   for (const file of SKILL_FILES) {
-    const sourcePath = join12(sourceDir, file);
-    const targetPath = join12(targetDir, file);
-    const content = readFileSync10(sourcePath, "utf-8");
-    writeFileSync9(targetPath, content, "utf-8");
+    const sourcePath = join13(sourceDir, file);
+    const targetPath = join13(targetDir, file);
+    const content = readFileSync11(sourcePath, "utf-8");
+    writeFileSync10(targetPath, content, "utf-8");
     installedFiles.push(targetPath);
   }
   return {
@@ -19096,8 +19200,8 @@ var exports_init = {};
 __export(exports_init, {
   registerInitCommand: () => registerInitCommand
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join13, resolve as resolve6, basename } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join14, resolve as resolve6, basename } from "node:path";
 function registerInitCommand(program2) {
   program2.command("init").description("Initialize a dura project in the current directory and install AI agent skills").option("--dir <path>", "Project directory (defaults to current dir)").option("--name <name>", "Project name (defaults to directory name)").option("--global", "Install AI agent skills globally (~/.claude/skills/dura/)").option("--local", "Install AI agent skills locally (.claude/skills/dura/)").option("--skip-skills", "Skip AI agent skill installation").action(async (opts, cmd) => {
     const output = getOutput(cmd);
@@ -19107,24 +19211,24 @@ function registerInitCommand(program2) {
       output.error("INVALID_NAME", `Invalid project name "${projectName}"`, "Project name must start with a letter and contain only letters, numbers, hyphens, and underscores. Use --name to specify a valid name.");
       return;
     }
-    mkdirSync7(join13(projectDir, "routes"), { recursive: true });
-    mkdirSync7(join13(projectDir, "jobs"), { recursive: true });
-    const manifestPath = join13(projectDir, "dura.json");
-    const alreadyInitialized = existsSync12(manifestPath);
+    mkdirSync8(join14(projectDir, "routes"), { recursive: true });
+    mkdirSync8(join14(projectDir, "jobs"), { recursive: true });
+    const manifestPath = join14(projectDir, "dura.json");
+    const alreadyInitialized = existsSync13(manifestPath);
     if (!alreadyInitialized) {
-      writeFileSync10(manifestPath, duraJsonTemplate(projectName));
+      writeFileSync11(manifestPath, duraJsonTemplate(projectName));
     } else {
       output.info(`dura.json already exists in ${projectDir} — leaving it in place.`);
     }
-    const helloPath = join13(projectDir, "routes", "hello.ts");
-    if (existsSync12(helloPath)) {
+    const helloPath = join14(projectDir, "routes", "hello.ts");
+    if (existsSync13(helloPath)) {
       output.warn("routes/hello.ts already exists — skipping");
     } else {
-      writeFileSync10(helloPath, HELLO_TEMPLATE);
+      writeFileSync11(helloPath, HELLO_TEMPLATE);
     }
-    const gitignorePath = join13(projectDir, ".gitignore");
-    if (!existsSync12(gitignorePath)) {
-      writeFileSync10(gitignorePath, GITIGNORE_CONTENT2);
+    const gitignorePath = join14(projectDir, ".gitignore");
+    if (!existsSync13(gitignorePath)) {
+      writeFileSync11(gitignorePath, GITIGNORE_CONTENT2);
     }
     if (alreadyInitialized) {
       output.info(`Re-checked dura project "${projectName}" in ${projectDir}`);
@@ -19230,11 +19334,7 @@ function registerProjectsCommand(program2) {
       const project = await client.get(`/api/v1/orgs/${orgId}/projects/${projectId}`);
       output.success(project);
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("PROJECTS_GET_FAILED", err.message);
-      }
+      reportApiError(output, err, "PROJECTS_GET_FAILED");
     }
   });
   projects2.command("list").description("List all projects in the organization").option("--org <id>", "Organization ID").option("--api-url <url>", "API base URL").option("--token <token>", "Auth token").action(async (opts, cmd) => {
@@ -19268,11 +19368,7 @@ function registerProjectsCommand(program2) {
         ]));
       }
     } catch (err) {
-      if (err instanceof ApiClientError) {
-        output.error(err.code, err.message, err.suggestion);
-      } else if (err instanceof Error) {
-        output.error("PROJECTS_LIST_FAILED", err.message);
-      }
+      reportApiError(output, err, "PROJECTS_LIST_FAILED");
     }
   });
 }
@@ -19280,6 +19376,7 @@ var init_projects2 = __esm(() => {
   init_src3();
   init_api_client();
   init_config_store();
+  init_handle_api_error();
 });
 // src/index.ts
@@ -19321,6 +19418,7 @@ async function registerAllCommands(program2) {
   const { registerTestCommand: registerTestCommand2 } = await Promise.resolve().then(() => (init_test(), exports_test));
   const { registerDomainsCommand: registerDomainsCommand2 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
   const { registerEndpointKeysCommand: registerEndpointKeysCommand2 } = await Promise.resolve().then(() => (init_endpoint_keys2(), exports_endpoint_keys));
+  const { registerEventsCommand: registerEventsCommand2 } = await Promise.resolve().then(() => (init_events(), exports_events));
   const { registerUsageCommand: registerUsageCommand2 } = await Promise.resolve().then(() => (init_usage(), exports_usage));
   const { registerMarketplaceCommand: registerMarketplaceCommand2 } = await Promise.resolve().then(() => (init_marketplace2(), exports_marketplace));
   const { registerExportCommand: registerExportCommand2 } = await Promise.resolve().then(() => (init_export(), exports_export));
@@ -19365,6 +19463,7 @@ async function registerAllCommands(program2) {
   registerTestCommand2(program2);
   registerRunCommand2(program2);
   registerScheduleCommand2(program2);
+  registerEventsCommand2(program2);
   registerStatusCommand2(program2);
   registerLogsCommand2(program2);
   registerUsageCommand2(program2);
@@ -19386,7 +19485,7 @@ async function registerAllCommands(program2) {
   registerOpenApiCommand2(program2);
   return program2;
 }
-var CLI_VERSION = "0.2.1";
+var CLI_VERSION = "0.3.1";
 var init_src3 = __esm(() => {
   init_esm();
   if (import.meta.url === `file://${realpathSync(process.argv[1] ?? "").replace(/\\/g, "/")}`) {
@@ -19403,4 +19502,4 @@ export {
   CLI_VERSION
 };
-//# debugId=25AB4373003CF5A164756E2164756E21
+//# debugId=A22178BD000AEBBE64756E2164756E21