@edgestore/cli 0.0.0-canary-20260801073726

package/dist/bin.mjs

@@ -0,0 +1,3004 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { CommanderError, Command } from 'commander';
+import { EdgeStoreApiError, EdgeStoreNetworkError, EdgeStoreAbortError, createEdgeStoreSdk, DEFAULT_MULTIPART_THRESHOLD_BYTES, DEFAULT_MULTIPART_PART_SIZE_BYTES } from '@edgestore/sdk';
+import { createColors } from 'picocolors';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import envPaths from 'env-paths';
+import { randomUUID } from 'node:crypto';
+import { rm, rmdir, readFile, mkdir, writeFile, rename, stat, chmod, access, open, glob } from 'node:fs/promises';
+import { z } from 'zod';
+import { password, isCancel, text, confirm, select } from '@clack/prompts';
+
+class CliError extends Error {
+    code;
+    options;
+    name = 'CliError';
+    constructor(code, message, options = {}){
+        super(message), this.code = code, this.options = options;
+    }
+    get exitCode() {
+        return this.options.exitCode ?? 1;
+    }
+}
+const remediation = {
+    authentication_required: [
+        'edgestore login --token'
+    ],
+    invalid_credential: [
+        'edgestore login --token'
+    ],
+    credential_not_allowed: [
+        'Use a management token instead of a project access key.',
+        'edgestore login --token'
+    ],
+    bucket_not_empty: [
+        'edgestore bucket empty <bucket>',
+        'edgestore bucket delete <bucket>'
+    ],
+    bucket_empty_in_progress: [
+        'edgestore bucket empty-status <bucket>'
+    ]
+};
+function normalizeError(error) {
+    if (error instanceof CliError) {
+        return error;
+    }
+    if (error instanceof EdgeStoreApiError) {
+        return new CliError(error.code, error.message, {
+            details: error.details,
+            requestId: error.requestId,
+            suggestions: remediation[error.code]
+        });
+    }
+    if (error instanceof EdgeStoreNetworkError) {
+        return new CliError('network_error', 'Could not reach the EdgeStore API.', {
+            suggestions: [
+                'Check your network connection and the configured API URL.'
+            ]
+        });
+    }
+    if (error instanceof EdgeStoreAbortError) {
+        return new CliError('interrupted', 'Operation canceled.', {
+            exitCode: 130
+        });
+    }
+    if (error instanceof Error) {
+        return new CliError('unexpected_error', error.message);
+    }
+    return new CliError('unexpected_error', 'An unexpected error occurred.');
+}
+function usageError(code, message, suggestions) {
+    return new CliError(code, message, {
+        suggestions,
+        exitCode: 2
+    });
+}
+
+class CliOutput {
+    streams;
+    options;
+    colors;
+    constructor(streams, options){
+        this.streams = streams;
+        this.options = options;
+        this.colors = createColors(options.color && options.mode === 'human');
+    }
+    result(value, human, plain) {
+        if (this.options.mode === 'json') {
+            this.writeStdout(JSON.stringify(value, null, 2));
+            return;
+        }
+        if (this.options.mode === 'plain') {
+            if (plain === undefined) {
+                throw new CliError('plain_output_unavailable', 'This command does not have a single plain-text value.', {
+                    exitCode: 2
+                });
+            }
+            this.writeStdout(plain);
+            return;
+        }
+        this.writeStdout(human);
+    }
+    message(message) {
+        this.writeStdout(message);
+    }
+    warning(message) {
+        this.writeStderr(`${this.colors.yellow('Warning:')} ${message}`);
+    }
+    error(error) {
+        if (this.options.mode === 'json') {
+            this.writeStderr(JSON.stringify({
+                error: {
+                    code: error.code,
+                    message: error.message,
+                    ...error.options.details === undefined ? {} : {
+                        details: error.options.details
+                    },
+                    ...error.options.requestId === undefined ? {} : {
+                        requestId: error.options.requestId
+                    },
+                    ...error.options.suggestions === undefined ? {} : {
+                        suggestions: error.options.suggestions
+                    }
+                }
+            }, null, 2));
+            return;
+        }
+        const lines = [
+            this.colors.red(error.message)
+        ];
+        if (error.options.suggestions?.length) {
+            lines.push('', 'Run:', ...error.options.suggestions.map((item)=>`  ${item}`));
+        }
+        if (error.options.requestId) {
+            lines.push('', `Request ID: ${error.options.requestId}`);
+        }
+        this.writeStderr(lines.join('\n'));
+    }
+    writeStdout(value) {
+        this.streams.stdout.write(`${value}\n`);
+    }
+    writeStderr(value) {
+        this.streams.stderr.write(`${value}\n`);
+    }
+}
+function renderTable(headers, rows) {
+    const stringRows = rows.map((row)=>row.map(String));
+    const widths = headers.map((header, columnIndex)=>Math.max(header.length, ...stringRows.map((row)=>row[columnIndex]?.length ?? 0)));
+    const renderRow = (row)=>row.map((value, index)=>value.padEnd(widths[index] ?? value.length)).join('  ').trimEnd();
+    return [
+        renderRow(headers),
+        ...stringRows.map((row)=>renderRow(row))
+    ].join('\n');
+}
+
+const DEFAULT_API_ORIGIN = 'https://api.edgestore.dev';
+function resolveApiUrl(flagValue, envValue) {
+    const rawValue = flagValue ?? envValue ?? DEFAULT_API_ORIGIN;
+    let url;
+    try {
+        url = new URL(rawValue);
+    } catch  {
+        throw usageError('invalid_api_url', `Invalid EdgeStore API URL: ${rawValue}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw usageError('invalid_api_url', 'The EdgeStore API URL must use http or https.');
+    }
+    if (url.username || url.password) {
+        throw usageError('invalid_api_url', 'The EdgeStore API URL must not contain credentials.');
+    }
+    url.search = '';
+    url.hash = '';
+    const pathname = url.pathname.replace(/\/+$/, '');
+    if (pathname !== '' && pathname !== '/v2') {
+        throw usageError('invalid_api_url', 'The EdgeStore API URL must be an origin or end in /v2.');
+    }
+    url.pathname = '';
+    const displayUrl = url.toString().replace(/\/$/, '');
+    return {
+        displayUrl,
+        sdkBaseUrl: `${displayUrl}/v2`
+    };
+}
+
+const globalConfigSchema = z.object({
+    version: z.literal(1),
+    activeAccount: z.string().min(1).optional()
+}).strict();
+const repoConfigSchema = z.object({
+    account: z.string().min(1),
+    project: z.string().min(1)
+}).strict();
+class GlobalConfigStore {
+    path;
+    constructor(path){
+        this.path = path;
+    }
+    async read() {
+        return readConfig(this.path, globalConfigSchema, {
+            version: 1
+        });
+    }
+    async write(config) {
+        await writeConfig(this.path, globalConfigSchema.parse(config));
+    }
+}
+class RepoConfigStore {
+    cwd;
+    constructor(cwd){
+        this.cwd = cwd;
+    }
+    async read() {
+        const configPath = await findRepoConfig(this.cwd);
+        if (!configPath) {
+            return undefined;
+        }
+        return {
+            config: await readConfig(configPath, repoConfigSchema),
+            path: configPath
+        };
+    }
+    async write(config) {
+        const root = await findGitRoot(this.cwd) ?? this.cwd;
+        const configPath = path.join(root, '.edgestore', 'config.json');
+        await writeConfig(configPath, repoConfigSchema.parse(config));
+        return configPath;
+    }
+    async remove() {
+        const located = await this.read();
+        if (!located) {
+            return undefined;
+        }
+        await rm(located.path);
+        await rmdir(path.dirname(located.path)).catch((error)=>{
+            if (error.code !== 'ENOTEMPTY' && error.code !== 'EEXIST') {
+                throw error;
+            }
+        });
+        return located.path;
+    }
+}
+async function readConfig(configPath, schema, missingValue) {
+    let contents;
+    try {
+        contents = await readFile(configPath, 'utf8');
+    } catch (error) {
+        if (isMissingFile(error) && missingValue !== undefined) {
+            return missingValue;
+        }
+        throw error;
+    }
+    try {
+        return schema.parse(JSON.parse(contents));
+    } catch (error) {
+        throw new CliError('invalid_config', `Invalid EdgeStore config at ${configPath}.`, {
+            details: error
+        });
+    }
+}
+async function writeConfig(configPath, config) {
+    await mkdir(path.dirname(configPath), {
+        recursive: true
+    });
+    const temporaryPath = `${configPath}.${randomUUID()}.tmp`;
+    await writeFile(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600
+    });
+    await rename(temporaryPath, configPath);
+}
+async function findRepoConfig(start) {
+    let current = path.resolve(start);
+    while(true){
+        const candidate = path.join(current, '.edgestore', 'config.json');
+        if (await pathExists(candidate)) {
+            return candidate;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
+async function findGitRoot(start) {
+    let current = path.resolve(start);
+    while(true){
+        if (await pathExists(path.join(current, '.git'))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
+async function pathExists(candidate) {
+    try {
+        await stat(candidate);
+        return true;
+    } catch (error) {
+        if (isMissingFile(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+function isMissingFile(error) {
+    return error instanceof Error && 'code' in error && (error.code === 'ENOENT' || error.code === 'ENOTDIR');
+}
+
+const SERVICE_NAME = 'edgestore-cli';
+const CREDENTIAL_NAME = 'management-credential';
+class KeyringCredentialStore {
+    async get() {
+        const entry = await createEntry();
+        return await entry.getPassword() ?? undefined;
+    }
+    async set(token) {
+        const entry = await createEntry();
+        await entry.setPassword(token);
+    }
+    async delete() {
+        const entry = await createEntry();
+        return entry.deleteCredential();
+    }
+    async available() {
+        try {
+            await import('@napi-rs/keyring');
+            return true;
+        } catch  {
+            return false;
+        }
+    }
+}
+async function createEntry() {
+    try {
+        const { AsyncEntry } = await import('@napi-rs/keyring');
+        return new AsyncEntry(SERVICE_NAME, CREDENTIAL_NAME);
+    } catch (error) {
+        throw new CliError('keychain_unavailable', 'The operating system credential store is unavailable.', {
+            details: error,
+            suggestions: [
+                'Set EDGESTORE_TOKEN for automation or configure your OS credential store.'
+            ],
+            exitCode: 2
+        });
+    }
+}
+async function resolveCredential(envToken, store) {
+    if (envToken?.trim()) {
+        return {
+            token: envToken.trim(),
+            source: 'environment'
+        };
+    }
+    const token = await store.get();
+    return token?.trim() ? {
+        token: token.trim(),
+        source: 'keychain'
+    } : undefined;
+}
+
+class DefaultCliPrompts {
+    async readToken(input, inputIsTty) {
+        if (!inputIsTty) {
+            const chunks = [];
+            for await (const chunk of input){
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+            }
+            return validateToken(Buffer.concat(chunks).toString('utf8'));
+        }
+        const result = await password({
+            message: 'Management token',
+            validate: (value)=>value?.trim() ? undefined : 'Token is required.'
+        });
+        if (isCancel(result)) {
+            throw new CliError('interrupted', 'Login canceled.', {
+                exitCode: 130
+            });
+        }
+        return validateToken(result);
+    }
+    async confirmTyped(message, expected) {
+        const result = await text({
+            message,
+            placeholder: expected,
+            validate: (value)=>value === expected ? undefined : `Type ${expected} to confirm.`
+        });
+        if (isCancel(result)) {
+            throw new CliError('interrupted', 'Operation canceled.', {
+                exitCode: 130
+            });
+        }
+    }
+    async confirm(message, initialValue = false) {
+        return unwrapPrompt(await confirm({
+            message,
+            initialValue
+        }));
+    }
+    async select(message, options) {
+        return unwrapPrompt(await select({
+            message,
+            options
+        }));
+    }
+    async text(message, placeholder) {
+        const result = unwrapPrompt(await text({
+            message,
+            placeholder,
+            validate: (value)=>value?.trim() ? undefined : 'Value is required.'
+        }));
+        return result.trim();
+    }
+}
+function validateToken(value) {
+    const token = value.trim();
+    if (!token) {
+        throw usageError('missing_token', 'No management token was provided.');
+    }
+    return token;
+}
+function unwrapPrompt(value) {
+    if (isCancel(value)) {
+        throw new CliError('interrupted', 'Operation canceled.', {
+            exitCode: 130
+        });
+    }
+    return value;
+}
+
+function createDefaultRuntime(signal) {
+    const paths = envPaths('edgestore', {
+        suffix: ''
+    });
+    return {
+        exitCode: 0,
+        cwd: process.cwd(),
+        env: process.env,
+        io: {
+            stdin: process.stdin,
+            stdout: process.stdout,
+            stderr: process.stderr,
+            inputIsTty: Boolean(process.stdin.isTTY),
+            outputIsTty: Boolean(process.stdout.isTTY)
+        },
+        signal,
+        globalConfig: new GlobalConfigStore(path.join(paths.config, 'config.json')),
+        repoConfig: new RepoConfigStore(process.cwd()),
+        credentials: new KeyringCredentialStore(),
+        prompts: new DefaultCliPrompts(),
+        sdkFactory: ({ token, baseUrl })=>createEdgeStoreSdk({
+                credentials: {
+                    token
+                },
+                apiUrl: baseUrl
+            }),
+        openUrl,
+        runCommand
+    };
+}
+function outputFor(runtime, flags) {
+    const mode = getOutputMode(flags);
+    return new CliOutput(runtime.io, {
+        mode,
+        color: flags.color && runtime.io.outputIsTty && runtime.env.NO_COLOR === undefined
+    });
+}
+function apiUrlFor(runtime, flags) {
+    return resolveApiUrl(flags.apiUrl, runtime.env.EDGESTORE_API_URL);
+}
+async function credentialFor(runtime) {
+    const credential = await resolveCredential(runtime.env.EDGESTORE_TOKEN, runtime.credentials);
+    if (!credential) {
+        throw usageError('authentication_required', 'Not logged in.', [
+            'edgestore login --token'
+        ]);
+    }
+    return credential;
+}
+async function sdkFor(runtime, flags) {
+    const credential = await credentialFor(runtime);
+    return runtime.sdkFactory({
+        token: credential.token,
+        baseUrl: apiUrlFor(runtime, flags).sdkBaseUrl
+    });
+}
+function getOutputMode(flags) {
+    if (flags.json && flags.plain) {
+        throw usageError('conflicting_output_modes', '--json and --plain cannot be used together.');
+    }
+    if (flags.json) {
+        return 'json';
+    }
+    if (flags.plain) {
+        return 'plain';
+    }
+    return 'human';
+}
+function openUrl(url) {
+    if (process.platform === 'darwin') {
+        return runCommand('open', [
+            url
+        ]);
+    }
+    if (process.platform === 'win32') {
+        return runCommand('cmd', [
+            '/c',
+            'start',
+            '',
+            url
+        ]);
+    }
+    return runCommand('xdg-open', [
+        url
+    ]);
+}
+function runCommand(command, args) {
+    return new Promise((resolve, reject)=>{
+        const child = spawn(command, args, {
+            stdio: 'inherit'
+        });
+        child.once('error', reject);
+        child.once('exit', (code, signal)=>{
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(signal ? `${command} was terminated by ${signal}.` : `${command} exited with code ${code ?? 'unknown'}.`));
+        });
+    });
+}
+
+async function accountListCommand(runtime, flags) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.accounts.list({
+        signal: runtime.signal
+    });
+    const config = await runtime.globalConfig.read();
+    const rows = result.accounts.map((account)=>[
+            account.id === config.activeAccount ? '*' : '',
+            account.id,
+            account.type.toLowerCase(),
+            account.displayName,
+            account.role?.toLowerCase() ?? '-'
+        ]);
+    const human = result.accounts.length ? renderTable([
+        'CURRENT',
+        'ID',
+        'TYPE',
+        'NAME',
+        'ROLE'
+    ], rows) : 'No accounts found.';
+    outputFor(runtime, flags).result(result, human);
+}
+async function accountCurrentCommand(runtime, flags) {
+    const config = await runtime.globalConfig.read();
+    if (!config.activeAccount) {
+        throw missingAccountError();
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.accounts.get({
+        account: config.activeAccount,
+        signal: runtime.signal
+    });
+    const { account } = result;
+    outputFor(runtime, flags).result(result, `${account.displayName} (${account.id})`, account.id);
+}
+async function accountSwitchCommand(runtime, flags, selector) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.accounts.list({
+        signal: runtime.signal
+    });
+    const account = findAccount(result.accounts, selector);
+    if (!account) {
+        throw usageError('account_not_found', selector === 'personal' ? 'No personal account is available to this credential.' : `Account ${selector} is not available to this credential.`, [
+            'edgestore account list'
+        ]);
+    }
+    const config = await runtime.globalConfig.read();
+    await runtime.globalConfig.write({
+        ...config,
+        activeAccount: account.id
+    });
+    outputFor(runtime, flags).result(account, `Switched to ${account.displayName} (${account.id}).`, account.id);
+}
+async function activeAccount(runtime, explicitAccount) {
+    if (explicitAccount) {
+        return explicitAccount;
+    }
+    const config = await runtime.globalConfig.read();
+    if (!config.activeAccount) {
+        throw missingAccountError();
+    }
+    return config.activeAccount;
+}
+async function accountUsageCommand(runtime, flags) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.accounts.get({
+        account: await activeAccount(runtime),
+        signal: runtime.signal
+    });
+    const account = result.account;
+    outputFor(runtime, flags).result(result, [
+        `Account: ${account.displayName} (${account.id})`,
+        `Storage: ${account.usageBytes}/${account.storageLimitBytes} bytes`,
+        `Projects: ${account.projectCount}/${account.projectLimit}`,
+        `Plan: ${account.planType}`
+    ].join('\n'), String(account.usageBytes));
+}
+async function accountBillingCommand(runtime, flags) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.accounts.get({
+        account: await activeAccount(runtime),
+        signal: runtime.signal
+    });
+    const account = result.account;
+    outputFor(runtime, flags).result(result, [
+        `Plan: ${account.planType}`,
+        `Storage limit: ${account.storageLimitBytes} bytes`,
+        `Project limit: ${account.projectLimit}`,
+        `Member limit: ${account.memberLimit}`,
+        '',
+        'Open billing:',
+        '  edgestore open billing'
+    ].join('\n'), account.planType);
+}
+async function accountLeaveCommand(runtime, flags, options) {
+    const accountId = await activeAccount(runtime);
+    const sdk = await sdkFor(runtime, flags);
+    const current = await sdk.management.accounts.get({
+        account: accountId,
+        signal: runtime.signal
+    });
+    if (current.account.type === 'PERSONAL') {
+        throw usageError('personal_account', 'You cannot leave a personal account.');
+    }
+    if (!options.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'Leaving an account requires confirmation.', [
+                'edgestore account leave --yes'
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Type ${accountId} to leave ${current.account.displayName}`, accountId);
+    }
+    await sdk.management.accounts.leave({
+        account: accountId,
+        signal: runtime.signal
+    });
+    const listed = await sdk.management.accounts.list({
+        signal: runtime.signal
+    });
+    const personal = listed.accounts.find((account)=>account.type === 'PERSONAL');
+    const config = await runtime.globalConfig.read();
+    await runtime.globalConfig.write({
+        ...config,
+        activeAccount: personal?.id
+    });
+    outputFor(runtime, flags).result({
+        left: accountId,
+        activeAccount: personal?.id
+    }, `Left ${current.account.displayName}.${personal ? ` Switched to ${personal.displayName}.` : ''}`, personal?.id ?? accountId);
+}
+function findAccount(accounts, selector) {
+    if (selector === 'personal') {
+        return accounts.find((account)=>account.type === 'PERSONAL');
+    }
+    return accounts.find((account)=>account.id === selector);
+}
+function missingAccountError() {
+    return usageError('account_context_required', 'No active account selected.', [
+        'edgestore account list',
+        'edgestore account switch <account-id>'
+    ]);
+}
+
+async function loginCommand(runtime, flags, options) {
+    if (!options.token) {
+        throw usageError('browser_login_unavailable', 'Browser login is not available yet.', [
+            'edgestore login --token'
+        ]);
+    }
+    if (flags.json && runtime.io.inputIsTty) {
+        throw usageError('interactive_input_disabled', 'Interactive token input is disabled with --json.', [
+            'printf %s "$EDGESTORE_TOKEN" | edgestore login --token --json'
+        ]);
+    }
+    const token = await runtime.prompts.readToken(runtime.io.stdin, runtime.io.inputIsTty);
+    const apiUrl = apiUrlFor(runtime, flags);
+    const sdk = runtime.sdkFactory({
+        token,
+        baseUrl: apiUrl.sdkBaseUrl
+    });
+    const identity = await sdk.management.whoami({
+        signal: runtime.signal
+    });
+    await runtime.credentials.set(token);
+    const accountId = accountIdFromActor(identity.actor);
+    if (accountId) {
+        const config = await runtime.globalConfig.read();
+        await runtime.globalConfig.write({
+            ...config,
+            activeAccount: accountId
+        });
+    }
+    outputFor(runtime, flags).result({
+        authenticated: true,
+        actor: identity.actor
+    }, `Logged in as ${actorLabel(identity.actor)}.`, actorLabel(identity.actor));
+}
+async function logoutCommand(runtime, flags) {
+    const deleted = await runtime.credentials.delete();
+    const environmentTokenActive = Boolean(runtime.env.EDGESTORE_TOKEN?.trim());
+    const output = outputFor(runtime, flags);
+    output.result({
+        loggedOut: deleted,
+        environmentTokenActive
+    }, deleted ? 'Logged out.' : 'No stored login found.', String(deleted));
+    if (environmentTokenActive && output.options.mode === 'human') {
+        output.warning('EDGESTORE_TOKEN is still set and will authenticate this process.');
+    }
+}
+async function whoamiCommand(runtime, flags) {
+    const credential = await credentialFor(runtime);
+    const apiUrl = apiUrlFor(runtime, flags);
+    const sdk = runtime.sdkFactory({
+        token: credential.token,
+        baseUrl: apiUrl.sdkBaseUrl
+    });
+    const identity = await sdk.management.whoami({
+        signal: runtime.signal
+    });
+    const globalConfig = await runtime.globalConfig.read();
+    const localConfig = await runtime.repoConfig.read();
+    const context = {
+        activeAccount: globalConfig.activeAccount,
+        localAccount: localConfig?.config.account,
+        localProject: localConfig?.config.project,
+        apiUrl: apiUrl.displayUrl
+    };
+    const lines = [
+        `Identity: ${actorLabel(identity.actor)}`,
+        `Credential: ${credential.source}`,
+        `Active account: ${context.activeAccount ?? 'none'}`,
+        `Local project: ${context.localProject ?? 'none'}`
+    ];
+    if (context.localAccount && context.localAccount !== context.activeAccount) {
+        lines.push(`Local account: ${context.localAccount}`);
+    }
+    lines.push(`API: ${context.apiUrl}`);
+    outputFor(runtime, flags).result({
+        actor: identity.actor,
+        credentialSource: credential.source,
+        context
+    }, lines.join('\n'));
+}
+function actorLabel(actor) {
+    if (actor.kind === 'account_token') {
+        return `account token ${actor.tokenId}`;
+    }
+    if (actor.kind === 'user_token') {
+        return actor.user.email;
+    }
+    return actor.user.email;
+}
+function accountIdFromActor(actor) {
+    return actor.kind === 'account_token' ? actor.accountId : actor.user.accountId;
+}
+
+async function projectListCommand(runtime, flags, options) {
+    const account = await activeAccount(runtime, options.account);
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.projects.list({
+        account,
+        signal: runtime.signal
+    });
+    const local = await runtime.repoConfig.read();
+    const rows = result.projects.map((project)=>[
+            project.basePath === local?.config.project ? '*' : '',
+            project.basePath,
+            project.name,
+            project.id
+        ]);
+    const human = result.projects.length ? renderTable([
+        'LINKED',
+        'BASE PATH',
+        'NAME',
+        'ID'
+    ], rows) : 'No projects found.';
+    outputFor(runtime, flags).result(result, human);
+}
+async function projectShowCommand(runtime, flags, projectRef) {
+    const project = await getProject(runtime, flags, projectRef);
+    outputFor(runtime, flags).result({
+        project
+    }, [
+        `Name: ${project.name}`,
+        `Base path: ${project.basePath}`,
+        `ID: ${project.id}`,
+        `Account: ${project.accountId}`,
+        `Usage: ${project.usageBytes} bytes`,
+        `Created: ${project.createdAt}`
+    ].join('\n'), project.basePath);
+}
+async function projectCreateCommand(runtime, flags, options) {
+    const account = await activeAccount(runtime, options.account);
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.projects.create({
+        account,
+        name: options.name,
+        createKey: !options.withoutKey,
+        allowOverage: Boolean(options.allowOverage),
+        signal: runtime.signal
+    });
+    const keyLines = result.projectKey ? [
+        '',
+        `EDGE_STORE_ACCESS_KEY=${result.projectKey.key.accessKey}`,
+        `EDGE_STORE_SECRET_KEY=${result.projectKey.secretKey}`,
+        '',
+        'Save this secret now. You will not be able to view it again.'
+    ] : [];
+    outputFor(runtime, flags).result(result, [
+        `Created project "${result.project.name}" (${result.project.basePath}).`,
+        ...keyLines,
+        '',
+        'Link this directory:',
+        `  edgestore project link ${result.project.basePath}`
+    ].join('\n'), result.project.basePath);
+}
+async function projectDeleteCommand(runtime, flags, options) {
+    const project = await getProject(runtime, flags, options.project);
+    if (!options.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'Project deletion requires confirmation.', [
+                `edgestore project delete ${project.basePath} --yes`
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Delete project "${project.name}"? Type ${project.basePath} to confirm`, project.basePath);
+    }
+    const sdk = await sdkFor(runtime, flags);
+    await sdk.management.projects.delete({
+        project: project.basePath,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result({
+        deleted: true,
+        project
+    }, `Deleted project "${project.name}" (${project.basePath}).`, project.basePath);
+}
+async function projectCurrentCommand(runtime, flags) {
+    const located = await runtime.repoConfig.read();
+    if (!located) {
+        throw missingProjectError();
+    }
+    outputFor(runtime, flags).result({
+        account: located.config.account,
+        project: located.config.project,
+        configPath: located.path
+    }, [
+        `Project: ${located.config.project}`,
+        `Account: ${located.config.account}`,
+        `Config: ${located.path}`
+    ].join('\n'), located.config.project);
+}
+async function projectLinkCommand(runtime, flags, projectRef) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.projects.get({
+        project: projectRef,
+        signal: runtime.signal
+    });
+    const { project } = result;
+    const configPath = await runtime.repoConfig.write({
+        account: project.accountId,
+        project: project.basePath
+    });
+    outputFor(runtime, flags).result({
+        ...result,
+        configPath
+    }, [
+        `Linked ${project.name} (${project.basePath}).`,
+        `Config: ${configPath}`
+    ].join('\n'), project.basePath);
+}
+async function projectUnlinkCommand(runtime, flags) {
+    const configPath = await runtime.repoConfig.remove();
+    if (!configPath) {
+        throw missingProjectError();
+    }
+    outputFor(runtime, flags).result({
+        unlinked: true,
+        configPath
+    }, `Unlinked the local project at ${configPath}.`, configPath);
+}
+async function resolvedProjectRef(runtime, explicit) {
+    if (explicit) return explicit;
+    const located = await runtime.repoConfig.read();
+    if (!located) throw missingProjectError();
+    return located.config.project;
+}
+async function getProject(runtime, flags, explicit) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.projects.get({
+        project: await resolvedProjectRef(runtime, explicit),
+        signal: runtime.signal
+    });
+    return result.project;
+}
+function missingProjectError() {
+    return usageError('project_context_required', 'No project specified or linked.', [
+        'edgestore project list',
+        'edgestore project link <basePath>'
+    ]);
+}
+
+async function bucketListCommand(runtime, flags, project) {
+    const projectRef = await resolvedProjectRef(runtime, project);
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.buckets.list({
+        project: projectRef,
+        signal: runtime.signal
+    });
+    const rows = result.buckets.map((bucket)=>[
+            bucket.name,
+            bucket.type,
+            bucket.visibility,
+            bucket.usageBytes,
+            bucket.id
+        ]);
+    outputFor(runtime, flags).result(result, rows.length ? renderTable([
+        'NAME',
+        'TYPE',
+        'VISIBILITY',
+        'BYTES',
+        'ID'
+    ], rows) : 'No buckets found.');
+}
+async function bucketShowCommand(runtime, flags, input) {
+    const result = await getBucket(runtime, flags, input);
+    outputFor(runtime, flags).result(result, [
+        `Name: ${result.bucket.name}`,
+        `Type: ${result.bucket.type}`,
+        `Visibility: ${result.bucket.visibility}`,
+        `Usage: ${result.bucket.usageBytes} bytes`,
+        `ID: ${result.bucket.id}`
+    ].join('\n'), result.bucket.name);
+}
+async function bucketCreateCommand(runtime, flags, input) {
+    validateBucketName$1(input.bucket);
+    if (Boolean(input.public) === Boolean(input.protected)) {
+        throw usageError('bucket_visibility_required', 'Choose exactly one of --public or --protected.');
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.buckets.create({
+        project: await resolvedProjectRef(runtime, input.project),
+        name: input.bucket,
+        type: input.type,
+        visibility: input.public ? 'public' : 'protected',
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Created ${result.bucket.visibility} ${result.bucket.type} bucket ${result.bucket.name}.`, result.bucket.name);
+}
+async function bucketDeleteCommand(runtime, flags, input) {
+    const project = await resolvedProjectRef(runtime, input.project);
+    const current = await getBucket(runtime, flags, {
+        project,
+        bucket: input.bucket
+    });
+    if (!input.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'Bucket deletion requires confirmation.', [
+                `edgestore bucket delete ${input.bucket} --yes`
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Type ${current.bucket.name} to delete this bucket`, current.bucket.name);
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.buckets.delete({
+        project,
+        bucket: current.bucket.name,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Deleted bucket ${current.bucket.name}.`, current.bucket.name);
+}
+async function bucketEmptyCommand(runtime, flags, input) {
+    const project = await resolvedProjectRef(runtime, input.project);
+    if (!input.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'Emptying a bucket requires confirmation.', [
+                `edgestore bucket empty ${input.bucket} --yes`
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Type ${input.bucket} to asynchronously delete all files`, input.bucket);
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const started = input.retry ? await sdk.management.buckets.emptyJobs.retry({
+        project,
+        bucket: input.bucket,
+        jobId: input.retry,
+        signal: runtime.signal
+    }) : await sdk.management.buckets.empty({
+        project,
+        bucket: input.bucket,
+        signal: runtime.signal
+    });
+    if (input.wait) {
+        const job = await waitForEmptyJob(runtime, flags, {
+            project,
+            bucket: input.bucket,
+            jobId: started.jobId
+        });
+        renderEmptyJob(runtime, flags, job);
+        if (job.status === 'FAILED') {
+            throw new CliError('bucket_empty_failed', 'The bucket empty job failed.', {
+                details: {
+                    jobId: job.id,
+                    error: job.error
+                },
+                suggestions: [
+                    `edgestore bucket empty ${input.bucket} --retry ${job.id}`
+                ]
+            });
+        }
+        return;
+    }
+    outputFor(runtime, flags).result(started, [
+        'Started empty bucket job.',
+        `Job: ${started.jobId}`,
+        '',
+        'Check status:',
+        `  edgestore bucket empty-status ${input.bucket} --job ${started.jobId}`
+    ].join('\n'), started.jobId);
+}
+async function bucketEmptyStatusCommand(runtime, flags, input) {
+    const project = await resolvedProjectRef(runtime, input.project);
+    const sdk = await sdkFor(runtime, flags);
+    const result = input.job ? await sdk.management.buckets.emptyJobs.get({
+        project,
+        bucket: input.bucket,
+        jobId: input.job,
+        signal: runtime.signal
+    }) : await sdk.management.buckets.emptyJobs.latest({
+        project,
+        bucket: input.bucket,
+        signal: runtime.signal
+    });
+    if (!result.job) {
+        throw new CliError('bucket_empty_job_not_found', `No empty-bucket job found for ${input.bucket}.`, {
+            suggestions: [
+                `edgestore bucket empty ${input.bucket}`
+            ]
+        });
+    }
+    renderEmptyJob(runtime, flags, result.job);
+}
+async function getBucket(runtime, flags, input) {
+    const sdk = await sdkFor(runtime, flags);
+    return sdk.management.buckets.get({
+        project: await resolvedProjectRef(runtime, input.project),
+        bucket: input.bucket,
+        signal: runtime.signal
+    });
+}
+function validateBucketName$1(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$/.test(name)) {
+        throw usageError('invalid_bucket_name', 'Bucket names must begin with a letter or number and contain only letters, numbers, underscores, or hyphens.');
+    }
+}
+async function waitForEmptyJob(runtime, flags, target) {
+    const sdk = await sdkFor(runtime, flags);
+    for(let attempt = 0; attempt < 120; attempt += 1){
+        const result = await sdk.management.buckets.emptyJobs.get({
+            project: target.project,
+            bucket: target.bucket,
+            jobId: target.jobId,
+            signal: runtime.signal
+        });
+        if (result.job.status === 'SUCCEEDED' || result.job.status === 'FAILED') {
+            return result.job;
+        }
+        await delay(Math.min(1_000 + attempt * 250, 5_000), runtime.signal);
+    }
+    throw new CliError('bucket_empty_timeout', 'Timed out waiting for the bucket empty job.', {
+        details: {
+            jobId: target.jobId
+        },
+        suggestions: [
+            `edgestore bucket empty-status ${target.bucket} --job ${target.jobId}`
+        ]
+    });
+}
+function renderEmptyJob(runtime, flags, job) {
+    outputFor(runtime, flags).result({
+        job
+    }, [
+        `Job: ${job.id}`,
+        `Status: ${job.status.toLowerCase()}`,
+        `Phase: ${job.phase.toLowerCase()}`,
+        `Progress: ${job.processedCount}/${job.totalCount}`,
+        `Freed: ${job.freedBytes} bytes`,
+        `Canceled uploads: ${job.canceledUploadCount}`,
+        `Orphan objects: ${job.orphanObjectCount}`,
+        ...job.error ? [
+            `Failure: ${job.error}`
+        ] : []
+    ].join('\n'), job.status.toLowerCase());
+}
+function delay(milliseconds, signal) {
+    return new Promise((resolve, reject)=>{
+        const timeout = setTimeout(resolve, milliseconds);
+        signal.addEventListener('abort', ()=>{
+            clearTimeout(timeout);
+            reject(new CliError('interrupted', 'Operation canceled.', {
+                exitCode: 130
+            }));
+        }, {
+            once: true
+        });
+    });
+}
+
+const topLevel = 'login logout whoami doctor init account member project token bucket file open completion';
+async function completionCommand(runtime, flags, shell) {
+    const script = completionScript(shell);
+    outputFor(runtime, flags).result({
+        shell,
+        script
+    }, script, script);
+}
+function completionScript(shell) {
+    if (shell === 'bash') {
+        return `_edgestore() {
+  local current="\${COMP_WORDS[COMP_CWORD]}"
+  COMPREPLY=( $(compgen -W "${topLevel}" -- "$current") )
+}
+complete -F _edgestore edgestore`;
+    }
+    if (shell === 'zsh') {
+        return `#compdef edgestore
+_arguments '1:command:(${topLevel})' '*::argument:->args'`;
+    }
+    if (shell === 'fish') {
+        return topLevel.split(' ').map((command)=>`complete -c edgestore -n '__fish_use_subcommand' -a '${command}'`).join('\n');
+    }
+    throw usageError('unsupported_shell', `Unsupported shell: ${shell}.`, [
+        'Choose bash, zsh, or fish.'
+    ]);
+}
+
+async function doctorCommand(runtime, flags, version) {
+    const checks = [
+        {
+            name: 'CLI',
+            status: 'pass',
+            detail: version
+        }
+    ];
+    const apiUrl = apiUrlFor(runtime, flags);
+    const globalConfig = await checkGlobalConfig(runtime, checks);
+    const localConfig = await checkLocalConfig(runtime, checks);
+    const envKeys = await checkEnvFile(runtime, checks);
+    const keychainAvailable = await runtime.credentials.available();
+    checks.push({
+        name: 'Credential store',
+        status: keychainAvailable ? 'pass' : 'warn',
+        detail: keychainAvailable ? 'OS credential store module is available' : 'Unavailable; EDGESTORE_TOKEN is still supported'
+    });
+    let credential;
+    try {
+        credential = await resolveCredential(runtime.env.EDGESTORE_TOKEN, runtime.credentials);
+        checks.push({
+            name: 'Credential',
+            status: credential ? 'pass' : 'warn',
+            detail: credential ? credential.source : 'Not configured'
+        });
+    } catch (error) {
+        checks.push({
+            name: 'Credential',
+            status: 'fail',
+            detail: error instanceof Error ? error.message : 'Could not read credential'
+        });
+    }
+    const sdk = runtime.sdkFactory({
+        token: credential?.token ?? 'edgestore-doctor',
+        baseUrl: apiUrl.sdkBaseUrl
+    });
+    try {
+        await sdk.system.health({
+            signal: runtime.signal
+        });
+        checks.push({
+            name: 'API',
+            status: 'pass',
+            detail: apiUrl.displayUrl
+        });
+    } catch (error) {
+        checks.push({
+            name: 'API',
+            status: 'fail',
+            detail: error instanceof Error ? error.message : 'Health check failed'
+        });
+    }
+    if (credential) {
+        let authenticated = false;
+        try {
+            const identity = await sdk.management.whoami({
+                signal: runtime.signal
+            });
+            authenticated = true;
+            const scopeDetail = 'scopes' in identity.actor ? ` (${identity.actor.scopes.join(', ')})` : '';
+            checks.push({
+                name: 'Authentication',
+                status: 'pass',
+                detail: `${identity.actor.kind}${scopeDetail}`
+            });
+        } catch (error) {
+            checks.push({
+                name: 'Authentication',
+                status: 'fail',
+                detail: error instanceof Error ? error.message : 'Validation failed'
+            });
+        }
+        if (authenticated && globalConfig.activeAccount) {
+            try {
+                const account = await sdk.management.accounts.get({
+                    account: globalConfig.activeAccount,
+                    signal: runtime.signal
+                });
+                checks.push({
+                    name: 'Active account',
+                    status: 'pass',
+                    detail: `${account.account.displayName} (${account.account.id})`
+                });
+            } catch (error) {
+                checks.push({
+                    name: 'Active account',
+                    status: 'fail',
+                    detail: error instanceof Error ? error.message : 'Account is inaccessible'
+                });
+            }
+        } else if (authenticated) {
+            checks.push({
+                name: 'Active account',
+                status: 'warn',
+                detail: 'Not selected'
+            });
+        }
+        if (authenticated && localConfig) {
+            try {
+                await checkLinkedProject(runtime, sdk, {
+                    local: localConfig,
+                    envKeys,
+                    checks
+                });
+            } catch (error) {
+                checks.push({
+                    name: 'Linked project',
+                    status: 'fail',
+                    detail: error instanceof Error ? error.message : 'Project is inaccessible'
+                });
+            }
+        }
+    }
+    if (checks.some((check)=>check.status === 'fail')) {
+        runtime.exitCode = 1;
+    }
+    outputFor(runtime, flags).result({
+        checks
+    }, renderTable([
+        'CHECK',
+        'STATUS',
+        'DETAIL'
+    ], checks.map((check)=>[
+            check.name,
+            check.status,
+            check.detail
+        ])));
+}
+async function checkGlobalConfig(runtime, checks) {
+    try {
+        const config = await runtime.globalConfig.read();
+        checks.push({
+            name: 'Global config',
+            status: 'pass',
+            detail: runtime.globalConfig.path
+        });
+        return config;
+    } catch (error) {
+        checks.push({
+            name: 'Global config',
+            status: 'fail',
+            detail: error instanceof Error ? error.message : 'Could not read config'
+        });
+        return {
+            version: 1
+        };
+    }
+}
+async function checkLocalConfig(runtime, checks) {
+    try {
+        const located = await runtime.repoConfig.read();
+        checks.push({
+            name: 'Local config',
+            status: located ? 'pass' : 'warn',
+            detail: located?.path ?? 'No linked project'
+        });
+        return located;
+    } catch (error) {
+        checks.push({
+            name: 'Local config',
+            status: 'fail',
+            detail: error instanceof Error ? error.message : 'Could not read local config'
+        });
+        return undefined;
+    }
+}
+async function checkEnvFile(runtime, checks) {
+    let contents = '';
+    try {
+        contents = await readFile(path.join(runtime.cwd, '.env.local'), 'utf8');
+    } catch (error) {
+        if (error.code !== 'ENOENT') {
+            checks.push({
+                name: '.env.local',
+                status: 'fail',
+                detail: 'Could not read file'
+            });
+        }
+        return {
+            hasSecretKey: false
+        };
+    }
+    const accessKey = envValue(contents, 'EDGE_STORE_ACCESS_KEY');
+    const hasSecretKey = Boolean(envValue(contents, 'EDGE_STORE_SECRET_KEY'));
+    checks.push({
+        name: '.env.local',
+        status: accessKey && hasSecretKey ? 'pass' : 'warn',
+        detail: [
+            `EDGE_STORE_ACCESS_KEY ${accessKey ? 'present' : 'missing'}`,
+            `EDGE_STORE_SECRET_KEY ${hasSecretKey ? 'present' : 'missing'}`
+        ].join(', ')
+    });
+    return {
+        accessKey,
+        hasSecretKey
+    };
+}
+async function checkLinkedProject(runtime, sdk, input) {
+    const { local, envKeys, checks } = input;
+    const result = await sdk.management.projects.get({
+        project: local.config.project,
+        signal: runtime.signal
+    });
+    const belongsToConfiguredAccount = result.project.accountId === local.config.account;
+    checks.push({
+        name: 'Linked project',
+        status: belongsToConfiguredAccount ? 'pass' : 'fail',
+        detail: belongsToConfiguredAccount ? `${result.project.name} (${result.project.basePath})` : `Belongs to ${result.project.accountId}, config says ${local.config.account}`
+    });
+    if (!envKeys.accessKey) return;
+    try {
+        const keys = await sdk.management.projectKeys.list({
+            project: result.project.basePath,
+            signal: runtime.signal
+        });
+        if (keys.keys.some((key)=>key.accessKey === envKeys.accessKey)) return;
+        checks.push({
+            name: 'Environment project',
+            status: 'warn',
+            detail: '.env.local access key is not for the linked project'
+        });
+    } catch  {
+        checks.push({
+            name: 'Environment project',
+            status: 'warn',
+            detail: 'Could not compare .env.local with project key metadata'
+        });
+    }
+}
+function envValue(contents, name) {
+    const match = new RegExp(`^${name}=(.+)$`, 'm').exec(contents);
+    const value = match?.[1]?.trim();
+    return value ? value : undefined;
+}
+
+async function fileListCommand(runtime, flags, input) {
+    if (input.all && input.cursor) {
+        throw usageError('conflicting_pagination', '--all and --cursor cannot be used together.');
+    }
+    const project = await resolvedProjectRef(runtime, input.project);
+    const sdk = await sdkFor(runtime, flags);
+    const files = [];
+    let cursor = input.cursor;
+    let pagination;
+    do {
+        const result = await sdk.management.files.list({
+            project,
+            bucket: input.bucket,
+            limit: input.limit,
+            cursor,
+            signal: runtime.signal
+        });
+        files.push(...result.files);
+        pagination = result.pagination;
+        cursor = result.pagination.nextCursor ?? undefined;
+    }while (input.all && pagination.hasMore && cursor)
+    const rows = files.map((file)=>[
+            file.id,
+            file.key,
+            file.sizeBytes,
+            file.mimeType ?? '',
+            file.uploadedAt
+        ]);
+    const continuation = !input.all && pagination?.nextCursor ? `\n\nNext cursor: ${pagination.nextCursor}` : '';
+    outputFor(runtime, flags).result({
+        files,
+        pagination
+    }, `${rows.length ? renderTable([
+        'ID',
+        'PATH',
+        'BYTES',
+        'TYPE',
+        'UPLOADED'
+    ], rows) : 'No files found.'}${continuation}`);
+}
+async function fileInfoCommand(runtime, flags, input) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.files.lookup({
+        project: await resolvedProjectRef(runtime, input.project),
+        file: fileReference(input.reference, input.bucket),
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, [
+        `ID: ${result.file.id}`,
+        `Bucket: ${result.file.bucketName}`,
+        `Key: ${result.file.key}`,
+        `Path fields: ${JSON.stringify(result.file.path)}`,
+        `Size: ${result.file.sizeBytes} bytes`,
+        `Type: ${result.file.mimeType ?? 'unknown'}`,
+        `URL: ${result.file.url}`,
+        `Uploaded: ${result.file.uploadedAt}`
+    ].join('\n'), result.file.id);
+}
+async function fileDownloadCommand(runtime, flags, input) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.files.generateAccessUrls({
+        project: await resolvedProjectRef(runtime, input.project),
+        files: [
+            fileReference(input.reference, input.bucket)
+        ],
+        signal: runtime.signal
+    });
+    const download = result.accessUrls[0];
+    if (!download) {
+        throw usageError('download_url_missing', 'No download URL was returned.');
+    }
+    const response = await fetch(download.url, {
+        signal: runtime.signal
+    });
+    if (!response.ok) {
+        throw new Error(`Download failed with HTTP ${response.status}.`);
+    }
+    const outputPath = path.resolve(runtime.cwd, input.output);
+    await writeFile(outputPath, Buffer.from(await response.arrayBuffer()), {
+        mode: 0o600
+    });
+    outputFor(runtime, flags).result({
+        output: outputPath,
+        download
+    }, `Downloaded file to ${outputPath}.`, outputPath);
+}
+async function fileDeleteCommand(runtime, flags, input) {
+    if (!input.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'File deletion requires confirmation.', [
+                'Repeat the command with --yes.'
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Type delete to remove ${input.references.length} file(s)`, 'delete');
+    }
+    const project = await resolvedProjectRef(runtime, input.project);
+    const sdk = await sdkFor(runtime, flags);
+    const refs = input.references.map((value)=>fileReference(value, input.bucket));
+    const results = [];
+    for(let index = 0; index < refs.length; index += 100){
+        const result = await sdk.management.files.delete({
+            project,
+            files: refs.slice(index, index + 100),
+            signal: runtime.signal
+        });
+        results.push(...result.results);
+    }
+    const successCount = results.filter((result)=>result.success).length;
+    const failureCount = results.length - successCount;
+    outputFor(runtime, flags).result({
+        results,
+        successCount,
+        failureCount
+    }, `Deleted ${successCount} file(s); ${failureCount} failed.`);
+    if (failureCount) runtime.exitCode = 1;
+}
+function fileReference(value, bucket) {
+    if (/^https?:\/\//i.test(value)) return {
+        url: value
+    };
+    if (bucket) return {
+        bucketName: bucket,
+        path: value
+    };
+    return {
+        id: value
+    };
+}
+
+async function deliverEnvSecret(cwd, values, options) {
+    const text = Object.entries(values).map(([name, value])=>`${name}=${value}`).join('\n');
+    const destinations = [];
+    if (options.copy) {
+        await copyToClipboard(`${text}\n`);
+        destinations.push('Copied to clipboard.');
+    }
+    if (options.output) {
+        const outputPath = path.resolve(cwd, options.output);
+        await writeEnvFile(outputPath, values, Boolean(options.update));
+        destinations.push(`Saved to ${outputPath}.`);
+    }
+    return destinations;
+}
+async function writeEnvFile(filePath, values, update) {
+    let existing = '';
+    try {
+        existing = await readFile(filePath, 'utf8');
+    } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+    }
+    const names = Object.keys(values);
+    const present = names.filter((name)=>new RegExp(`^${escapeRegExp(name)}=`, 'm').test(existing));
+    if (present.length && !update) {
+        throw usageError('secret_output_exists', `${filePath} already contains ${present.join(', ')}.`, [
+            'Pass --update to replace the existing values.'
+        ]);
+    }
+    let next = existing;
+    for (const [name, value] of Object.entries(values)){
+        const line = `${name}=${value}`;
+        const pattern = new RegExp(`^${escapeRegExp(name)}=.*$`, 'm');
+        next = pattern.test(next) ? next.replace(pattern, line) : `${next}${next && !next.endsWith('\n') ? '\n' : ''}${line}\n`;
+    }
+    await writeFile(filePath, next, {
+        mode: 0o600
+    });
+    await chmod(filePath, 0o600);
+}
+async function copyToClipboard(value) {
+    const candidates = process.platform === 'darwin' ? [
+        [
+            'pbcopy'
+        ]
+    ] : process.platform === 'win32' ? [
+        [
+            'clip'
+        ]
+    ] : [
+        [
+            'wl-copy'
+        ],
+        [
+            'xclip',
+            '-selection',
+            'clipboard'
+        ]
+    ];
+    for (const [command, ...args] of candidates){
+        if (!command) continue;
+        const copied = await runClipboard(command, args, value);
+        if (copied) return;
+    }
+    throw new CliError('clipboard_unavailable', 'No supported clipboard command is available.');
+}
+function runClipboard(command, args, value) {
+    return new Promise((resolve, reject)=>{
+        const child = spawn(command, args, {
+            stdio: [
+                'pipe',
+                'ignore',
+                'ignore'
+            ]
+        });
+        child.on('error', (error)=>{
+            if (error.code === 'ENOENT') resolve(false);
+            else reject(error);
+        });
+        child.on('exit', (code)=>{
+            resolve(code === 0);
+        });
+        child.stdin.end(value);
+    });
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+async function initCommand(runtime, flags, options) {
+    const interactive = runtime.io.inputIsTty && !flags.json && !flags.plain;
+    validateOptions(options, interactive);
+    const sdk = await sdkFor(runtime, flags);
+    const account = await resolveAccount({
+        runtime,
+        sdk,
+        options,
+        interactive
+    });
+    const context = {
+        runtime,
+        sdk,
+        options,
+        interactive,
+        account
+    };
+    const mode = await resolveMode(runtime, options, interactive);
+    const projectResult = mode === 'new' ? await createProject(context) : await selectProject(context);
+    const createKey = await shouldCreateKey(context, mode);
+    const keyResult = projectResult.projectKey ?? (createKey ? await sdk.management.projectKeys.create({
+        project: projectResult.project.basePath,
+        name: 'local',
+        signal: runtime.signal
+    }) : undefined);
+    const output = keyResult ? options.output ?? '.env.local' : undefined;
+    if (keyResult && output) {
+        await deliverEnvSecret(runtime.cwd, {
+            EDGE_STORE_ACCESS_KEY: keyResult.key.accessKey,
+            EDGE_STORE_SECRET_KEY: keyResult.secretKey
+        }, {
+            output,
+            update: options.update
+        });
+        await ignoreSecretFile(runtime.cwd, output);
+    }
+    const bucketChoice = await resolveBucket(runtime, options, interactive);
+    const bucket = bucketChoice ? (await sdk.management.buckets.create({
+        project: projectResult.project.basePath,
+        name: bucketChoice.name,
+        type: bucketChoice.type,
+        visibility: bucketChoice.visibility,
+        signal: runtime.signal
+    })).bucket : undefined;
+    const packages = await detectPackages(runtime.cwd);
+    const install = await installPackages(runtime, packages, {
+        requested: options.install,
+        interactive,
+        recoveryProject: projectResult.project.basePath
+    });
+    const configPath = await runtime.repoConfig.write({
+        account: projectResult.project.accountId,
+        project: projectResult.project.basePath
+    });
+    const human = [
+        `Linked ${projectResult.project.name} (${projectResult.project.basePath}).`,
+        `Config: ${configPath}`,
+        ...output ? [
+            `Secrets: ${path.resolve(runtime.cwd, output)}`
+        ] : [],
+        ...bucket ? [
+            `Bucket: ${bucket.name}`
+        ] : [],
+        ...install.command && !install.ran ? [
+            '',
+            'Install packages:',
+            `  ${install.command}`
+        ] : [],
+        '',
+        ...nextSteps(packages.framework)
+    ].join('\n');
+    outputFor(runtime, flags).result({
+        project: projectResult.project,
+        key: keyResult?.key,
+        bucket,
+        configPath,
+        output,
+        install,
+        framework: packages.framework
+    }, human, projectResult.project.basePath);
+}
+function validateOptions(options, interactive) {
+    if (options.new && options.link) {
+        throw usageError('conflicting_init_mode', 'Choose either --new or --link.');
+    }
+    if (options.createKey && options.withoutKey) {
+        throw usageError('conflicting_key_options', 'Choose either --create-key or --without-key.');
+    }
+    if (options.output && options.withoutKey) {
+        throw usageError('conflicting_key_output', '--output cannot be used with --without-key.');
+    }
+    if (options.public && options.protected) {
+        throw usageError('conflicting_bucket_visibility', 'Choose either --public or --protected.');
+    }
+    if ([
+        options.bucketType,
+        options.public,
+        options.protected
+    ].some(Boolean) && !options.bucket) {
+        throw usageError('bucket_name_required', '--bucket is required with bucket options.');
+    }
+    if (!options.bucket) return;
+    validateBucketName(options.bucket);
+    if (options.bucketType) parseBucketType(options.bucketType);
+    if (!interactive) {
+        parseBucketType(options.bucketType);
+        if (![
+            options.public,
+            options.protected
+        ].some(Boolean)) {
+            throw usageError('bucket_visibility_required', 'Choose --public or --protected when using --bucket.');
+        }
+    }
+}
+async function resolveAccount(context) {
+    const { runtime, sdk, options, interactive } = context;
+    if (options.account) return options.account;
+    try {
+        return await activeAccount(runtime);
+    } catch (error) {
+        if (!interactive) throw error;
+    }
+    const result = await sdk.management.accounts.list({
+        signal: runtime.signal
+    });
+    if (!result.accounts.length) {
+        throw usageError('account_not_found', 'No accessible accounts found.');
+    }
+    const selected = await runtime.prompts.select('Which account should own this project?', result.accounts.map((account)=>({
+            value: account.id,
+            label: account.displayName,
+            hint: account.type.toLowerCase()
+        })));
+    const config = await runtime.globalConfig.read();
+    await runtime.globalConfig.write({
+        ...config,
+        activeAccount: selected
+    });
+    return selected;
+}
+async function resolveMode(runtime, options, interactive) {
+    if (options.new) return 'new';
+    if (options.link) return 'link';
+    requireInteractive(interactive, 'Choose --new or --link <basePath>.');
+    return runtime.prompts.select('What do you want to do?', [
+        {
+            value: 'new',
+            label: 'Create a new project'
+        },
+        {
+            value: 'link',
+            label: 'Link an existing project'
+        }
+    ]);
+}
+async function createProject(context) {
+    const { runtime, sdk, options, interactive, account } = context;
+    const name = options.name ?? await promptText(runtime, {
+        interactive,
+        message: 'Project name',
+        placeholder: path.basename(runtime.cwd)
+    });
+    return sdk.management.projects.create({
+        account,
+        name,
+        createKey: !options.withoutKey,
+        allowOverage: Boolean(options.allowOverage),
+        signal: runtime.signal
+    });
+}
+async function selectProject(context) {
+    const { runtime, sdk, options, interactive, account } = context;
+    let projectRef = options.link;
+    if (!projectRef) {
+        requireInteractive(interactive, '--link requires a project base path.');
+        const listed = await sdk.management.projects.list({
+            account,
+            signal: runtime.signal
+        });
+        if (!listed.projects.length) {
+            throw usageError('project_not_found', 'No projects are available in this account.', [
+                'edgestore init --new --name <name>'
+            ]);
+        }
+        projectRef = await runtime.prompts.select('Which project do you want to link?', listed.projects.map((project)=>({
+                value: project.basePath,
+                label: project.name,
+                hint: project.basePath
+            })));
+    }
+    const result = await sdk.management.projects.get({
+        project: projectRef,
+        signal: runtime.signal
+    });
+    if (result.project.accountId !== account) {
+        throw usageError('project_account_mismatch', `Project ${result.project.basePath} does not belong to account ${account}.`);
+    }
+    return {
+        project: result.project,
+        projectKey: undefined
+    };
+}
+async function shouldCreateKey(context, mode) {
+    const { runtime, options, interactive } = context;
+    if (options.withoutKey) return false;
+    if ([
+        mode === 'new',
+        options.createKey,
+        options.output
+    ].some(Boolean)) {
+        return true;
+    }
+    return interactive ? runtime.prompts.confirm('Create a new project key?', false) : false;
+}
+async function resolveBucket(runtime, options, interactive) {
+    let name = options.bucket;
+    if (!name) {
+        if (!interactive || !await runtime.prompts.confirm('Create a bucket now?')) {
+            return undefined;
+        }
+        name = await runtime.prompts.text('Bucket name', 'publicFiles');
+    }
+    validateBucketName(name);
+    const type = parseBucketType(options.bucketType ?? (interactive ? await runtime.prompts.select('Bucket type', [
+        {
+            value: 'file',
+            label: 'File'
+        },
+        {
+            value: 'image',
+            label: 'Image'
+        }
+    ]) : undefined));
+    const visibility = [
+        options.public,
+        options.protected
+    ].some(Boolean) ? options.public ? 'public' : 'protected' : interactive ? await runtime.prompts.select('Visibility', [
+        {
+            value: 'public',
+            label: 'Public'
+        },
+        {
+            value: 'protected',
+            label: 'Protected'
+        }
+    ]) : undefined;
+    if (!visibility) {
+        throw usageError('bucket_visibility_required', 'Choose --public or --protected when using --bucket.');
+    }
+    return {
+        name,
+        type,
+        visibility
+    };
+}
+async function detectPackages(cwd) {
+    const packagePath = path.join(cwd, 'package.json');
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(packagePath, 'utf8'));
+    } catch  {
+        return {
+            framework: 'unknown',
+            missing: []
+        };
+    }
+    const dependencies = {
+        ...manifest.dependencies,
+        ...manifest.devDependencies
+    };
+    const framework = dependencies.next ? 'next' : dependencies.react ? 'react' : 'node';
+    const wanted = framework === 'next' || framework === 'react' ? [
+        '@edgestore/server',
+        '@edgestore/react',
+        'zod'
+    ] : [
+        '@edgestore/server',
+        'zod'
+    ];
+    return {
+        framework,
+        manager: managerFromField(manifest.packageManager) ?? await detectManager(cwd),
+        missing: wanted.filter((name)=>!dependencies[name])
+    };
+}
+async function installPackages(runtime, plan, options) {
+    if (!plan.manager || !plan.missing.length) return {
+        ran: false
+    };
+    const args = installArgs(plan.manager, plan.missing);
+    const command = [
+        plan.manager,
+        ...args
+    ].join(' ');
+    const shouldInstall = options.requested ?? (options.interactive ? await runtime.prompts.confirm(`Install EdgeStore packages with ${plan.manager}?`, true) : false);
+    if (!shouldInstall) return {
+        command,
+        ran: false
+    };
+    try {
+        await runtime.runCommand(plan.manager, args);
+    } catch (error) {
+        throw new CliError('package_install_failed', error instanceof Error ? error.message : 'Package installation failed.', {
+            suggestions: [
+                command,
+                `edgestore project link ${options.recoveryProject}`
+            ]
+        });
+    }
+    return {
+        command,
+        ran: true
+    };
+}
+async function ignoreSecretFile(cwd, output) {
+    const absolute = path.resolve(cwd, output);
+    const relative = path.relative(cwd, absolute);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) return;
+    const gitignorePath = path.join(cwd, '.gitignore');
+    let contents = '';
+    try {
+        contents = await readFile(gitignorePath, 'utf8');
+    } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+    }
+    const entry = relative.replaceAll(path.sep, '/');
+    if (contents.split(/\r?\n/).map((line)=>line.trim()).includes(entry)) {
+        return;
+    }
+    await writeFile(gitignorePath, `${contents}${contents ? contents.endsWith('\n') ? '' : '\n' : ''}${entry}\n`);
+}
+function parseBucketType(value) {
+    if (value === 'file' || value === 'image') return value;
+    throw usageError('bucket_type_required', 'Choose --bucket-type file or --bucket-type image.');
+}
+function validateBucketName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$/.test(name)) {
+        throw usageError('invalid_bucket_name', 'Bucket names must begin with a letter or number and contain only letters, numbers, underscores, or hyphens.');
+    }
+}
+function managerFromField(value) {
+    const manager = value?.split('@')[0];
+    return manager === 'pnpm' || manager === 'npm' || manager === 'yarn' || manager === 'bun' ? manager : undefined;
+}
+async function detectManager(cwd) {
+    for (const [file, manager] of [
+        [
+            'pnpm-lock.yaml',
+            'pnpm'
+        ],
+        [
+            'yarn.lock',
+            'yarn'
+        ],
+        [
+            'bun.lock',
+            'bun'
+        ],
+        [
+            'bun.lockb',
+            'bun'
+        ],
+        [
+            'package-lock.json',
+            'npm'
+        ]
+    ]){
+        try {
+            await access(path.join(cwd, file));
+            return manager;
+        } catch  {
+        // Keep checking known lockfiles.
+        }
+    }
+    return 'npm';
+}
+function installArgs(manager, packages) {
+    if (manager === 'npm') return [
+        'install',
+        ...packages
+    ];
+    return [
+        'add',
+        ...packages
+    ];
+}
+async function promptText(runtime, input) {
+    requireInteractive(input.interactive, '--name is required with --new.');
+    return runtime.prompts.text(input.message, input.placeholder);
+}
+function requireInteractive(interactive, message) {
+    if (!interactive) {
+        throw usageError('interactive_input_required', message);
+    }
+}
+function nextSteps(framework) {
+    if (framework === 'next') {
+        return [
+            'Next steps:',
+            '  Configure an EdgeStore router in your Next.js app.',
+            '  Add the EdgeStore provider to your client layout.'
+        ];
+    }
+    if (framework === 'react') {
+        return [
+            'Next steps:',
+            '  Configure an EdgeStore server endpoint.',
+            '  Add the EdgeStore provider to your React app.'
+        ];
+    }
+    return [
+        'Next steps:',
+        '  Configure an EdgeStore router and server endpoint.'
+    ];
+}
+
+async function memberListCommand(runtime, flags, options) {
+    const account = await teamAccount(runtime, flags);
+    if (!account) return;
+    const sdk = await sdkFor(runtime, flags);
+    const members = [];
+    const pageSize = options.limit ?? 50;
+    let page = options.page ?? 1;
+    do {
+        const result = await sdk.management.members.list({
+            account: account.id,
+            page,
+            pageSize,
+            signal: runtime.signal
+        });
+        members.push(...result.members);
+        if (!options.all || result.members.length < pageSize) break;
+        page += 1;
+    }while (true)
+    outputFor(runtime, flags).result({
+        members
+    }, members.length ? renderTable([
+        'USER ID',
+        'EMAIL',
+        'ROLE',
+        'JOINED'
+    ], members.map((member)=>[
+            member.userId,
+            member.email,
+            member.role.toLowerCase(),
+            member.createdAt
+        ])) : 'No members found.');
+}
+async function memberInviteCommand(runtime, flags, input) {
+    const account = await requireTeamAccount(runtime, flags);
+    const role = parseRole(input.role);
+    if (role === 'OWNER') {
+        await runtime.prompts.confirmTyped('Owners can manage billing, projects, keys, and members. Type owner to confirm', 'owner');
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const results = [];
+    for (const email of input.emails){
+        try {
+            const result = await sdk.management.invitations.create({
+                account: account.id,
+                email,
+                role,
+                allowOverage: Boolean(input.allowOverage),
+                signal: runtime.signal
+            });
+            results.push({
+                email,
+                success: true,
+                invitation: result.invitation
+            });
+        } catch (error) {
+            results.push({
+                email,
+                success: false,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    outputFor(runtime, flags).result({
+        results
+    }, renderTable([
+        'EMAIL',
+        'STATUS'
+    ], results.map((result)=>[
+            result.email,
+            result.success ? 'invited' : `failed: ${result.error}`
+        ])));
+    if (results.some((result)=>!result.success)) runtime.exitCode = 1;
+}
+async function memberRoleCommand(runtime, flags, input) {
+    const account = await requireTeamAccount(runtime, flags);
+    const role = parseRole(input.role);
+    if (role === 'OWNER') {
+        await runtime.prompts.confirmTyped('Owners can manage billing, projects, keys, and members. Type owner to confirm', 'owner');
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.members.update({
+        account: account.id,
+        userId: input.userId,
+        role,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Updated ${result.member.email} to ${result.member.role.toLowerCase()}.`, result.member.role.toLowerCase());
+}
+async function memberRemoveCommand(runtime, flags, input) {
+    const account = await requireTeamAccount(runtime, flags);
+    await confirmDestructive(runtime, flags, {
+        expected: input.userId,
+        yes: input.yes
+    });
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.members.remove({
+        account: account.id,
+        userId: input.userId,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Removed member ${input.userId}.`, input.userId);
+}
+async function invitationListCommand(runtime, flags, options) {
+    const account = await teamAccount(runtime, flags);
+    if (!account) return;
+    const sdk = await sdkFor(runtime, flags);
+    const invitations = [];
+    const pageSize = options.limit ?? 50;
+    let page = options.page ?? 1;
+    do {
+        const result = await sdk.management.invitations.list({
+            account: account.id,
+            page,
+            pageSize,
+            signal: runtime.signal
+        });
+        invitations.push(...result.invitations);
+        if (!options.all || result.invitations.length < pageSize) break;
+        page += 1;
+    }while (true)
+    outputFor(runtime, flags).result({
+        invitations
+    }, invitations.length ? renderTable([
+        'ID',
+        'EMAIL',
+        'ROLE',
+        'STATUS'
+    ], invitations.map((invitation)=>[
+            invitation.id,
+            invitation.email,
+            invitation.role.toLowerCase(),
+            invitation.status.toLowerCase()
+        ])) : 'No pending invitations found.');
+}
+async function invitationActionCommand(runtime, flags, input) {
+    const account = await requireTeamAccount(runtime, flags);
+    if (input.action === 'revoke') {
+        await confirmDestructive(runtime, flags, {
+            expected: input.invitationId,
+            yes: input.yes
+        });
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = input.action === 'revoke' ? await sdk.management.invitations.revoke({
+        account: account.id,
+        invitationId: input.invitationId,
+        signal: runtime.signal
+    }) : await sdk.management.invitations.resend({
+        account: account.id,
+        invitationId: input.invitationId,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `${input.action === 'revoke' ? 'Revoked' : 'Resent'} invitation ${input.invitationId}.`, input.invitationId);
+}
+async function teamAccount(runtime, flags) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.accounts.get({
+        account: await activeAccount(runtime),
+        signal: runtime.signal
+    });
+    if (result.account.type === 'PERSONAL') {
+        outputFor(runtime, flags).result({
+            membersAvailable: false,
+            account: result.account
+        }, 'Current account is personal.\nMembers are only available for team accounts.');
+        return undefined;
+    }
+    return result.account;
+}
+async function requireTeamAccount(runtime, flags) {
+    const account = await teamAccount(runtime, flags);
+    if (!account) {
+        throw usageError('team_account_required', 'This command requires a team account.');
+    }
+    return account;
+}
+function parseRole(value) {
+    const role = value.toUpperCase();
+    if (role === 'OWNER' || role === 'MEMBER' || role === 'VIEWER') return role;
+    throw usageError('invalid_member_role', `Unsupported member role: ${value}.`);
+}
+async function confirmDestructive(runtime, flags, input) {
+    if (input.yes) return;
+    if (!runtime.io.inputIsTty || flags.json) {
+        throw usageError('confirmation_required', 'This operation requires --yes.');
+    }
+    await runtime.prompts.confirmTyped(`Type ${input.expected} to confirm`, input.expected);
+}
+
+async function openCommand(runtime, flags, input) {
+    const target = parseTarget(input.target);
+    const project = target === 'project' || target === 'keys' ? await resolvedProjectRef(runtime, input.project) : undefined;
+    const url = dashboardUrl(runtime, target, project);
+    if (!flags.json && !flags.plain) {
+        await runtime.openUrl(url);
+    }
+    outputFor(runtime, flags).result({
+        target: target ?? 'dashboard',
+        project,
+        url
+    }, `Opened ${url}`, url);
+}
+function parseTarget(value) {
+    if (!value) return undefined;
+    if (value === 'account' || value === 'billing' || value === 'keys' || value === 'project') {
+        return value;
+    }
+    throw usageError('invalid_open_target', `Unsupported dashboard target: ${value}.`, [
+        'Choose account, billing, project, or keys.'
+    ]);
+}
+function dashboardUrl(runtime, target, project) {
+    const base = (runtime.env.EDGESTORE_DASHBOARD_URL ?? 'https://dashboard.edgestore.dev').replace(/\/+$/, '');
+    if (!target) return base;
+    if (target === 'account') return `${base}/settings`;
+    if (target === 'billing') return `${base}/settings/billing`;
+    return `${base}/projects/${encodeURIComponent(project ?? '')}`;
+}
+
+async function projectKeyListCommand(runtime, flags, project) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.projectKeys.list({
+        project,
+        signal: runtime.signal
+    });
+    const rows = result.keys.map((key)=>[
+            key.id,
+            key.name,
+            key.accessKey,
+            key.revokedAt ? 'revoked' : 'active',
+            key.createdAt
+        ]);
+    outputFor(runtime, flags).result(result, rows.length ? renderTable([
+        'ID',
+        'NAME',
+        'ACCESS KEY',
+        'STATUS',
+        'CREATED'
+    ], rows) : 'No project keys found.');
+}
+async function projectKeyCreateCommand(runtime, flags, input) {
+    const result = await createKey(runtime, flags, input);
+    const values = keyValues(result.key.accessKey, result.secretKey);
+    const delivered = await deliverEnvSecret(runtime.cwd, values, input);
+    outputFor(runtime, flags).result(result, [
+        `Created project key "${result.key.name}".`,
+        ...delivered.length ? [
+            '',
+            ...delivered
+        ] : [
+            '',
+            ...envLines(values)
+        ],
+        '',
+        'Save this secret now. You will not be able to view it again.'
+    ].join('\n'), result.key.id);
+}
+async function projectKeyRevokeCommand(runtime, flags, input) {
+    const sdk = await sdkFor(runtime, flags);
+    const listed = await sdk.management.projectKeys.list({
+        project: input.project,
+        signal: runtime.signal
+    });
+    const key = listed.keys.find((item)=>item.id === input.keyId);
+    if (!input.yes) {
+        requireInteractiveConfirmation(runtime, flags, [
+            `edgestore project key revoke ${input.project} ${input.keyId} --yes`
+        ]);
+        const activeCount = listed.keys.filter((item)=>!item.revokedAt).length;
+        const warning = key && !key.revokedAt && activeCount === 1 ? ' This is the last active key and runtime access will stop.' : '';
+        await runtime.prompts.confirmTyped(`Revoke project key ${input.keyId}?${warning} Type ${input.keyId} to confirm`, input.keyId);
+    }
+    const result = await sdk.management.projectKeys.revoke({
+        project: input.project,
+        keyId: input.keyId,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Revoked project key ${input.keyId}.`, input.keyId);
+}
+async function projectKeyRotateCommand(runtime, flags, input) {
+    if (!input.yes) {
+        requireInteractiveConfirmation(runtime, flags, [
+            `edgestore project key rotate ${input.project} ${input.keyId} --name ${input.name} --output .env.local --yes`
+        ]);
+    } else if (!input.copy && !input.output) {
+        throw usageError('secret_delivery_required', 'Non-interactive rotation requires --copy or --output.');
+    }
+    const result = await createKey(runtime, flags, input);
+    const values = keyValues(result.key.accessKey, result.secretKey);
+    const delivered = await deliverEnvSecret(runtime.cwd, values, input);
+    const output = outputFor(runtime, flags);
+    const secretMessage = [
+        `Created replacement key "${result.key.name}".`,
+        ...delivered.length ? [
+            '',
+            ...delivered
+        ] : [
+            '',
+            ...envLines(values)
+        ],
+        '',
+        'Save this secret now. You will not be able to view it again.'
+    ].join('\n');
+    if (!input.yes) {
+        output.message(secretMessage);
+        await runtime.prompts.confirmTyped(`Type saved to revoke ${input.keyId}`, 'saved');
+    }
+    const sdk = await sdkFor(runtime, flags);
+    await sdk.management.projectKeys.revoke({
+        project: input.project,
+        keyId: input.keyId,
+        signal: runtime.signal
+    });
+    output.result({
+        replacement: result,
+        revokedKeyId: input.keyId
+    }, input.yes ? [
+        secretMessage,
+        '',
+        `Revoked old project key ${input.keyId}.`
+    ].join('\n') : `Revoked old project key ${input.keyId}.`, result.key.id);
+}
+async function createKey(runtime, flags, input) {
+    const sdk = await sdkFor(runtime, flags);
+    return sdk.management.projectKeys.create({
+        project: input.project,
+        name: input.name,
+        signal: runtime.signal
+    });
+}
+function keyValues(accessKey, secretKey) {
+    return {
+        EDGE_STORE_ACCESS_KEY: accessKey,
+        EDGE_STORE_SECRET_KEY: secretKey
+    };
+}
+function envLines(values) {
+    return Object.entries(values).map(([name, value])=>`${name}=${value}`);
+}
+function requireInteractiveConfirmation(runtime, flags, suggestions) {
+    if (!runtime.io.inputIsTty || flags.json) {
+        throw usageError('confirmation_required', 'This operation requires confirmation.', suggestions);
+    }
+}
+
+const tokenScopes = [
+    'account:read',
+    'project:read',
+    'project:create',
+    'project:delete',
+    'bucket:read',
+    'bucket:write',
+    'file:read',
+    'file:write',
+    'project-key:read',
+    'project-key:create',
+    'project-key:revoke',
+    'member:read',
+    'member:write',
+    'token:read',
+    'token:create',
+    'token:revoke'
+];
+async function tokenListCommand(runtime, flags, options) {
+    const sdk = await sdkFor(runtime, flags);
+    const pageSize = options.limit ?? 50;
+    const account = options.user ? undefined : await activeAccount(runtime, options.account);
+    const tokens = [];
+    let page = options.page ?? 1;
+    do {
+        const result = options.user ? await sdk.management.tokens.listUser({
+            page,
+            pageSize,
+            signal: runtime.signal
+        }) : await sdk.management.tokens.listAccount({
+            account: account,
+            page,
+            pageSize,
+            signal: runtime.signal
+        });
+        tokens.push(...result.tokens);
+        if (!options.all || result.tokens.length < pageSize) break;
+        page += 1;
+    }while (true)
+    const rows = tokens.map((token)=>[
+            token.id,
+            token.name,
+            token.kind.toLowerCase(),
+            token.scopes.join(','),
+            token.lastUsedAt ?? 'never',
+            token.revokedAt ? 'revoked' : 'active'
+        ]);
+    outputFor(runtime, flags).result({
+        tokens
+    }, rows.length ? renderTable([
+        'ID',
+        'NAME',
+        'TYPE',
+        'SCOPES',
+        'LAST USED',
+        'STATUS'
+    ], rows) : 'No management tokens found.');
+}
+async function tokenCreateCommand(runtime, flags, options) {
+    if (options.preset && options.scope?.length) {
+        throw usageError('conflicting_token_permissions', '--preset and --scope cannot be used together.');
+    }
+    if (!options.preset && !options.scope?.length) {
+        throw usageError('token_permissions_required', 'Token creation requires --preset or at least one --scope.');
+    }
+    const scopes = options.scope?.map(validateScope);
+    const sdk = await sdkFor(runtime, flags);
+    const body = {
+        name: options.name,
+        preset: options.preset,
+        scopes,
+        expiresAt: options.expiresAt,
+        signal: runtime.signal
+    };
+    const result = options.user ? await sdk.management.tokens.createUser(body) : await sdk.management.tokens.createAccount({
+        account: await activeAccount(runtime, options.account),
+        ...body
+    });
+    const delivered = await deliverEnvSecret(runtime.cwd, {
+        EDGESTORE_TOKEN: result.secret
+    }, options);
+    outputFor(runtime, flags).result(result, [
+        `Created ${result.token.kind.toLowerCase()} token "${result.token.name}".`,
+        ...delivered.length ? [
+            '',
+            ...delivered
+        ] : [
+            '',
+            `EDGESTORE_TOKEN=${result.secret}`
+        ],
+        '',
+        'Save this token now. You will not be able to view it again.'
+    ].join('\n'), result.token.id);
+}
+async function tokenRevokeCommand(runtime, flags, input) {
+    if (!input.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'Token revocation requires confirmation.', [
+                `edgestore token revoke ${input.tokenId} --yes`
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Type ${input.tokenId} to revoke this token`, input.tokenId);
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.tokens.revoke({
+        tokenId: input.tokenId,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Revoked management token ${input.tokenId}.`, input.tokenId);
+}
+function validateScope(value) {
+    if (tokenScopes.includes(value)) {
+        return value;
+    }
+    throw usageError('invalid_token_scope', `Unsupported token scope: ${value}.`);
+}
+
+async function fileUploadCommand(runtime, flags, input) {
+    const localFiles = await expandFiles(runtime.cwd, input.paths);
+    if (!localFiles.length) {
+        throw usageError('upload_files_missing', 'No matching files were found.');
+    }
+    if (input.path) validateRemotePath(input.path);
+    if (localFiles.length > 1 && input.path && !input.path.endsWith('/')) {
+        throw usageError('upload_path_not_prefix', '--path must end in / when uploading multiple files.');
+    }
+    const project = await resolvedProjectRef(runtime, input.project);
+    const sdk = await sdkFor(runtime, flags);
+    const results = [];
+    for (const localFile of localFiles){
+        const fileStat = await stat(localFile);
+        const large = fileStat.size >= DEFAULT_MULTIPART_THRESHOLD_BYTES;
+        const fileName = path.basename(localFile);
+        const destination = input.path && localFiles.length > 1 ? `${input.path}${fileName}` : input.path;
+        const partCount = large ? Math.ceil(fileStat.size / DEFAULT_MULTIPART_PART_SIZE_BYTES) : 0;
+        const requested = await sdk.management.uploads.request({
+            project,
+            bucket: input.bucket,
+            ...input.keepName ? {
+                fileName
+            } : {},
+            ...destination ? {
+                path: destination
+            } : {},
+            mimeType: mimeTypeFor(fileName),
+            sizeBytes: fileStat.size,
+            ...large ? {
+                multipart: {
+                    partNumbers: Array.from({
+                        length: partCount
+                    }, (_, index)=>index + 1)
+                }
+            } : {},
+            signal: runtime.signal
+        });
+        let transferring = true;
+        try {
+            if (requested.upload.kind === 'single') {
+                await putPart(requested.upload.signedUrl, await readFile(localFile), runtime.signal);
+                transferring = false;
+            } else {
+                const handle = await open(localFile, 'r');
+                const completedParts = [];
+                try {
+                    for (const part of requested.upload.parts){
+                        const offset = (part.partNumber - 1) * DEFAULT_MULTIPART_PART_SIZE_BYTES;
+                        const size = Math.min(DEFAULT_MULTIPART_PART_SIZE_BYTES, fileStat.size - offset);
+                        const buffer = Buffer.allocUnsafe(size);
+                        await handle.read(buffer, 0, size, offset);
+                        const etag = await putPart(part.signedUrl, buffer, runtime.signal);
+                        completedParts.push({
+                            partNumber: part.partNumber,
+                            eTag: etag
+                        });
+                        reportProgress(runtime, flags, {
+                            fileName,
+                            percentage: Math.round(completedParts.length / partCount * 100)
+                        });
+                    }
+                } finally{
+                    await handle.close();
+                }
+                await sdk.management.uploads.completeMultipart({
+                    project,
+                    uploadId: requested.upload.id,
+                    parts: completedParts,
+                    signal: runtime.signal
+                });
+                transferring = false;
+            }
+            const completed = await waitForUpload(runtime, flags, {
+                project,
+                uploadId: requested.upload.id
+            });
+            results.push({
+                localPath: localFile,
+                ...completed,
+                signedReadUrl: requested.signedReadUrl
+            });
+        } catch (error) {
+            if (transferring) {
+                await sdk.management.uploads.cancel({
+                    project,
+                    uploadId: requested.upload.id,
+                    signal: runtime.signal
+                }).catch(()=>undefined);
+            }
+            throw error;
+        }
+    }
+    const human = results.map((result)=>{
+        const readUrl = result.signedReadUrl?.signedUrl ?? result.file.url;
+        return `${path.basename(result.localPath)} -> ${readUrl} (${result.file.id})`;
+    }).join('\n');
+    outputFor(runtime, flags).result({
+        uploads: results
+    }, human);
+}
+async function putPart(url, body, signal) {
+    const response = await fetch(url, {
+        method: 'PUT',
+        body: new Uint8Array(body),
+        signal
+    });
+    if (!response.ok) {
+        throw new CliError('upload_transfer_failed', `Storage upload failed with HTTP ${response.status}.`);
+    }
+    return response.headers.get('etag') ?? '';
+}
+async function waitForUpload(runtime, flags, target) {
+    const sdk = await sdkFor(runtime, flags);
+    for(let attempt = 0; attempt < 60; attempt += 1){
+        const result = await sdk.management.uploads.get({
+            project: target.project,
+            uploadId: target.uploadId,
+            signal: runtime.signal
+        });
+        if (result.upload.status === 'completed' && 'file' in result) return result;
+        if (result.upload.status === 'canceled') {
+            throw new CliError('upload_canceled', `Upload ${target.uploadId} was canceled.`);
+        }
+        await new Promise((resolve)=>setTimeout(resolve, 1_000));
+    }
+    throw new CliError('upload_processing_timeout', `Timed out waiting for upload ${target.uploadId}.`, {
+        suggestions: [
+            `edgestore file upload-status ${target.uploadId}`
+        ]
+    });
+}
+function reportProgress(runtime, flags, progress) {
+    if (flags.progress && !flags.json && runtime.io.outputIsTty) {
+        runtime.io.stderr.write(`${progress.fileName}: uploading ${progress.percentage}%\n`);
+    }
+}
+async function fileUploadStatusCommand(runtime, flags, input) {
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.uploads.get({
+        project: await resolvedProjectRef(runtime, input.project),
+        uploadId: input.uploadId,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, 'file' in result ? `Upload ${input.uploadId}: completed\nURL: ${result.file.url}` : `Upload ${input.uploadId}: ${result.upload.status}`, result.upload.status);
+}
+async function fileUploadCancelCommand(runtime, flags, input) {
+    if (!input.yes) {
+        if (!runtime.io.inputIsTty || flags.json) {
+            throw usageError('confirmation_required', 'Upload cancellation requires confirmation.', [
+                `edgestore file upload-cancel ${input.uploadId} --yes`
+            ]);
+        }
+        await runtime.prompts.confirmTyped(`Type ${input.uploadId} to cancel this upload`, input.uploadId);
+    }
+    const sdk = await sdkFor(runtime, flags);
+    const result = await sdk.management.uploads.cancel({
+        project: await resolvedProjectRef(runtime, input.project),
+        uploadId: input.uploadId,
+        signal: runtime.signal
+    });
+    outputFor(runtime, flags).result(result, `Upload ${input.uploadId}: ${result.upload.status}`, result.upload.status);
+}
+async function expandFiles(cwd, patterns) {
+    const files = new Set();
+    for (const pattern of patterns){
+        for await (const match of glob(pattern, {
+            cwd
+        })){
+            const absolute = path.resolve(cwd, match);
+            if ((await stat(absolute)).isFile()) files.add(absolute);
+        }
+    }
+    return [
+        ...files
+    ];
+}
+function validateRemotePath(value) {
+    if (value.startsWith('/') || value.split('/').includes('..') || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw usageError('invalid_upload_path', 'The upload path is unsafe.');
+    }
+}
+function mimeTypeFor(fileName) {
+    const extension = path.extname(fileName).toLowerCase();
+    return ({
+        '.gif': 'image/gif',
+        '.jpeg': 'image/jpeg',
+        '.jpg': 'image/jpeg',
+        '.json': 'application/json',
+        '.pdf': 'application/pdf',
+        '.png': 'image/png',
+        '.svg': 'image/svg+xml',
+        '.txt': 'text/plain',
+        '.webp': 'image/webp'
+    })[extension];
+}
+
+async function runCli(argv, runtime, version) {
+    const program = createProgram(runtime, version);
+    if (argv.length === 0) {
+        program.outputHelp();
+        return 0;
+    }
+    try {
+        await program.parseAsync(argv, {
+            from: 'user'
+        });
+        return runtime.signal.aborted ? 130 : runtime.exitCode;
+    } catch (error) {
+        if (error instanceof CommanderError) {
+            return error.code === 'commander.helpDisplayed' || error.code === 'commander.version' ? 0 : 2;
+        }
+        const normalized = normalizeError(error);
+        safeOutput(runtime, program).error(normalized);
+        return runtime.signal.aborted ? 130 : normalized.exitCode;
+    }
+}
+function createProgram(runtime, version) {
+    const program = new Command().name('edgestore').description('Manage EdgeStore accounts and projects').version(version).option('--json', 'emit structured JSON').option('--plain', 'emit a single plain-text value').option('--api-url <url>', 'override the EdgeStore API URL').option('--no-color', 'disable color output').option('--no-progress', 'disable progress output').showHelpAfterError().exitOverride().configureOutput({
+        writeOut: (value)=>runtime.io.stdout.write(value),
+        writeErr: (value)=>runtime.io.stderr.write(value)
+    }).addHelpText('after', `
+Common workflows:
+  edgestore login --token
+  edgestore init
+  edgestore project list
+  edgestore file upload ./logo.png --bucket publicImages
+  edgestore project key rotate x36t1ejdlz key_123 --output .env.local --update
+`);
+    program.hook('preAction', ()=>{
+        outputFor(runtime, globalFlags(program));
+    });
+    program.command('login').description('Log in with a management credential').option('--token', 'read and securely store a management token').action(async (options)=>{
+        await loginCommand(runtime, globalFlags(program), options);
+    });
+    program.command('logout').description('Remove the stored login').action(async ()=>{
+        await logoutCommand(runtime, globalFlags(program));
+    });
+    program.command('whoami').description('Show the current identity and context').action(async ()=>{
+        await whoamiCommand(runtime, globalFlags(program));
+    });
+    program.command('doctor').description('Check local configuration and API connectivity').action(async ()=>{
+        await doctorCommand(runtime, globalFlags(program), version);
+    });
+    program.command('init').description('Configure EdgeStore for the current project').option('--new', 'create a new project').option('--link <project>', 'link an existing project').option('--name <name>', 'new project name').option('--account <account-id>', 'override the active account').option('--create-key', 'create a new local project key').option('--without-key', 'do not create a project key').option('--output <file>', 'write project keys to an env file').option('--update', 'replace existing values in the output file').option('--bucket <bucket>', 'create a bucket').option('--bucket-type <type>', 'bucket type: file or image').option('--public', 'make the new bucket public').option('--protected', 'make the new bucket protected').option('--install', 'install detected EdgeStore packages').option('--allow-overage', 'allow billable project overage').addHelpText('after', `
+Examples:
+  edgestore init --new --name "Marketing Site" --output .env.local
+  edgestore init --link x36t1ejdlz
+  edgestore init --link x36t1ejdlz --create-key --output .env.local
+`).action(async (options)=>{
+        await initCommand(runtime, globalFlags(program), options);
+    });
+    program.command('open [target] [project]').description('Open the EdgeStore dashboard').addHelpText('after', `
+Targets:
+  account
+  billing
+  project [basePath]
+  keys [basePath]
+`).action(async (target, project)=>{
+        await openCommand(runtime, globalFlags(program), {
+            target,
+            project
+        });
+    });
+    program.command('completion <shell>').description('Print shell completion for bash, zsh, or fish').action(async (shell)=>{
+        await completionCommand(runtime, globalFlags(program), shell);
+    });
+    const account = program.command('account').description('Manage account context');
+    account.command('list').alias('ls').description('List accessible accounts').action(async ()=>{
+        await accountListCommand(runtime, globalFlags(program));
+    });
+    account.command('usage').description('Show account usage and limits').action(async ()=>{
+        await accountUsageCommand(runtime, globalFlags(program));
+    });
+    account.command('billing').description('Show billing plan and limits').action(async ()=>{
+        await accountBillingCommand(runtime, globalFlags(program));
+    });
+    account.command('leave').description('Leave the active team account').option('--yes', 'skip interactive confirmation').action(async (options)=>{
+        await accountLeaveCommand(runtime, globalFlags(program), options);
+    });
+    account.command('current').description('Show the active account').action(async ()=>{
+        await accountCurrentCommand(runtime, globalFlags(program));
+    });
+    account.command('switch <account-id>').alias('use').description('Set the active account').action(async (accountId)=>{
+        await accountSwitchCommand(runtime, globalFlags(program), accountId);
+    });
+    const project = program.command('project').description('Inspect and link projects');
+    const member = program.command('member').description('Manage team members');
+    member.command('list').alias('ls').description('List team members').option('--page <number>', 'page number', parsePositiveInteger).option('--limit <number>', 'page size', parsePositiveInteger).option('--all', 'fetch every page').action(async (options)=>{
+        await memberListCommand(runtime, globalFlags(program), options);
+    });
+    member.command('invite <email...>').description('Invite one or more team members').option('--role <role>', 'owner, member, or viewer', 'member').option('--allow-overage', 'allow billable member overage').action(async (emails, options)=>{
+        await memberInviteCommand(runtime, globalFlags(program), {
+            emails,
+            ...options
+        });
+    });
+    member.command('role <user-id> <role>').description('Change a team member role').action(async (userId, role)=>{
+        await memberRoleCommand(runtime, globalFlags(program), {
+            userId,
+            role
+        });
+    });
+    member.command('remove <user-id>').description('Remove a team member').option('--yes', 'skip interactive confirmation').action(async (userId, options)=>{
+        await memberRemoveCommand(runtime, globalFlags(program), {
+            userId,
+            ...options
+        });
+    });
+    const invitation = member.command('invitation').description('Manage pending invitations');
+    invitation.command('list').alias('ls').description('List pending invitations').option('--page <number>', 'page number', parsePositiveInteger).option('--limit <number>', 'page size', parsePositiveInteger).option('--all', 'fetch every page').action(async (options)=>{
+        await invitationListCommand(runtime, globalFlags(program), options);
+    });
+    invitation.command('revoke <invite-id>').description('Revoke a pending invitation').option('--yes', 'skip interactive confirmation').action(async (invitationId, options)=>{
+        await invitationActionCommand(runtime, globalFlags(program), {
+            invitationId,
+            action: 'revoke',
+            ...options
+        });
+    });
+    invitation.command('resend <invite-id>').description('Resend a pending invitation').action(async (invitationId)=>{
+        await invitationActionCommand(runtime, globalFlags(program), {
+            invitationId,
+            action: 'resend'
+        });
+    });
+    project.command('list').alias('ls').description('List projects in an account').option('--account <account-id>', 'override the active account').action(async (options)=>{
+        await projectListCommand(runtime, globalFlags(program), options);
+    });
+    project.command('current').description('Show the locally linked project').action(async ()=>{
+        await projectCurrentCommand(runtime, globalFlags(program));
+    });
+    project.command('show [project]').description('Show a project by base path or ID').action(async (projectRef)=>{
+        await projectShowCommand(runtime, globalFlags(program), projectRef);
+    });
+    project.command('create').description('Create a project').requiredOption('--name <name>', 'project name').option('--account <account-id>', 'override the active account').option('--without-key', 'create the project without an initial key').option('--allow-overage', 'allow billable project overage').action(async (options)=>{
+        await projectCreateCommand(runtime, globalFlags(program), options);
+    });
+    project.command('delete <project>').alias('rm').description('Delete a project').option('--yes', 'skip interactive confirmation').action(async (projectRef, options)=>{
+        await projectDeleteCommand(runtime, globalFlags(program), {
+            project: projectRef,
+            ...options
+        });
+    });
+    project.command('link <project>').description('Link this repository to a project base path or ID').action(async (projectRef)=>{
+        await projectLinkCommand(runtime, globalFlags(program), projectRef);
+    });
+    project.command('unlink').description('Remove the local project link').action(async ()=>{
+        await projectUnlinkCommand(runtime, globalFlags(program));
+    });
+    const projectKey = project.command('key').description('Manage project keys');
+    projectKey.command('list <project>').alias('ls').description('List project key metadata').action(async (projectRef)=>{
+        await projectKeyListCommand(runtime, globalFlags(program), projectRef);
+    });
+    projectKey.command('create <project>').description('Create a named project key').requiredOption('--name <name>', 'key name').option('--copy', 'copy the key pair to the clipboard').option('--output <file>', 'write the key pair to an env file').option('--update', 'replace existing key values in the output file').addHelpText('after', `
+The secret is shown only once.
+
+Examples:
+  edgestore project key create x36t1ejdlz --name production
+  edgestore project key create x36t1ejdlz --name ci --copy
+  edgestore project key create x36t1ejdlz --name local --output .env.local
+`).action(async (projectRef, options)=>{
+        await projectKeyCreateCommand(runtime, globalFlags(program), {
+            project: projectRef,
+            ...options
+        });
+    });
+    projectKey.command('revoke <project> <key-id>').description('Revoke a project key').option('--yes', 'skip interactive confirmation').action(async (projectRef, keyId, options)=>{
+        await projectKeyRevokeCommand(runtime, globalFlags(program), {
+            project: projectRef,
+            keyId,
+            ...options
+        });
+    });
+    projectKey.command('rotate <project> <key-id>').description('Create a replacement key and revoke the old key').requiredOption('--name <name>', 'replacement key name').option('--copy', 'copy the replacement key pair to the clipboard').option('--output <file>', 'write the replacement key pair to an env file').option('--update', 'replace existing key values in the output file').option('--yes', 'confirm non-interactive rotation').action(async (projectRef, keyId, options)=>{
+        await projectKeyRotateCommand(runtime, globalFlags(program), {
+            project: projectRef,
+            keyId,
+            ...options
+        });
+    });
+    const token = program.command('token').description('Manage account and user management tokens');
+    token.command('list').alias('ls').description('List management token metadata').option('--user', 'list user-owned tokens').option('--account <account-id>', 'override the active account').option('--page <number>', 'page number', parsePositiveInteger).option('--limit <number>', 'page size', parsePositiveInteger).option('--all', 'fetch every page').action(async (options)=>{
+        await tokenListCommand(runtime, globalFlags(program), options);
+    });
+    token.command('create').description('Create a management token').requiredOption('--name <name>', 'token name').option('--user', 'create a user-owned token').option('--account <account-id>', 'override the active account').option('--preset <preset>', 'permission preset: deploy, read-only, or full-access').option('--scope <scope>', 'explicit permission scope', collectValue, []).option('--expires-at <timestamp>', 'ISO 8601 expiration timestamp').option('--copy', 'copy the token to the clipboard').option('--output <file>', 'write the token to an env file').option('--update', 'replace an existing token in the output file').action(async (options)=>{
+        await tokenCreateCommand(runtime, globalFlags(program), options);
+    });
+    token.command('revoke <token-id>').description('Revoke a management token').option('--yes', 'skip interactive confirmation').action(async (tokenId, options)=>{
+        await tokenRevokeCommand(runtime, globalFlags(program), {
+            tokenId,
+            ...options
+        });
+    });
+    const bucket = program.command('bucket').description('Manage project buckets');
+    bucket.command('list').alias('ls').description('List buckets in a project').option('--project <project>', 'override the linked project').action(async (options)=>{
+        await bucketListCommand(runtime, globalFlags(program), options.project);
+    });
+    const file = program.command('file').description('Manage project files');
+    file.command('list').alias('ls').description('List files in one bucket').requiredOption('--bucket <bucket>', 'bucket name').option('--project <project>', 'override the linked project').option('--limit <number>', 'page size', parsePositiveInteger).option('--cursor <cursor>', 'opaque continuation cursor').option('--all', 'fetch every page').action(async (options)=>{
+        await fileListCommand(runtime, globalFlags(program), options);
+    });
+    file.command('info <file>').description('Show file metadata').option('--project <project>', 'override the linked project').option('--bucket <bucket>', 'treat the file argument as a bucket path').action(async (reference, options)=>{
+        await fileInfoCommand(runtime, globalFlags(program), {
+            reference,
+            ...options
+        });
+    });
+    file.command('download <file>').description('Download a file').requiredOption('--output <path>', 'local output path').option('--project <project>', 'override the linked project').option('--bucket <bucket>', 'treat the file argument as a bucket path').action(async (reference, options)=>{
+        await fileDownloadCommand(runtime, globalFlags(program), {
+            reference,
+            ...options
+        });
+    });
+    file.command('delete <file...>').alias('rm').description('Delete one or more files').option('--project <project>', 'override the linked project').option('--bucket <bucket>', 'treat file arguments as bucket paths').option('--yes', 'skip interactive confirmation').action(async (references, options)=>{
+        await fileDeleteCommand(runtime, globalFlags(program), {
+            references,
+            ...options
+        });
+    });
+    file.command('upload <path...>').description('Upload one or more local files').requiredOption('--bucket <bucket>', 'existing bucket name').option('--project <project>', 'override the linked project').option('--path <path>', 'destination path or prefix').option('--keep-name', 'preserve original file names').action(async (paths, options)=>{
+        await fileUploadCommand(runtime, globalFlags(program), {
+            paths,
+            ...options
+        });
+    });
+    file.command('upload-status <upload-id>').description('Show upload processing status').option('--project <project>', 'override the linked project').action(async (uploadId, options)=>{
+        await fileUploadStatusCommand(runtime, globalFlags(program), {
+            uploadId,
+            ...options
+        });
+    });
+    file.command('upload-cancel <upload-id>').description('Cancel an incomplete upload').option('--project <project>', 'override the linked project').option('--yes', 'skip interactive confirmation').action(async (uploadId, options)=>{
+        await fileUploadCancelCommand(runtime, globalFlags(program), {
+            uploadId,
+            ...options
+        });
+    });
+    bucket.command('show <bucket>').description('Show bucket details').option('--project <project>', 'override the linked project').action(async (bucketName, options)=>{
+        await bucketShowCommand(runtime, globalFlags(program), {
+            bucket: bucketName,
+            ...options
+        });
+    });
+    bucket.command('create <bucket>').description('Create a bucket').requiredOption('--type <type>', 'bucket type: file or image').option('--project <project>', 'override the linked project').option('--public', 'allow public reads').option('--protected', 'require signed reads').action(async (bucketName, options)=>{
+        await bucketCreateCommand(runtime, globalFlags(program), {
+            bucket: bucketName,
+            ...options
+        });
+    });
+    bucket.command('delete <bucket>').alias('rm').description('Delete an empty bucket').option('--project <project>', 'override the linked project').option('--yes', 'skip interactive confirmation').action(async (bucketName, options)=>{
+        await bucketDeleteCommand(runtime, globalFlags(program), {
+            bucket: bucketName,
+            ...options
+        });
+    });
+    bucket.command('empty <bucket>').description('Asynchronously delete every file in a bucket').option('--project <project>', 'override the linked project').option('--retry <job-id>', 'retry the latest failed job').option('--wait', 'wait for the job to finish').option('--yes', 'skip interactive confirmation').action(async (bucketName, options)=>{
+        await bucketEmptyCommand(runtime, globalFlags(program), {
+            bucket: bucketName,
+            ...options
+        });
+    });
+    bucket.command('empty-status <bucket>').description('Show empty-bucket job status').option('--project <project>', 'override the linked project').option('--job <job-id>', 'inspect a specific job').action(async (bucketName, options)=>{
+        await bucketEmptyStatusCommand(runtime, globalFlags(program), {
+            bucket: bucketName,
+            ...options
+        });
+    });
+    return program;
+}
+function collectValue(value, previous) {
+    return [
+        ...previous,
+        value
+    ];
+}
+function parsePositiveInteger(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new CommanderError(2, 'invalid_number', 'Expected a positive integer.');
+    }
+    return parsed;
+}
+function globalFlags(program) {
+    const options = program.opts();
+    return {
+        json: options.json,
+        plain: options.plain,
+        apiUrl: options.apiUrl,
+        color: options.color,
+        progress: options.progress
+    };
+}
+function safeOutput(runtime, program) {
+    try {
+        return outputFor(runtime, globalFlags(program));
+    } catch  {
+        return outputFor(runtime, {
+            color: globalFlags(program).color,
+            progress: globalFlags(program).progress
+        });
+    }
+}
+
+const require$1 = createRequire(import.meta.url);
+const packageJson = require$1('../package.json');
+const abortController = new AbortController();
+let interruptCount = 0;
+const onInterrupt = ()=>{
+    interruptCount += 1;
+    if (interruptCount === 1) {
+        abortController.abort();
+        return;
+    }
+    process.exit(130);
+};
+process.on('SIGINT', onInterrupt);
+try {
+    process.exitCode = await runCli(process.argv.slice(2), createDefaultRuntime(abortController.signal), packageJson.version);
+} finally{
+    process.off('SIGINT', onInterrupt);
+}