@epilot/cli 0.1.193 → 0.1.195

package/README.md

@@ -29,7 +29,7 @@ npm install -g @epilot/cli
 
 <!-- usage-help -->
 ```
-epilot v0.1.193 — CLI for epilot APIs
+epilot v0.1.195 — CLI for epilot APIs
 
 USAGE
   epilot <api> <operationId> [params...] [flags]
@@ -60,6 +60,13 @@ COMMANDS
   profile                 Manage named profiles
   completion              Generate shell completion scripts
 
+AGENT MODE (optional)
+  auth login --agent      Register this CLI as an Agent Auth agent (org switching, silent token refresh, scoped access profiles)
+  org list                List your organizations and this CLI's access
+  org use <id>            Switch the active organization
+  org request <id>        Request access (--access <profile> --reason "…")
+  org current             Show the active organization
+
 APIs
   access-token         Access Token API
   address              Address API
@@ -123,6 +130,8 @@ EXAMPLES
   $ epilot entity searchEntities -d '{"q":"*"}'
   $ epilot entity searchEntities --jsonata 'results[0]._title'
   $ echo '{"q":"*"}' | epilot entity searchEntities
+  $ epilot auth login --agent --org 739224   # agent mode (optional)
+  $ epilot org request 739224 --access config:write --reason "Fix the PV journey mapping"
 
 Run epilot <api> to list available operations.
 Run epilot <api> <operationId> --help for operation details.
@@ -158,6 +167,82 @@ Token resolution order:
 4. Stored credentials (`~/.config/epilot/credentials.json`)
 5. Interactive prompt (if TTY)
 
+### Agent mode (optional)
+
+`epilot auth login --agent` registers the CLI through the
+[Agent Auth Protocol](https://agentauthprotocol.com/specification/v1.0-draft) (via
+[`@epilot/agent-auth`](../agent-auth)): your machine is a **host**, the CLI is an **agent** you approve once in the
+browser, and short-lived epilot tokens are issued per organization and refreshed silently. In return you get
+organization switching, scoped **access profiles** and sessions that outlive a single token. Plain logins are not
+affected: a profile without an agent behaves exactly as before.
+
+```bash
+# Register the CLI as an agent and approve it in the browser (read access, your login organization)
+epilot auth login --agent
+
+# A specific organization, an access profile and the purpose shown to the approving user
+epilot auth login --agent --org 739224 --access config:write --reason "Fix the PV registration journey mapping"
+
+# Non-interactive (CI / agents): requires --org; prints the approval URL and polls until approved
+epilot auth login --agent --org 739224 --no-interactive --json
+
+# Status shows the agent, its grants (profile, expiry, reason); logout revokes the agent
+epilot auth status
+epilot auth logout
+```
+
+Access profiles scope what the issued tokens may do. `read` is the default and lives as long as the agent; every
+other profile is an escalation that requires a `--reason` (10–200 characters, prompted for in a TTY) and expires.
+The flag is `--access` because `--profile` already selects a [named CLI profile](#profiles):
+
+| `--access` | Meaning | Read-only | Expires after |
+| --- | --- | --- | --- |
+| `read` | Read everything you can see | yes | never (agent lifetime) |
+| `config:read` | Read configuration (journeys, automations, workflows, schemas, portals, designs) | yes | 7 days |
+| `config:write` | Change configuration | no | 24 hours |
+| `data:read` | Read business data (contacts, opportunities, orders, files, messages) | yes | 7 days |
+| `data:write` | Change business data | no | 24 hours |
+| `full` | Everything your account can do | no | 24 hours |
+
+Anonymization is a read-only property: `--anonymize` (and `org request` without `--full-pii`) only applies to read
+profiles. Combining `--anonymize` with a write profile is an error ("anonymize is only available with read
+profiles"), because an agent must never write masked data back. `--readonly` with a write profile downgrades it to
+its read sibling (`config:write` → `config:read`, `full` → `read`). On the approval page the user can only narrow what
+the CLI asked for; the CLI then issues tokens for the profile that was actually granted.
+
+#### Organizations
+
+One approval grants access to one organization. Switching or adding organizations goes through `epilot org`
+(agent mode only — without an agent the commands exit 1 with "This profile has no agent identity. Run
+`epilot auth login --agent` first.", or `{"error":"agent_required"}` with `--json`):
+
+```bash
+epilot org list                 # organizations with access (profile, anonymized, "expires in 23h", pending)
+epilot org current              # the active organization and its profile
+epilot org use 911210           # switch: issues a token under the most permissive grant (asks for access otherwise)
+epilot org use 911210 --access data:read            # ...or under a specific granted profile
+epilot org request 911210       # ask for read, anonymized access (approved in the browser)
+epilot org request 911210 --full-pii                # read access with unmasked personal data
+epilot org request 911210 --access data:write --reason "Import meter readings from the portal export"
+epilot org request 911210 --access full --reason "…" --no-interactive --json   # prints the approval, exits 0 (pending)
+```
+
+`--write` is a deprecated alias for `--access full`. Write profiles always get full personal data (`--full-pii` is
+implied). After an approval that happened outside the CLI (e.g. from a `--no-interactive` request),
+`epilot org use <id>` completes the switch; `auth status` lists every grant with its profile, expiry and reason.
+
+#### Silent refresh
+
+Issued tokens are short-lived. Whenever a command runs and the stored token of an agent-mode profile is missing or
+expires within two minutes, the CLI issues a fresh one through the agent (same organization and profile) and stores
+it — you stay logged in for as long as the agent and its grant are active. If the agent was revoked or expired, run
+`epilot auth login --agent` again. A plain `epilot auth login` (or `--token`) on the same profile revokes that
+profile's agent, so plain tokens are never replaced.
+
+Local state lives in `~/.config/epilot/agent-auth/` (`host.json` for the machine key, `agents/<profile>.json` for
+the per-profile agent; both mode 0600). `EPILOT_AGENT_AUTH_ISSUER` overrides the Agent Auth server URL (defaults per
+stage: `--use-dev`, `--use-staging`).
+
 ## Profiles
 
 Manage multiple environments, similar to AWS CLI profiles:
@@ -383,6 +468,9 @@ Full documentation with sample calls and responses for all APIs:
 # Install dependencies
 pnpm install
 
+# Build the workspace dependency once (bundled into the CLI by tsup; also needed by tests and `pnpm dev`)
+pnpm --filter @epilot/agent-auth build
+
 # Generate API commands + definitions + docs from client specs
 pnpm generate
 

package/definitions/pricing.json

@@ -3946,7 +3946,7 @@
             }
           },
           "400": {
-            "description": "`VARIANT_UNPINNED`, `CONDITION_UNDEFINED`, `CONDITION_VALUE_INVALID`,\n`PIN_FORMAT_INVALID`, `DEFAULT_MARKER_RESERVED`, `DEFAULT_VARIANT_PINS_CONDITIONS`,\n`VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `IDENTIFIER_INVALID`, `ENTITY_TYPE_MISMATCH`.\n",
+            "description": "`VARIANT_UNPINNED`, `CONDITION_UNDEFINED`, `CONDITION_VALUE_INVALID`,\n`PIN_FORMAT_INVALID`, `DEFAULT_MARKER_RESERVED`, `DEFAULT_VARIANT_PINS_CONDITIONS`,\n`VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `OVERRIDE_VALUE_INVALID`, `IDENTIFIER_INVALID`,\n`ENTITY_TYPE_MISMATCH`.\n",
             "content": {
               "application/json": {
                 "schema": {
@@ -4487,7 +4487,7 @@
             }
           },
           "400": {
-            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `IDENTIFIER_INVALID`,\n`ENTITY_TYPE_MISMATCH`.\n",
+            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `OVERRIDE_VALUE_INVALID`,\n`IDENTIFIER_INVALID`, `ENTITY_TYPE_MISMATCH`.\n",
             "content": {
               "application/json": {
                 "schema": {
@@ -4589,7 +4589,7 @@
             }
           },
           "400": {
-            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `IDENTIFIER_INVALID`,\n`ENTITY_TYPE_MISMATCH`.\n",
+            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `OVERRIDE_VALUE_INVALID`,\n`IDENTIFIER_INVALID`, `ENTITY_TYPE_MISMATCH`.\n",
             "content": {
               "application/json": {
                 "schema": {
@@ -4963,7 +4963,7 @@
             }
           },
           "400": {
-            "description": "`VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `IDENTIFIER_INVALID`, `ENTITY_TYPE_MISMATCH`.",
+            "description": "`VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `OVERRIDE_VALUE_INVALID`, `IDENTIFIER_INVALID`,\n`ENTITY_TYPE_MISMATCH`.\n",
             "content": {
               "application/json": {
                 "schema": {
@@ -5179,7 +5179,7 @@
             }
           },
           "400": {
-            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `IDENTIFIER_INVALID`,\n`ENTITY_TYPE_MISMATCH`.\n",
+            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `OVERRIDE_VALUE_INVALID`,\n`IDENTIFIER_INVALID`, `ENTITY_TYPE_MISMATCH`.\n",
             "content": {
               "application/json": {
                 "schema": {
@@ -5291,7 +5291,7 @@
             }
           },
           "400": {
-            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `IDENTIFIER_INVALID`,\n`ENTITY_TYPE_MISMATCH`.\n",
+            "description": "`VALID_FROM_IMMUTABLE`, `VALID_FROM_INVALID`, `VALUE_UNSTORABLE`, `OVERRIDE_VALUE_INVALID`,\n`IDENTIFIER_INVALID`, `ENTITY_TYPE_MISMATCH`.\n",
             "content": {
               "application/json": {
                 "schema": {
@@ -6017,7 +6017,7 @@
       },
       "ConditionalPricingErrorCode": {
         "type": "string",
-        "description": "Machine-readable failure mode of a conditional-pricing operation, so a client can branch on\nthe kind of failure instead of parsing the message. A `400` is about the request; a `409` is\nabout what is already stored. Refusals raised by request validation carry no `code` at all.\n\n- `SCHEMA_NOT_FOUND` (404): no conditional entity type by that slug\n- `ENTITY_NOT_FOUND` (404): the schema holds no entity with that id\n- `ENTITY_TYPE_MISMATCH` (400): that id belongs to an entity of another type than the slug named\n- `ENTITY_NOT_CONDITIONAL` (409): the entity is of the right type but was not created as a conditional one\n- `VARIANT_NOT_FOUND` (404): the entity has no such variant\n- `VERSION_NOT_FOUND` (404): the variant has no version at that `valid_from`\n- `NO_MATCHES` (404): nothing applied to the context and the entity has no `default` variant\n- `NO_ACTIVE_VERSION` (404): the variant has no version in effect at the instant asked about\n- `AMBIGUOUS_RESOLUTION` (409): several variants match the given context while a single result was requested\n- `TUPLE_CONFLICT` (409): the condition tuple is already claimed by another variant\n- `VERSION_CONFLICT` (409): a version already exists at the given `valid_from` on that variant\n- `CONDITION_UNDEFINED` (400): the request names a condition the entity's schema does not define\n- `VARIANT_PIN_UNDECLARED` (409): a variant a resolve would compose pins a condition the entity's schema no longer declares\n- `OPERATOR_UNSUPPORTED` (400): the requested predicate, or a sort, is not applicable to the condition's type\n- `CONTEXT_FORMAT_INVALID` (400): a resolve context or listing filter value is malformed for its condition type\n- `CONDITION_VALUE_INVALID` (400): a variant write pins a `select` value absent from the condition's declared `options`\n- `CONDITION_UNCONFIGURED` (409): a variant write pins a `select` condition whose `options` are absent or empty\n- `TOO_MANY_MATCHES` (400): a multi-match resolve exceeded its result cap\n- `WRITE_CONFLICT` (409): transient write contention, retryable unlike `TUPLE_CONFLICT`\n- `OFFSET_WINDOW_EXCEEDED` (400): a listing's `from` plus `size` reaches past the offset window the search index allows\n- `CURSOR_INVALID` (400): a paging cursor cannot be read, or does not belong to the read it was sent with\n- `VARIANT_LIMIT_REACHED` (409): the entity already holds every variant it may hold\n- `PIN_FORMAT_INVALID` (400): a variant pins a value malformed for its condition's type\n- `VARIANT_UNPINNED` (400): a variant write pins no condition and is not marked `default`, or a batch delete item addresses no variant\n- `LAST_VERSION_UNDELETABLE` (409): the delete would leave the variant with no version at all\n- `CONDITION_UNREADABLE` (409): the entity's schema declares a condition in a way this deploy cannot read\n- `SORT_INVALID` (400): a listing's `sort` is not `conditions.<name>:asc` or `conditions.<name>:desc`\n- `DEFAULT_MARKER_RESERVED` (400): a variant write's pins, or a resolve context, address the fallback marker — `default` or `_default`\n- `DEFAULT_VARIANT_PINS_CONDITIONS` (400): a variant marked `default` also pins real conditions\n- `VALID_FROM_IMMUTABLE` (400): a version write asks for a different `valid_from` than the version its own address names\n- `VARIANT_CONDITIONS_IMMUTABLE` (409): a version write carries a condition tuple other than the one its variant was created with\n- `IDENTIFIER_INVALID` (400): an id in the request cannot be used as a storage key — empty, carrying an unsupported character, or longer than 128 characters\n- `VALID_FROM_INVALID` (400): a `valid_from` is not one of the timestamp forms a version timeline can be sorted by\n- `VALUE_UNSTORABLE` (400): a write carries a value the store cannot hold, such as a non-finite number or one outside the table's numeric range\n- `CONDITIONAL_PRICING_NOT_ENABLED` (403): the organization has not opted in to Conditional Pricing\n- `CONDITIONAL_PRICING_NOT_READY` (409): the organization opted in minutes ago and a variant cannot be created until its setup finishes\n",
+        "description": "Machine-readable failure mode of a conditional-pricing operation, so a client can branch on\nthe kind of failure instead of parsing the message. A `400` is about the request; a `409` is\nabout what is already stored. Refusals raised by request validation carry no `code` at all.\n\n- `SCHEMA_NOT_FOUND` (404): no conditional entity type by that slug\n- `ENTITY_NOT_FOUND` (404): the schema holds no entity with that id\n- `ENTITY_TYPE_MISMATCH` (400): that id belongs to an entity of another type than the slug named\n- `ENTITY_NOT_CONDITIONAL` (409): the entity is of the right type but was not created as a conditional one\n- `VARIANT_NOT_FOUND` (404): the entity has no such variant\n- `VERSION_NOT_FOUND` (404): the variant has no version at that `valid_from`\n- `NO_MATCHES` (404): nothing applied to the context and the entity has no `default` variant\n- `NO_ACTIVE_VERSION` (404): the variant has no version in effect at the instant asked about\n- `AMBIGUOUS_RESOLUTION` (409): several variants match the given context while a single result was requested\n- `TUPLE_CONFLICT` (409): the condition tuple is already claimed by another variant\n- `VERSION_CONFLICT` (409): a version already exists at the given `valid_from` on that variant\n- `CONDITION_UNDEFINED` (400): the request names a condition the entity's schema does not define\n- `VARIANT_PIN_UNDECLARED` (409): a variant a resolve would compose pins a condition the entity's schema no longer declares\n- `OPERATOR_UNSUPPORTED` (400): the requested predicate, or a sort, is not applicable to the condition's type\n- `CONTEXT_FORMAT_INVALID` (400): a resolve context or listing filter value is malformed for its condition type\n- `CONDITION_VALUE_INVALID` (400): a variant write pins a `select` value absent from the condition's declared `options`\n- `CONDITION_UNCONFIGURED` (409): a variant write pins a `select` condition whose `options` are absent or empty\n- `TOO_MANY_MATCHES` (400): a multi-match resolve exceeded its result cap\n- `WRITE_CONFLICT` (409): transient write contention, retryable unlike `TUPLE_CONFLICT`\n- `OFFSET_WINDOW_EXCEEDED` (400): a listing's `from` plus `size` reaches past the offset window the search index allows\n- `CURSOR_INVALID` (400): a paging cursor cannot be read, or does not belong to the read it was sent with\n- `VARIANT_LIMIT_REACHED` (409): the entity already holds every variant it may hold\n- `PIN_FORMAT_INVALID` (400): a variant pins a value malformed for its condition's type\n- `VARIANT_UNPINNED` (400): a variant write pins no condition and is not marked `default`, or a batch delete item addresses no variant\n- `LAST_VERSION_UNDELETABLE` (409): the delete would leave the variant with no version at all\n- `CONDITION_UNREADABLE` (409): the entity's schema declares a condition in a way this deploy cannot read\n- `SORT_INVALID` (400): a listing's `sort` is not `conditions.<name>:asc` or `conditions.<name>:desc`\n- `DEFAULT_MARKER_RESERVED` (400): a variant write's pins, or a resolve context, address the fallback marker — `default` or `_default`\n- `DEFAULT_VARIANT_PINS_CONDITIONS` (400): a variant marked `default` also pins real conditions\n- `VALID_FROM_IMMUTABLE` (400): a version write asks for a different `valid_from` than the version its own address names\n- `VARIANT_CONDITIONS_IMMUTABLE` (409): a version write carries a condition tuple other than the one its variant was created with\n- `IDENTIFIER_INVALID` (400): an id in the request cannot be used as a storage key — empty, carrying an unsupported character, or longer than 128 characters\n- `VALID_FROM_INVALID` (400): a `valid_from` is not one of the timestamp forms a version timeline can be sorted by\n- `VALUE_UNSTORABLE` (400): a write carries a value the store cannot hold, such as a non-finite number or one outside the table's numeric range\n- `OVERRIDE_VALUE_INVALID` (400): a write overrides a `currency` or `number` field, or an amount/decimal pair, with a value of the wrong type\n- `CONDITIONAL_PRICING_NOT_ENABLED` (403): the organization has not opted in to Conditional Pricing\n- `CONDITIONAL_PRICING_NOT_READY` (409): the organization opted in minutes ago and a variant cannot be created until its setup finishes\n",
         "enum": [
           "SCHEMA_NOT_FOUND",
           "ENTITY_NOT_FOUND",
@@ -6053,6 +6053,7 @@
           "IDENTIFIER_INVALID",
           "VALID_FROM_INVALID",
           "VALUE_UNSTORABLE",
+          "OVERRIDE_VALUE_INVALID",
           "CONDITIONAL_PRICING_NOT_ENABLED",
           "CONDITIONAL_PRICING_NOT_READY"
         ]
@@ -8987,6 +8988,42 @@
                   }
                 }
               },
+              {
+                "type": "object",
+                "description": "An override whose value is not of the type its field holds. A field declared by a\n`currency` attribute `x` takes `x` as a number, `x_decimal` as a non-empty string and\n`x_currency` as one of the attribute's currency codes, in any case. A field declared\nby a `number` attribute takes a string, or a number where the attribute sets\n`data_type: number`. A field a capability manages that neither attribute type\ndeclares, such as `tiers`, is checked at any depth by the amount/decimal convention:\na key `K_decimal` is a non-empty string, and a `K` beside it is a number. No other\nvalue is checked, and a decimal string is not parsed.\n",
+                "required": [
+                  "code",
+                  "details"
+                ],
+                "properties": {
+                  "code": {
+                    "type": "string",
+                    "enum": [
+                      "OVERRIDE_VALUE_INVALID"
+                    ]
+                  },
+                  "details": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                      "path",
+                      "expected"
+                    ],
+                    "properties": {
+                      "path": {
+                        "type": "string",
+                        "description": "Where the value sits, as a dotted path of the request's own keys, with array\nentries by index.\n",
+                        "example": "values.tiers.0.unit_amount_decimal"
+                      },
+                      "expected": {
+                        "type": "string",
+                        "description": "What the value has to be, in prose.",
+                        "example": "a non-empty string"
+                      }
+                    }
+                  }
+                }
+              },
               {
                 "type": "object",
                 "description": "The organization has not opted in to Conditional Pricing. Opting in is done once, by\nepilot, from the organization's settings; nothing in this API enables it.\n",

package/dist/{access-token-CMXAXZ3R.js → access-token-Q2UGZIMP.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-CMVLVDYF.js";
+} from "./chunk-36I64456.js";
+import "./chunk-BYNI3AGG.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/access-token.ts

package/dist/{add-component-KJLVM44N.js → add-component-USRY2DQG.js}

@@ -3,10 +3,10 @@ import {
   log,
   readManifest,
   writeManifest
-} from "./chunk-7TLX5QRJ.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+} from "./chunk-5DFIPWJS.js";
+import "./chunk-BYNI3AGG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/app/add-component.ts

package/dist/{add-function-ODBHPWP6.js → add-function-RZTEKVSB.js}

@@ -4,10 +4,10 @@ import {
   readManifest,
   validateScheduleExpression,
   writeManifest
-} from "./chunk-7TLX5QRJ.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+} from "./chunk-5DFIPWJS.js";
+import "./chunk-BYNI3AGG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/app/add-function.ts

package/dist/{address-556I5SBF.js → address-AX4UT6BO.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-CMVLVDYF.js";
+} from "./chunk-36I64456.js";
+import "./chunk-BYNI3AGG.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/address.ts

package/dist/{address-suggestions-5KHWKGNW.js → address-suggestions-GMVIIZY6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-CMVLVDYF.js";
+} from "./chunk-36I64456.js";
+import "./chunk-BYNI3AGG.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/address-suggestions.ts

package/dist/agent-auth-A2D2R6FP.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+import {
+  REFRESH_WINDOW_MS,
+  agentPath,
+  agentProfileKey,
+  deleteAgentRecord,
+  ensureHostKey,
+  forgetAgentForProfile,
+  formatExpiresIn,
+  getAgentAuthClient,
+  isAgentGoneError,
+  issueTokenForOrg,
+  loadAgentIdentity,
+  loadAgentRecord,
+  loadHostKey,
+  printLoginAgainHint,
+  refreshTokenIfNeeded,
+  resolveAgentAuthIssuer,
+  saveAgentRecord
+} from "./chunk-5Q3PQUI2.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
+import "./chunk-7ZQ666ZQ.js";
+export {
+  REFRESH_WINDOW_MS,
+  agentPath,
+  agentProfileKey,
+  deleteAgentRecord,
+  ensureHostKey,
+  forgetAgentForProfile,
+  formatExpiresIn,
+  getAgentAuthClient,
+  isAgentGoneError,
+  issueTokenForOrg,
+  loadAgentIdentity,
+  loadAgentRecord,
+  loadHostKey,
+  printLoginAgainHint,
+  refreshTokenIfNeeded,
+  resolveAgentAuthIssuer,
+  saveAgentRecord
+};

package/dist/{ai-agents-5QBOUUL5.js → ai-agents-J2ZTLDLV.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-CMVLVDYF.js";
+} from "./chunk-36I64456.js";
+import "./chunk-BYNI3AGG.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/ai-agents.ts

package/dist/{api-MA3KZAHZ.js → api-3L3XZYSQ.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-CMVLVDYF.js";
+} from "./chunk-36I64456.js";
+import "./chunk-BYNI3AGG.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/app/api.ts

package/dist/app-RHHZR5YW.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+// src/commands/app/index.ts
+import { defineCommand } from "citty";
+var app_default = defineCommand({
+  meta: {
+    name: "app",
+    description: "Manage epilot Apps \u2014 create, deploy, and manage app manifests"
+  },
+  subCommands: {
+    init: () => import("./init-HRF5Q2UW.js").then((m) => m.default),
+    "add-component": () => import("./add-component-USRY2DQG.js").then((m) => m.default),
+    "remove-component": () => import("./remove-component-WQLTK36T.js").then((m) => m.default),
+    "add-function": () => import("./add-function-RZTEKVSB.js").then((m) => m.default),
+    validate: () => import("./validate-L3EVLLDB.js").then((m) => m.default),
+    deploy: () => import("./deploy-LRSKADBB.js").then((m) => m.default),
+    dev: () => import("./dev-FGVM3R2Z.js").then((m) => m.default),
+    export: () => import("./export-IXXFKWBZ.js").then((m) => m.default),
+    versions: () => import("./versions-U4M5UMIX.js").then((m) => m.default),
+    review: () => import("./review-XWKQ2QBF.js").then((m) => m.default),
+    api: () => import("./api-3L3XZYSQ.js").then((m) => m.default)
+  }
+});
+export {
+  app_default as default
+};

package/dist/{audit-logs-N6ZFVTBE.js → audit-logs-VLVHBCF5.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-CMVLVDYF.js";
+} from "./chunk-36I64456.js";
+import "./chunk-BYNI3AGG.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-ENVFJFZZ.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-G564QXNL.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/audit-logs.ts