@fleox-agent-crm/agentcrm 0.0.0-stage → 0.3.0

package/dist/agent/agentcrm.mjs

@@ -0,0 +1,3932 @@
+#!/usr/bin/env node
+import { createRequire as __acrmRequire } from "node:module";
+import { fileURLToPath as __acrmPath } from "node:url";
+import { dirname as __acrmDirname } from "node:path";
+const require2 = __acrmRequire(import.meta.url);
+const __filename = __acrmPath(import.meta.url);
+const __dirname = __acrmDirname(__filename);
+import { parseArgs } from "node:util";
+import { existsSync, readFileSync, statSync, mkdirSync, writeFileSync, chmodSync, renameSync, openSync, writeSync, closeSync, unlinkSync, mkdtempSync, readdirSync, createReadStream } from "node:fs";
+import { join, resolve, dirname, basename, extname, sep, normalize, isAbsolute } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { homedir, tmpdir } from "node:os";
+import { spawnSync, execFileSync, spawn } from "node:child_process";
+import { createServer } from "node:http";
+class MemoryStorage {
+  data = /* @__PURE__ */ new Map();
+  get length() {
+    return this.data.size;
+  }
+  key(index) {
+    return [...this.data.keys()][index] ?? null;
+  }
+  getItem(key) {
+    return this.data.get(key) ?? null;
+  }
+  setItem(key, value) {
+    this.data.set(key, String(value));
+  }
+  removeItem(key) {
+    this.data.delete(key);
+  }
+  clear() {
+    this.data.clear();
+  }
+}
+let installed = false;
+function installBrowserEnv() {
+  if (installed) return;
+  installed = true;
+  const g = globalThis;
+  for (const name2 of ["localStorage", "sessionStorage"]) {
+    Object.defineProperty(globalThis, name2, { value: new MemoryStorage(), configurable: true, writable: true });
+  }
+  if (typeof g.window === "undefined") {
+    Object.defineProperty(globalThis, "window", { value: globalThis, configurable: true, writable: true });
+  }
+}
+class CliError extends Error {
+  constructor(code, message, hint, exitCode = 1) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+    this.exitCode = exitCode;
+  }
+}
+function createIo(json) {
+  return {
+    json,
+    out: (text) => process.stdout.write(text.endsWith("\n") ? text : text + "\n"),
+    err: (text) => process.stderr.write(text.endsWith("\n") ? text : text + "\n")
+  };
+}
+function printResult(io, data, human) {
+  if (io.json) io.out(JSON.stringify({ ok: true, data }));
+  else io.out(human());
+}
+const OPS_HINTS = {
+  forbidden: "The CRM user the CLI acts as lacks this permission (see `site show` → user, `users list`). Ask an admin, or re-register the site with an admin user (`site add … --user <email>`).",
+  notFound: "Check the id (list commands print them: `records list --object …`, `objects list`, `views list`…).",
+  validation: "Fix the input: `objects get <object>` lists field ids, types and select options.",
+  conflict: "Something with the same key already exists — list it first, then update instead of creating.",
+  invalid: "Check the arguments with `agentcrm help <command>`."
+};
+function knownError(error) {
+  if (!(error instanceof Error)) return null;
+  if (error.name === "PassphraseError") {
+    const reason = error.reason;
+    return reason === "missing" ? new CliError(
+      "passphrase-required",
+      "This dataset is encrypted and the site has no passphrase credential.",
+      "Store it (`agentcrm credentials set passphrase:<alias>` in the user's own terminal), then attach it: `agentcrm site credentials <alias> --passphrase-credential passphrase:<alias>`."
+    ) : new CliError("passphrase-wrong", "Wrong passphrase: the data could not be decrypted.", "Store the right one with `agentcrm credentials set <the site's passphrase account>` (see `site show`).");
+  }
+  if (error.name === "OpsError") {
+    const code = error.code ?? "invalid";
+    return new CliError(code, error.message, OPS_HINTS[code], code === "validation" || code === "invalid" ? 2 : 1);
+  }
+  if (error.name === "FieldValidationError") {
+    return new CliError("validation", error.message, OPS_HINTS.validation, 2);
+  }
+  if (error.name === "DocConflictError") {
+    return new CliError("conflict", `The data changed elsewhere while this command ran: ${error.message}`, "Run the same command again (it reloads the latest data).");
+  }
+  if (error.name === "StorageError") {
+    const status = error.status ?? 0;
+    const hint = status === 401 || status === 403 ? "The storage refused the credentials: check the key pair / token and its permissions (`agentcrm doctor`)." : status === 404 ? "Bucket, repository or path not found: check the names in the plan / site." : status === 0 ? "Network error or CORS: check the endpoint URL and the connection." : "Retry once; run `agentcrm doctor` if it persists.";
+    return new CliError("storage", `${error.message}${status ? ` (HTTP ${status})` : ""}`, hint);
+  }
+  return null;
+}
+function toCliError(error) {
+  return error instanceof CliError ? error : knownError(error) ?? new CliError(
+    "internal",
+    error instanceof Error ? error.message : String(error),
+    "Unexpected error. Retry once; if it persists, report it with the command and this output."
+  );
+}
+function printError(io, error) {
+  const e = toCliError(error);
+  if (io.json) io.out(JSON.stringify({ ok: false, error: { code: e.code, message: e.message, ...e.hint ? { hint: e.hint } : {} } }));
+  else io.err(`Error: ${e.message}${e.hint ? `
+Hint: ${e.hint}` : ""}`);
+  return e.exitCode;
+}
+const output = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  CliError,
+  createIo,
+  knownError,
+  printError,
+  printResult,
+  toCliError
+}, Symbol.toStringTag, { value: "Module" }));
+const name = "@fleox-agent-crm/agentcrm";
+const version = "0.3.0";
+const type = "module";
+const description = "The static CRM your AI agent can run: a Twenty / HubSpot-style CRM that runs entirely in the browser or headless through the agentcrm CLI, with data on storage you own.";
+const license = "SEE LICENSE IN LICENSE";
+const engines = { "node": ">=20" };
+const bin = { "agentcrm": "dist/agent/agentcrm.mjs" };
+const files$1 = ["dist/agent", "dist/admin", "types/agentcrm-runtime.d.ts", "dist/version.json", "plugin", "changelog.json", "README.md", "LICENSE"];
+const agentcrm = { "minSkillsVersion": "0.1.0", "dataSchema": 1 };
+const scripts = { "dev": "vite", "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.agent.json", "test": "vitest run", "test:watch": "vitest", "build": "vite build && node scripts/write-admin-manifest.mjs && vite build --config vite.agent.config.ts && node scripts/write-version.mjs", "build:examples": "node scripts/build-examples.mjs", "preview": "vite preview", "check:skills": "node scripts/check-skills.mjs", "hermes:build": "node scripts/build-hermes.mjs", "check:hermes": "node scripts/build-hermes.mjs --check && python3 -m unittest discover -s hermes/tests", "version": "node scripts/sync-version.mjs && npm run build && node scripts/build-hermes.mjs && git add -A plugin hermes .claude-plugin", "gen:runtime-stubs": "node scripts/gen-runtime-stubs.mjs", "prepublishOnly": "npm run typecheck && npm test && npm run build && npm run check:skills" };
+const devDependencies = { "@dnd-kit/core": "^6.3.1", "@dnd-kit/sortable": "^10.0.0", "@dnd-kit/utilities": "^3.2.2", "@types/node": "^25.9.9", "@types/papaparse": "^5.5.2", "@types/react": "^18.3.31", "@types/react-dom": "^18.3.7", "@vitejs/plugin-react": "^5.2.0", "autoprefixer": "^10.6.2", "clsx": "^2.1.1", "date-fns": "^4.4.0", "dompurify": "^3.4.17", "fake-indexeddb": "^6.2.7", "firebase": "^11.10.0", "happy-dom": "^20.14.6", "i18next": "^23.16.8", "i18next-browser-languagedetector": "^8.3.0", "jszip": "^3.10.2", "lucide-react": "^0.460.0", "marked": "^18.1.3", "minisearch": "^7.2.0", "papaparse": "^5.7.0", "postcss": "^8.5.32", "react": "^18.3.1", "react-dom": "^18.3.1", "react-i18next": "^15.7.4", "react-is": "^18.3.1", "react-router-dom": "^6.30.6", "recharts": "^3.10.1", "tailwindcss": "^3.4.19", "typescript": "^6.0.3", "vite": "^6.4.5", "vitest": "^4.1.12" };
+const repository = { "type": "git", "url": "git+https://github.com/fleox/agentcrm.git" };
+const homepage = "https://github.com/fleox/agentcrm#readme";
+const keywords = ["crm", "static", "mcp", "ai-agent", "claude", "sales", "pipeline", "s3", "encrypted"];
+const publishConfig = { "access": "public" };
+const bugs = { "url": "https://github.com/fleox/agentcrm/issues" };
+const pkg = {
+  name,
+  version,
+  type,
+  description,
+  license,
+  engines,
+  bin,
+  files: files$1,
+  agentcrm,
+  scripts,
+  devDependencies,
+  repository,
+  homepage,
+  keywords,
+  publishConfig,
+  bugs
+};
+function isBundled() {
+  return true;
+}
+function distRoot() {
+  if (process.env.AGENTCRM_DIST) return resolve(process.env.AGENTCRM_DIST);
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolve(here, "..");
+}
+function ownPackageRoot() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolve(here, "..", "..");
+}
+function packageRoot() {
+  return resolve(distRoot(), "..");
+}
+function readVersionInfo() {
+  const file2 = join(distRoot(), "version.json");
+  if (existsSync(file2)) {
+    try {
+      const v = JSON.parse(readFileSync(file2, "utf8"));
+      if (v.version) return { name: v.name ?? pkg.name, version: v.version, minSkillsVersion: v.minSkillsVersion ?? pkg.agentcrm.minSkillsVersion, dataSchema: v.dataSchema ?? pkg.agentcrm.dataSchema };
+    } catch {
+    }
+  }
+  return { name: pkg.name, version: pkg.version, minSkillsVersion: pkg.agentcrm.minSkillsVersion, dataSchema: pkg.agentcrm.dataSchema };
+}
+const PACKAGE_NAME = pkg.name;
+const FIELD_TYPES = [
+  "text",
+  "longText",
+  "number",
+  "currency",
+  "percent",
+  "date",
+  "datetime",
+  "boolean",
+  "select",
+  "multiSelect",
+  "email",
+  "phone",
+  "url",
+  "relation",
+  "user",
+  "rating",
+  "address",
+  "tags",
+  "image",
+  "files"
+];
+const ACTIVITY_TYPES = ["note", "task", "call", "email", "meeting"];
+const FILTER_OPS = [
+  "eq",
+  "neq",
+  "contains",
+  "notContains",
+  "empty",
+  "notEmpty",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "notIn",
+  "before",
+  "after",
+  "withinDays"
+];
+const USER_ROLES = ["admin", "member", "viewer"];
+function homeDir() {
+  return resolve(process.env.AGENTCRM_HOME || join(homedir(), ".agentcrm"));
+}
+function homePath(...parts) {
+  return join(homeDir(), ...parts);
+}
+function readJsonFile(file2, fallback) {
+  if (!existsSync(file2)) return fallback;
+  return JSON.parse(readFileSync(file2, "utf8"));
+}
+function writeJsonFile(file2, value, mode = 420) {
+  mkdirSync(dirname(file2), { recursive: true, mode: 448 });
+  const tmp = `${file2}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode });
+  chmodSync(tmp, mode);
+  renameSync(tmp, file2);
+}
+function isWorldReadable(file2) {
+  if (process.platform === "win32" || !existsSync(file2)) return false;
+  return (statSync(file2).mode & 63) !== 0;
+}
+const CREDENTIAL_TYPES = {
+  s3: {
+    fields: ["accessKeyId", "secretAccessKey"],
+    label: "S3-compatible access key pair",
+    howTo: "An access key restricted to the CRM bucket(s) with GetObject / PutObject / DeleteObject / ListBucket (AWS IAM user, Cloudflare R2 API token, OVHcloud / Scaleway S3 user). Import an existing aws CLI profile with --from-aws-profile."
+  },
+  github: {
+    fields: ["token"],
+    label: "GitHub personal access token",
+    howTo: "https://github.com/settings/personal-access-tokens/new — fine-grained, only the CRM data repo (private) and the admin hosting repo, Repository permissions: Contents Read and write, Pages Read and write (optional), Metadata Read-only. Or reuse the GitHub CLI login with --from-gh."
+  },
+  gitlab: {
+    fields: ["token"],
+    label: "GitLab access token",
+    howTo: "GitLab project → Settings → Access tokens (or Preferences → Access tokens): scope `api`, role Developer or higher."
+  },
+  firebase: {
+    fields: ["email", "password"],
+    label: "Firebase admin login (email + password)",
+    howTo: "The email and password of a CRM administrator in the Firebase project (Authentication → Users). The CLI signs in exactly like the admin login screen."
+  },
+  passphrase: {
+    fields: ["passphrase"],
+    label: "Dataset encryption passphrase",
+    howTo: "Generated by `agentcrm install` (or `credentials set passphrase:<name> --generate`). Each browser asks for it once. Save it in a password manager: without it nobody can read the data."
+  },
+  anthropic: {
+    fields: ["apiKey"],
+    label: "Anthropic API key (AI assistant)",
+    howTo: "https://console.anthropic.com/settings/keys — used by the in-admin assistant from the browser; the CLI only stores it so it can be copied into the admin."
+  }
+};
+const ACCOUNT_RE = /^([a-z0-9-]+):([A-Za-z0-9._@-]{1,100})$/;
+function file$1() {
+  return homePath("credentials.json");
+}
+function load$1() {
+  return readJsonFile(file$1(), { version: 1, accounts: {} });
+}
+function save$1(data) {
+  writeJsonFile(file$1(), data, 384);
+}
+function parseAccount(account) {
+  const m = ACCOUNT_RE.exec(account);
+  if (!m || !CREDENTIAL_TYPES[m[1]]) {
+    throw new CliError(
+      "invalid-account",
+      `Invalid account "${account}".`,
+      `Use <type>:<name> with type one of ${Object.keys(CREDENTIAL_TYPES).join(", ")} — e.g. s3:main.`,
+      2
+    );
+  }
+  return { type: m[1], name: m[2] };
+}
+function setCredential(account, values) {
+  const { type: type2 } = parseAccount(account);
+  const missing = CREDENTIAL_TYPES[type2].fields.filter((f) => !values[f]?.trim());
+  if (missing.length) throw new CliError("missing-fields", `Missing ${missing.join(", ")} for ${account}.`, void 0, 2);
+  const data = load$1();
+  const entry = {
+    type: type2,
+    values: Object.fromEntries(CREDENTIAL_TYPES[type2].fields.map((f) => [f, values[f].trim()])),
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  data.accounts[account] = entry;
+  save$1(data);
+  return entry;
+}
+function removeCredential(account) {
+  const data = load$1();
+  if (!data.accounts[account]) return false;
+  delete data.accounts[account];
+  save$1(data);
+  return true;
+}
+function getCredential(account) {
+  parseAccount(account);
+  const path = file$1();
+  if (isWorldReadable(path)) chmodSync(path, 384);
+  return load$1().accounts[account] ?? null;
+}
+function requireCredential(account) {
+  const cred = getCredential(account);
+  if (!cred) {
+    const { type: type2 } = parseAccount(account);
+    throw new CliError(
+      "credential-missing",
+      `No stored credential for ${account}.`,
+      `Ask the user to run \`agentcrm credentials set ${account}\` in their own terminal (input is hidden), or pass --from-env. ${CREDENTIAL_TYPES[type2].howTo}`
+    );
+  }
+  return cred;
+}
+function listCredentials() {
+  return Object.entries(load$1().accounts).map(([account, c]) => ({
+    account,
+    type: c.type,
+    fields: Object.keys(c.values),
+    updatedAt: c.updatedAt
+  }));
+}
+const credentials = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  CREDENTIAL_TYPES,
+  getCredential,
+  listCredentials,
+  parseAccount,
+  removeCredential,
+  requireCredential,
+  setCredential
+}, Symbol.toStringTag, { value: "Module" }));
+const ALIAS_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+function file() {
+  return homePath("sites.json");
+}
+function load() {
+  return readJsonFile(file(), { version: 1, default: null, sites: {} });
+}
+function save(data) {
+  writeJsonFile(file(), data);
+}
+function validateAlias(alias) {
+  if (!ALIAS_RE.test(alias)) {
+    throw new CliError("invalid-alias", `Invalid site alias "${alias}".`, "Lower-case letters, digits and dashes, e.g. acme-crm.", 2);
+  }
+  return alias;
+}
+function listSites() {
+  const data = load();
+  return { default: data.default, sites: Object.values(data.sites).sort((a, b) => a.alias.localeCompare(b.alias)) };
+}
+function getSite(alias) {
+  return load().sites[alias] ?? null;
+}
+function putSite(site) {
+  const data = load();
+  data.sites[site.alias] = { ...site, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  save(data);
+}
+function removeSite(alias) {
+  const data = load();
+  if (!data.sites[alias]) return false;
+  delete data.sites[alias];
+  if (data.default === alias) data.default = null;
+  save(data);
+  return true;
+}
+function renameSite(from, to) {
+  validateAlias(to);
+  const data = load();
+  const site = data.sites[from];
+  if (!site) throw siteNotFound(from, data);
+  if (data.sites[to]) throw new CliError("site-exists", `A site named "${to}" already exists.`);
+  delete data.sites[from];
+  data.sites[to] = { ...site, alias: to, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  if (data.default === from) data.default = to;
+  save(data);
+}
+function setDefaultSite(alias) {
+  const data = load();
+  if (!data.sites[alias]) throw siteNotFound(alias, data);
+  data.default = alias;
+  save(data);
+}
+function findProjectSite(cwd = process.cwd()) {
+  let dir = resolve(cwd);
+  for (; ; ) {
+    const candidate = join(dir, "agentcrm.json");
+    if (existsSync(candidate)) {
+      try {
+        const alias = JSON.parse(readFileSync(candidate, "utf8")).site;
+        if (typeof alias === "string" && alias) return { alias, file: candidate };
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function siteNotFound(alias, data) {
+  const known = Object.keys(data.sites);
+  return new CliError(
+    "site-not-found",
+    `No site named "${alias}".`,
+    known.length ? `Known sites: ${known.join(", ")}.` : "No CRM registered yet — run `agentcrm install --plan …` or `agentcrm site add`."
+  );
+}
+function resolveSite(explicit) {
+  const data = load();
+  const chosen = explicit || process.env.AGENTCRM_SITE?.trim() || findProjectSite()?.alias;
+  if (chosen) {
+    const site = data.sites[chosen];
+    if (!site) throw siteNotFound(chosen, data);
+    return site;
+  }
+  const all = Object.values(data.sites);
+  if (all.length === 1) return all[0];
+  if (all.length === 0) throw siteNotFound("(none)", data);
+  if (data.default && data.sites[data.default]) return data.sites[data.default];
+  throw new CliError(
+    "site-required",
+    `Several CRMs are registered: ${all.map((s) => s.alias).join(", ")}.`,
+    "Ask the user which one, then pass --site <alias> (or `agentcrm site use <alias>`).",
+    2
+  );
+}
+function lockSite(alias) {
+  const dir = homePath("locks");
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const path = join(dir, `${alias}.lock`);
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(path, "wx");
+      writeSync(fd, String(process.pid));
+      closeSync(fd);
+      return () => {
+        try {
+          unlinkSync(path);
+        } catch {
+        }
+      };
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const pid = Number(readFileSync(path, "utf8"));
+      if (pid && pid !== process.pid && isAlive(pid)) {
+        throw new CliError("site-busy", `Another agentcrm process (pid ${pid}) is writing to "${alias}".`, "Wait for it to finish, then retry.");
+      }
+      if (pid === process.pid) {
+        return () => void 0;
+      }
+      unlinkSync(path);
+    }
+  }
+  throw new CliError("site-busy", `Could not lock "${alias}".`);
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function runtimeDir() {
+  const own = ownPackageRoot();
+  const candidates = [...new Set([process.env.AGENTCRM_RUNTIME_DIR, join(distRoot(), "admin", "runtime"), join(packageRoot(), "public", "runtime"), join(own, "dist", "admin", "runtime"), join(own, "public", "runtime")].filter((p) => !!p))];
+  for (const dir of candidates) if (existsSync(join(dir, "agentcrm-runtime.js"))) return resolve(dir);
+  throw new Error(`Runtime stubs not found (looked in ${candidates.join(", ")}). Set AGENTCRM_RUNTIME_DIR to an admin build's runtime/ folder.`);
+}
+function safeModeFromEnv() {
+  const v = process.env.AGENTCRM_SAFE?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+let tmpBase = null;
+function tmpFolder() {
+  if (!tmpBase) tmpBase = mkdtempSync(join(tmpdir(), "agentcrm-cli-ext-"));
+  return tmpBase;
+}
+async function nodeImportBundle() {
+  await import("./chunks/runtime-DHo7ZEEO.mjs");
+  const { createNodeImportBundle } = await import("./chunks/nodeImport-BPCt5uMu.mjs");
+  return createNodeImportBundle({ runtimeDir: runtimeDir(), tmpDir: tmpFolder() });
+}
+function hasEnabledExtensions(store) {
+  return store.list("extensions").some((d) => d.enabled === true);
+}
+async function loadSessionExtensions(store, opts = {}) {
+  const safeMode = !!opts.safe || safeModeFromEnv();
+  let loadedAny = false;
+  const sync = async () => {
+    if (safeMode) return null;
+    if (!loadedAny && !opts.force && !hasEnabledExtensions(store)) return null;
+    try {
+      const importBundle = await nodeImportBundle();
+      const { syncExtensions } = await import("./chunks/loader-C9nm3iwx.mjs");
+      loadedAny = true;
+      const original = console.error;
+      console.error = () => void 0;
+      try {
+        return await syncExtensions(store, { importBundle });
+      } finally {
+        console.error = original;
+      }
+    } catch (err) {
+      return { loaded: [], unloaded: [], failed: [{ id: "*", error: err.message }], skipped: [] };
+    }
+  };
+  const report = await sync();
+  return {
+    report,
+    safeMode,
+    sync,
+    async close() {
+      if (!loadedAny) return;
+      (await import("./chunks/registry-Ceexawxl.mjs")).deactivateAllExtensions();
+    }
+  };
+}
+function extensionNotes(report) {
+  if (!report) return [];
+  return report.failed.map((f) => f.id === "*" ? `extensions could not be loaded: ${f.error}` : `extension ${f.id} failed to load: ${f.error} (\`agentcrm ext disable ${f.id}\`, or --safe to skip extensions)`);
+}
+function chainRegistries(primary, secondary) {
+  return {
+    ...primary,
+    async doAction(hook, ...args) {
+      await primary.doAction(hook, ...args);
+      await secondary.doAction(hook, ...args);
+    },
+    async applyFilters(hook, value, ...args) {
+      return secondary.applyFilters(hook, await primary.applyFilters(hook, value, ...args), ...args);
+    },
+    applyFiltersSync(hook, value, ...args) {
+      return secondary.applyFiltersSync(hook, primary.applyFiltersSync(hook, value, ...args), ...args);
+    },
+    hasAction: (hook) => primary.hasAction(hook) || secondary.hasAction(hook)
+  };
+}
+function kdfIterations() {
+  const n = Number(process.env.AGENTCRM_KDF_ITERATIONS);
+  return Number.isInteger(n) && n > 0 ? n : void 0;
+}
+function cliClientId() {
+  return `cli${randomBytes(4).toString("hex")}`;
+}
+function dataTargetOf(site) {
+  if (site.runtime.backend !== "journal") throw new CliError("unsupported-backend", `${site.alias} is not a journal dataset.`);
+  const j = site.runtime.journal;
+  const secrets = site.credentials.data ? requireCredential(site.credentials.data).values : {};
+  return { connectorId: j.connectorId, settings: { ...j.settings, ...site.dataPath ? { path: site.dataPath } : {}, ...secrets } };
+}
+function hostingTargetOf(site) {
+  if (!site.hosting) return null;
+  const secrets = site.credentials.hosting ? requireCredential(site.credentials.hosting).values : {};
+  if (!site.credentials.hosting && site.hosting.connectorId !== "local-folder") {
+    throw new CliError("credential-required", `No hosting credential recorded for ${site.alias}.`, `Attach one: \`agentcrm site credentials ${site.alias} --hosting-credential <account>\`.`);
+  }
+  return { connectorId: site.hosting.connectorId, settings: { ...site.hosting.settings, ...secrets } };
+}
+async function openStore(runtime, opts) {
+  installBrowserEnv();
+  const rc = await import("./chunks/runtimeConfig-CCOFg1RM.mjs");
+  rc.setRuntimeConfigOverride(runtime);
+  if (opts.passphrase) rc.setPassphrase(runtime, opts.passphrase);
+  if (runtime.backend === "local") {
+    throw new CliError("unsupported-backend", "This CRM keeps its data in one browser (local mode): the CLI can't reach it.", "Use the admin in that browser, or move the data to a journal / git / Firebase backend (Settings → Data).");
+  }
+  if (runtime.backend === "journal") {
+    if (!opts.dataTarget) throw new CliError("internal", "journal store without a data location");
+    const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+    const { createJournalStore } = await import("./chunks/index-B-4W0-P4.mjs");
+    const { publicSettings, secrets } = rc.splitSecretSettings(opts.dataTarget.settings);
+    rc.setConnectorSecrets(runtime, secrets);
+    return createJournalStore({
+      connector: buildConnector(opts.dataTarget),
+      root: runtime.journal.root,
+      encrypted: runtime.journal.encrypted,
+      passphrase: opts.passphrase ?? null,
+      clientId: cliClientId(),
+      iterations: kdfIterations()
+    });
+  }
+  if (runtime.backend === "git-json") {
+    const token = String(opts.secrets?.token ?? "");
+    if (token) rc.setGitToken(runtime.git, token);
+  }
+  const { createDataStore } = await import("./chunks/index-CRkw3_iF.mjs");
+  return createDataStore(runtime, { secrets: opts.secrets ?? {}, passphrase: opts.passphrase ?? null, clientId: cliClientId() });
+}
+function siteSecrets(site) {
+  const passphrase = site.credentials.passphrase ? requireCredential(site.credentials.passphrase).values.passphrase : null;
+  if (site.runtime.backend === "journal") return { dataTarget: dataTargetOf(site), passphrase };
+  if (site.runtime.backend === "git-json" || site.runtime.backend === "firebase") {
+    if (!site.credentials.data) {
+      throw new CliError(
+        "credential-required",
+        `No ${site.runtime.backend === "firebase" ? "Firebase login" : "git token"} recorded for ${site.alias}.`,
+        `Store it (\`agentcrm credentials set ${site.runtime.backend === "firebase" ? "firebase" : site.runtime.git.provider}:<name>\`), then \`agentcrm site credentials ${site.alias} --data-credential <account>\`.`
+      );
+    }
+    return { secrets: requireCredential(site.credentials.data).values, passphrase };
+  }
+  return { passphrase };
+}
+async function actingUser(store, site, as) {
+  const { usersOf } = await import("./chunks/store-5gqRSKXg.mjs");
+  const users = usersOf(store);
+  const find = (ref) => users.find((u) => u.id === ref || u.email.toLowerCase() === ref.toLowerCase());
+  if (as) {
+    const u = find(as);
+    if (!u) throw new CliError("user-not-found", `No CRM user "${as}".`, "List them with `agentcrm users list`.", 2);
+    return { user: u, warnings: [] };
+  }
+  if (site.user) {
+    const u = find(site.user);
+    if (u) return { user: u, warnings: u.disabled ? [`The site's CLI user ${u.email} is disabled.`] : [] };
+  }
+  const identity = await store.identity().catch(() => null);
+  const byIdentity = identity ? find(identity.uid) ?? (identity.email ? find(identity.email) : void 0) : void 0;
+  if (byIdentity) return { user: byIdentity, warnings: [] };
+  const admin = users.find((u) => u.role === "admin" && !u.disabled);
+  if (admin) return { user: admin, warnings: site.user ? [`CRM user ${site.user} not found: acting as ${admin.email}.`] : [] };
+  return { user: null, warnings: users.length ? [] : ["The dataset has no CRM user yet: acting as the system."] };
+}
+async function openSession(alias, opts = {}) {
+  installBrowserEnv();
+  const site = resolveSite(alias);
+  const unlock = opts.lock ? lockSite(site.alias) : null;
+  let store = null;
+  let uninstall = null;
+  let extensions = null;
+  try {
+    store = await openStore(site.runtime, siteSecrets(site));
+    await store.ready();
+    const [{ createOpsContext }, { createPluginRegistry, plugins: defaultPlugins }, { installAutomations }] = await Promise.all([
+      import("./chunks/context-CxFfqS4D.mjs"),
+      import("./chunks/pluginRegistry-DyHtlkcr.mjs"),
+      import("./chunks/automations-BWrvLqP6.mjs")
+    ]);
+    const own = createPluginRegistry((hook, err) => process.stderr.write(`[agentcrm] ${hook} handler failed: ${String(err?.message ?? err)}
+`));
+    uninstall = installAutomations(own);
+    const plugins = chainRegistries(own, defaultPlugins);
+    const { user, warnings } = await actingUser(store, site, opts.as);
+    extensions = await loadSessionExtensions(store, { safe: opts.safe });
+    warnings.push(...extensionNotes(extensions.report));
+    const log = (msg) => process.stderr.write(`${msg}
+`);
+    const ctx = createOpsContext(store, user, { plugins, log });
+    const system = createOpsContext(store, null, { plugins, log });
+    if (opts.lock && (!user || user.role === "admin") && store.list("objects").length) {
+      const { migrateSchema } = await import("./chunks/migrate-CsClnnN8.mjs").then((n) => n.c);
+      await migrateSchema(ctx).catch((err) => warnings.push(`Schema migration skipped: ${err.message}`));
+    }
+    if (site.hosting) {
+      const target = (() => {
+        try {
+          return hostingTargetOf(site);
+        } catch {
+          return null;
+        }
+      })();
+      if (target) {
+        const { setStorageConfigSource, registerStorageConnector } = await import("./chunks/registry-DijAKZ24.mjs").then((n) => n.r);
+        const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+        if (target.connectorId === "local-folder") registerStorageConnector({ id: "local-folder", create: (s) => buildConnector({ connectorId: "local-folder", settings: s }) });
+        setStorageConfigSource(async () => target);
+      }
+    }
+    {
+      const forms = await import("./chunks/forms-BKU5F9WF.mjs");
+      const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+      forms.setInboxSourceResolver((_ctx, form) => {
+        if (form.inbox.kind !== "s3") return null;
+        const settings = form.inbox.settings ?? {};
+        let target = null;
+        try {
+          target = settings.source === "data" && site.runtime.backend === "journal" ? dataTargetOf(site) : hostingTargetOf(site);
+        } catch {
+          target = null;
+        }
+        return target ? forms.connectorInboxSource(buildConnector(target), settings.prefix) : null;
+      });
+    }
+    const opened = store;
+    let closed = false;
+    return {
+      site,
+      store: opened,
+      ctx,
+      system,
+      plugins,
+      user,
+      warnings,
+      extensions,
+      hostingTarget: () => hostingTargetOf(site),
+      async close() {
+        if (closed) return;
+        closed = true;
+        try {
+          uninstall?.();
+          await extensions?.close();
+          await (await import("./chunks/batch-CVETiJj5.mjs")).flushImplicitBatch();
+          opened.close?.();
+        } finally {
+          unlock?.();
+        }
+      }
+    };
+  } catch (err) {
+    uninstall?.();
+    await extensions?.close().catch(() => void 0);
+    store?.close?.();
+    unlock?.();
+    throw err;
+  }
+}
+async function withSession(io, options, open, work, human = (r) => JSON.stringify(r, null, 2)) {
+  const session2 = await openSession(typeof options.site === "string" ? options.site : void 0, {
+    ...open,
+    as: typeof options.as === "string" ? options.as : open.as,
+    safe: options.safe === true || open.safe
+  });
+  try {
+    const result = await work(session2);
+    for (const w of session2.warnings) io.err(`note: ${w}`);
+    printResult(io, result, () => human(result));
+    return 0;
+  } finally {
+    await session2.close();
+  }
+}
+const session = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  cliClientId,
+  dataTargetOf,
+  hostingTargetOf,
+  kdfIterations,
+  openSession,
+  openStore,
+  withSession
+}, Symbol.toStringTag, { value: "Module" }));
+function usage(message, hint) {
+  throw new CliError("usage", message, hint, 2);
+}
+function strOpt(options, name2) {
+  const v = options[name2];
+  if (Array.isArray(v)) return v.at(-1);
+  return typeof v === "string" ? v : void 0;
+}
+function requireStr(options, name2, hint) {
+  const v = strOpt(options, name2);
+  if (!v || !v.trim()) usage(`--${name2} is required.`, hint);
+  return v.trim();
+}
+function listOpt(options, name2) {
+  const v = options[name2];
+  if (v === void 0 || v === false) return void 0;
+  const all = Array.isArray(v) ? v : [String(v)];
+  return all.flatMap((s) => s.split(",")).map((s) => s.trim()).filter(Boolean);
+}
+function multiOpt(options, name2) {
+  const v = options[name2];
+  if (v === void 0 || v === false) return [];
+  return Array.isArray(v) ? v : [String(v)];
+}
+function numOpt(options, name2) {
+  const v = strOpt(options, name2);
+  if (v === void 0) return void 0;
+  const n = Number(v);
+  if (!Number.isFinite(n)) usage(`--${name2} must be a number, got "${v}".`);
+  return n;
+}
+function boolOpt(options, name2) {
+  return options[name2] === true;
+}
+function readTextValue(value, name2) {
+  if (value === "-") return readFileSync(0, "utf8");
+  if (value.startsWith("@")) {
+    const file2 = value.slice(1);
+    if (!existsSync(file2)) usage(`--${name2}: ${file2} does not exist.`);
+    return readFileSync(file2, "utf8");
+  }
+  return value;
+}
+function jsonOpt(options, name2) {
+  const v = strOpt(options, name2);
+  if (v === void 0) return void 0;
+  const text = readTextValue(v, name2);
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    usage(`--${name2} is not valid JSON: ${err.message}`, `Example: --${name2} '{"name":"Acme"}' or --${name2} @file.json`);
+  }
+}
+function jsonObjectOpt(options, name2) {
+  const v = jsonOpt(options, name2);
+  if (v === void 0) return void 0;
+  if (!v || typeof v !== "object" || Array.isArray(v)) usage(`--${name2} must be a JSON object.`);
+  return v;
+}
+function parseScalar(raw) {
+  const t = raw.trim();
+  if (t === "") return "";
+  try {
+    const v = JSON.parse(t);
+    if (typeof v === "string") return v;
+    if (typeof v === "number" && String(v) !== t) return raw;
+    return v;
+  } catch {
+    return raw;
+  }
+}
+function fieldsInput(options, jsonName = "fields") {
+  const out = { ...jsonObjectOpt(options, jsonName) ?? {} };
+  for (const pair of multiOpt(options, "set")) {
+    const i = pair.indexOf("=");
+    if (i <= 0) usage(`--set expects key=value, got "${pair}".`, 'e.g. --set name="Acme Inc" --set employees=40');
+    out[pair.slice(0, i).trim()] = parseScalar(pair.slice(i + 1));
+  }
+  return out;
+}
+const VALUELESS = /* @__PURE__ */ new Set(["empty", "notEmpty"]);
+const LIST_OPS = /* @__PURE__ */ new Set(["in", "notIn"]);
+function parseFilters(values, ops) {
+  return values.map((f) => {
+    const first = f.indexOf(":");
+    if (first <= 0) usage(`--filter expects field:op:value, got "${f}".`, `Ops: ${ops.join(", ")}. e.g. --filter stage:eq:proposal --filter amount:gte:10000`);
+    const field = f.slice(0, first);
+    const rest = f.slice(first + 1);
+    const second = rest.indexOf(":");
+    const op = second < 0 ? rest : rest.slice(0, second);
+    const raw = second < 0 ? void 0 : rest.slice(second + 1);
+    if (!ops.includes(op)) usage(`Unknown filter op "${op}" in "${f}".`, `Ops: ${ops.join(", ")}.`);
+    if (VALUELESS.has(op)) return { field, op };
+    if (raw === void 0) usage(`--filter "${f}" needs a value (field:op:value).`);
+    let value = parseScalar(raw);
+    if (LIST_OPS.has(op) && !Array.isArray(value)) value = raw.split(",").map((s) => parseScalar(s.trim()));
+    return { field, op, value };
+  });
+}
+function parseSorts(values) {
+  return values.flatMap((v) => v.split(",")).map((s) => s.trim()).filter(Boolean).map((s) => {
+    if (s.startsWith("-")) return { field: s.slice(1), dir: "desc" };
+    const [field, dir = "asc"] = s.split(":");
+    if (dir !== "asc" && dir !== "desc") usage(`--sort direction must be asc or desc, got "${dir}".`);
+    return { field, dir };
+  });
+}
+function positional(positionals, index, what, usageLine) {
+  const v = positionals[index];
+  if (!v) usage(`Missing ${what}.`, `Usage: agentcrm ${usageLine}`);
+  return v;
+}
+function table(rows, columns) {
+  if (!rows.length) return "(none)";
+  const cell = (v) => (v === void 0 || v === null ? "" : typeof v === "object" ? JSON.stringify(v) : String(v)).replace(/\s+/g, " ").slice(0, 60);
+  const widths = columns.map((c) => Math.max(c.length, ...rows.map((r) => cell(r[c]).length)));
+  const line = (vals) => vals.map((v, i) => v.padEnd(widths[i])).join("  ").trimEnd();
+  return [line(columns), line(widths.map((w) => "-".repeat(w))), ...rows.map((r) => line(columns.map((c) => cell(r[c]))))].join("\n");
+}
+const SITE_OPTION = { name: "site", type: "string", description: "Site alias (default: $AGENTCRM_SITE, ./agentcrm.json, the only site, or `site use`)." };
+const AS_OPTION = { name: "as", type: "string", description: "Act as this CRM user (email or id) instead of the site's user." };
+const YES_OPTION = { name: "yes", type: "boolean", description: "Apply — only after the user confirmed the plan." };
+function fileOut(f) {
+  return {
+    id: f.id,
+    name: f.name,
+    mime: f.mime,
+    size: f.size,
+    ...f.width && f.height ? { width: f.width, height: f.height } : {},
+    targets: f.targets,
+    ...f.via ? { via: f.via.kind } : {},
+    createdAt: new Date(f.createdAt).toISOString(),
+    ...f.deletedAt ? { deletedAt: new Date(f.deletedAt).toISOString() } : {}
+  };
+}
+function readLocalFile(path) {
+  const full = resolve(path);
+  if (!existsSync(full)) usage(`${path} does not exist.`);
+  const st = statSync(full);
+  if (!st.isFile()) usage(`${path} is not a file.`);
+  if (st.size > 1024 * 1024 * 1024) usage(`${path} is larger than 1 GB.`);
+  return { name: basename(full), bytes: new Uint8Array(readFileSync(full)) };
+}
+async function uploadLocalFiles(ctx, paths, targets2 = []) {
+  const { uploadFile } = await import("./chunks/files-q8Xu5bft.mjs");
+  const { guessMime, imageDimensions } = await import("./chunks/files-CjsPJSR6.mjs");
+  const out = [];
+  for (const p of paths) {
+    const { name: name2, bytes } = readLocalFile(p);
+    const mime = guessMime(name2);
+    const dims = mime.startsWith("image/") ? imageDimensions(bytes) : null;
+    out.push(await uploadFile(ctx, { name: name2, mime, bytes, targets: targets2, ...dims ?? {} }));
+  }
+  return out;
+}
+const ATTACH_OPTION = { name: "attach", type: "string", description: "Attach a local file (repeatable; images are uploaded as they are).", multiple: true };
+const U$1 = {
+  list: "files list [--record <id> | --activity <id>] [--related] [--kind image|pdf|document|…] [--search <name>] [--limit n]",
+  upload: "files upload <path>… (--record <id> | --activity <id>)",
+  get: "files get <id> --out <path> [--thumb]",
+  delete: "files delete <id> [--yes]",
+  usage: "files usage"
+};
+const filesCommand = {
+  name: "files",
+  usage: "files <list|upload|get|delete|usage> …",
+  summary: "Images and attachments: list a record's / activity's files (metadata), upload local files to a record or an activity, download one, soft-delete (bytes purged by `compact`), storage usage.",
+  subcommands: [
+    { name: "list", usage: U$1.list, summary: "Files of a record (its own, its activities', --related: linked records') or of an activity; all files without a target." },
+    { name: "upload", usage: U$1.upload, summary: "Upload local files and attach them to a record or an activity (CRM size limit applies).", writes: true },
+    { name: "get", usage: U$1.get, summary: "Download a file's bytes (decrypted) to a local path." },
+    { name: "delete", usage: U$1.delete, summary: "Soft-delete a file (removed from its records / activities; bytes purged by `compact`). Plan unless --yes.", writes: true, destructive: true },
+    { name: "usage", usage: U$1.usage, summary: "Number of files and total size." }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "record", type: "string", description: "Record id." },
+    { name: "activity", type: "string", description: "Activity id (note, task, call, email, meeting)." },
+    { name: "related", type: "boolean", description: "list: include files of related records." },
+    { name: "kind", type: "string", description: "list: image, pdf, document, spreadsheet, presentation, archive, text, audio, video, other." },
+    { name: "search", type: "string", description: "list: part of the file name." },
+    { name: "limit", type: "string", description: "list: max items (default 100)." },
+    { name: "out", type: "string", description: "get: local path to write." },
+    { name: "thumb", type: "boolean", description: "get: the thumbnail when there is one." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action, ...args] = positionals;
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { listFiles } = await import("./chunks/files-q8Xu5bft.mjs");
+          const target = strOpt(options, "record") ?? strOpt(options, "activity") ?? null;
+          const items = listFiles(ctx, target, { includeRelated: boolOpt(options, "related"), kind: strOpt(options, "kind"), search: strOpt(options, "search") });
+          const limit = Math.min(1e3, numOpt(options, "limit") ?? 100);
+          return { total: items.length, files: items.slice(0, limit).map(fileOut) };
+        }, (r) => `${r.total} file(s)
+${table(r.files, ["id", "name", "mime", "size", "createdAt"])}`);
+      case "upload": {
+        if (!args.length) usage("files upload needs at least one path.", `Usage: agentcrm ${U$1.upload}`);
+        const record = strOpt(options, "record");
+        const activity = strOpt(options, "activity");
+        if (!record && !activity) usage("files upload needs --record <id> or --activity <id>.");
+        if (record && activity) usage("Give --record or --activity, not both.");
+        for (const p of args) readLocalFile(p);
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const { attachFile } = await import("./chunks/files-q8Xu5bft.mjs");
+          const files2 = await uploadLocalFiles(ctx, args, record ? [record] : []);
+          if (activity) for (const f of files2) await attachFile(ctx, f.id, { kind: "activity", id: activity });
+          const { requireFile } = await import("./chunks/store-5gqRSKXg.mjs");
+          return { uploaded: files2.map((f) => fileOut(requireFile(ctx.store, f.id))) };
+        }, (r) => `Uploaded ${r.uploaded.length} file(s)
+${table(r.uploaded, ["id", "name", "size"])}`);
+      }
+      case "get": {
+        const id = positional(args, 0, "file id", U$1.get);
+        const out = strOpt(options, "out");
+        if (!out) usage("files get needs --out <path>.");
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { getFile, getFileBytes } = await import("./chunks/files-q8Xu5bft.mjs");
+          const meta = getFile(ctx, id);
+          const bytes = await getFileBytes(ctx, id, { thumb: boolOpt(options, "thumb") });
+          writeFileSync(resolve(out), bytes);
+          return { id, name: meta.name, mime: meta.mime, bytes: bytes.length, path: resolve(out) };
+        }, (r) => `Wrote ${r.bytes} bytes (${r.name}) to ${r.path}`);
+      }
+      case "delete": {
+        const id = positional(args, 0, "file id", U$1.delete);
+        return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
+          const { getFile, deleteFile } = await import("./chunks/files-q8Xu5bft.mjs");
+          const meta = fileOut(getFile(ctx, id));
+          if (options.yes !== true) return { needsConfirmation: true, plan: { delete: meta } };
+          await deleteFile(ctx, id);
+          return { deleted: id };
+        }, (r) => "plan" in r && r.plan ? `Would delete ${r.plan.delete.name} (${r.plan.delete.id}). Re-run with --yes once the user agrees.` : `Deleted ${"deleted" in r ? r.deleted : id} (bytes purged by \`agentcrm compact\`).`);
+      }
+      case "usage":
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/files-q8Xu5bft.mjs")).fileUsage(ctx));
+      default:
+        usage(`Unknown files action "${action ?? ""}".`, "Use list, upload, get, delete or usage.");
+    }
+  }
+};
+async function recordImageAction(io, options, args) {
+  const [recordId, path] = args;
+  if (!recordId) usage("records image needs a record id.", "Usage: agentcrm records image <recordId> <path> | --remove [--field <id>]");
+  const remove = options.remove === true;
+  if (!remove && !path) usage("records image needs an image path (or --remove).");
+  const local = remove ? null : readLocalFile(path);
+  return withSession(io, options, { lock: true }, async ({ ctx }) => {
+    const { setRecordImage, clearRecordImage } = await import("./chunks/files-q8Xu5bft.mjs");
+    const field = strOpt(options, "field");
+    if (!local) {
+      const r = await clearRecordImage(ctx, recordId, field);
+      return { id: r.id, image: null };
+    }
+    const { guessMime, imageDimensions } = await import("./chunks/files-CjsPJSR6.mjs");
+    const mime = guessMime(local.name);
+    const res = await setRecordImage(ctx, recordId, field, { ...local, mime, ...imageDimensions(local.bytes) ?? {} });
+    return { id: res.record.id, image: fileOut(res.file) };
+  }, (r) => r.image ? `Image of ${r.id} set to ${r.image.name} (${r.image.id})` : `Image of ${r.id} removed`);
+}
+const files = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  ATTACH_OPTION,
+  fileOut,
+  filesCommand,
+  readLocalFile,
+  recordImageAction,
+  uploadLocalFiles
+}, Symbol.toStringTag, { value: "Module" }));
+function activityOut(a) {
+  return {
+    id: a.id,
+    type: a.type,
+    title: a.title,
+    ...a.body ? { body: a.body } : {},
+    targets: a.targets,
+    ...a.dueAt ? { dueAt: new Date(a.dueAt).toISOString() } : {},
+    ...a.doneAt ? { doneAt: new Date(a.doneAt).toISOString() } : {},
+    ...a.assigneeId ? { assigneeId: a.assigneeId } : {},
+    ...a.meta ? { meta: a.meta } : {},
+    ...a.attachments?.length ? { attachments: a.attachments } : {},
+    createdAt: new Date(a.createdAt).toISOString()
+  };
+}
+const targets = (ids) => ids.map((id) => ({ object: "", id }));
+function body(options) {
+  const v = options.body;
+  return typeof v === "string" ? readTextValue(v, "body") : void 0;
+}
+async function userRef(ctx, ref) {
+  if (!ref) return void 0;
+  const { usersOf } = await import("./chunks/store-5gqRSKXg.mjs");
+  const u = usersOf(ctx.store).find((x) => x.id === ref || x.email.toLowerCase() === ref.toLowerCase());
+  if (!u) usage(`No CRM user "${ref}".`, "`agentcrm users list` lists them.");
+  return u.id;
+}
+function attachPaths(options) {
+  const v = options.attach;
+  const paths = Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
+  for (const p of paths) readLocalFile(p);
+  return paths;
+}
+async function attachments(ctx, paths) {
+  if (!paths.length) return void 0;
+  return (await uploadLocalFiles(ctx, paths)).map((f) => f.id);
+}
+const RECORD_OPT = { name: "record", type: "string", description: "Record id the activity is attached to (repeatable).", multiple: true };
+const activitiesCommand = {
+  name: "activities",
+  usage: "activities <add|list|done> …",
+  summary: "Timeline entries: log calls, emails, meetings and notes on records; list a record's timeline (optionally with its related records' activities).",
+  subcommands: [
+    { name: "add", usage: `activities add --type <${ACTIVITY_TYPES.join("|")}> --title <t> [--body <md|@file>] --record <id>… [--meta <json>] [--due <date>] [--assignee <user>] [--attach <path>]…`, summary: "Log an activity (with attachments).", writes: true },
+    { name: "list", usage: "activities list [--record <id>] [--type <t>]… [--related] [--limit n]", summary: "Timeline, most recent first." },
+    { name: "done", usage: "activities done <id> [--undo]", summary: "Mark a task done (or reopen).", writes: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    { name: "type", type: "string", description: `Activity type: ${ACTIVITY_TYPES.join(", ")} (list: repeatable filter).`, multiple: true },
+    { name: "title", type: "string", description: "Title / subject." },
+    { name: "body", type: "string", description: "Markdown body, or @file." },
+    RECORD_OPT,
+    { name: "meta", type: "string", description: 'JSON metadata, e.g. {"durationMin":20} or {"startAt":…,"endAt":…}.' },
+    { name: "due", type: "string", description: "Due date (tasks): ISO date / datetime." },
+    { name: "assignee", type: "string", description: "Assignee user id or email." },
+    { name: "related", type: "boolean", description: "list: include activities of linked records." },
+    { name: "limit", type: "string", description: "Max items (default 50)." },
+    { name: "undo", type: "boolean", description: "done: reopen the task." },
+    ATTACH_OPTION
+  ],
+  async run({ io, options, positionals }) {
+    const [action, id] = positionals;
+    switch (action) {
+      case "add": {
+        const files2 = attachPaths(options);
+        const type2 = requireStr(options, "type");
+        if (!ACTIVITY_TYPES.includes(type2)) usage(`Unknown activity type "${type2}".`, `Types: ${ACTIVITY_TYPES.join(", ")}.`);
+        const title = requireStr(options, "title");
+        const recs = multiOpt(options, "record");
+        if (!recs.length && type2 !== "task") usage("activities add needs --record <id> (repeatable).");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const { addActivity } = await import("./chunks/activities-Cj_SIOay.mjs");
+          return activityOut(
+            await addActivity(ctx, {
+              type: type2,
+              title,
+              body: body(options),
+              targets: targets(recs),
+              meta: jsonObjectOpt(options, "meta"),
+              ...strOpt(options, "due") ? { dueAt: strOpt(options, "due") } : {},
+              ...strOpt(options, "assignee") ? { assigneeId: await userRef(ctx, strOpt(options, "assignee")) } : {},
+              attachments: await attachments(ctx, files2)
+            })
+          );
+        });
+      }
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { listActivities } = await import("./chunks/activities-Cj_SIOay.mjs");
+          const types = listOpt(options, "type");
+          const page = listActivities(ctx, { target: multiOpt(options, "record")[0], types, includeRelated: boolOpt(options, "related"), limit: Math.min(500, numOpt(options, "limit") ?? 50) });
+          return { total: page.total, activities: page.items.map(activityOut) };
+        }, (r) => `${r.total} activit${r.total === 1 ? "y" : "ies"}
+${table(r.activities, ["id", "type", "title", "createdAt"])}`);
+      case "done": {
+        if (!id) usage("activities done needs an id.");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => activityOut(await (await import("./chunks/activities-Cj_SIOay.mjs")).completeTask(ctx, id, !boolOpt(options, "undo"))));
+      }
+      default:
+        usage(`Unknown activities action "${action ?? ""}".`, "Use add, list or done.");
+    }
+  }
+};
+const notesCommand = {
+  name: "notes",
+  usage: "notes add <recordId> --body <markdown|@file> [--title <t>] [--attach <path>]…",
+  summary: "Add a note (Markdown, optional attachments) to a record's timeline.",
+  subcommands: [{ name: "add", usage: "notes add <recordId> --body <markdown|@file> [--title <t>] [--attach <path>]…", summary: "Add a note.", writes: true }],
+  options: [SITE_OPTION, AS_OPTION, { name: "body", type: "string", description: "Markdown, or @file." }, { name: "title", type: "string", description: "Title (default: first line)." }, ATTACH_OPTION],
+  async run({ io, options, positionals }) {
+    const [action, recordId] = positionals;
+    if (action !== "add") usage(`Unknown notes action "${action ?? ""}".`, "Use: notes add <recordId> --body …");
+    const id = positional(positionals, 1, "record id", "notes add <recordId> --body …");
+    const text = body(options);
+    if (!text?.trim()) usage("notes add needs --body.");
+    const files2 = attachPaths(options);
+    return withSession(io, options, { lock: true }, async ({ ctx }) => {
+      const ops = await import("./chunks/activities-Cj_SIOay.mjs");
+      const { recordOf } = await import("./chunks/store-5gqRSKXg.mjs");
+      const r = recordOf(ctx.store, id);
+      if (!files2.length || !r) return activityOut(await ops.addNote(ctx, id, text, strOpt(options, "title")));
+      return activityOut(await ops.addActivity(ctx, { type: "note", title: strOpt(options, "title") ?? "", body: text, targets: [{ object: r.object, id: r.id }], attachments: await attachments(ctx, files2) }));
+    });
+  }
+};
+const tasksCommand = {
+  name: "tasks",
+  usage: "tasks <list|add|done|reassign> …",
+  summary: "Tasks: list (open by default; by assignee, record, overdue, due soon), add with due date and assignee, mark done, reassign.",
+  subcommands: [
+    { name: "list", usage: "tasks list [--assignee <user|me>] [--record <id>] [--status open|done|all] [--overdue] [--due-within <days>] [--limit n]", summary: "Tasks sorted by due date." },
+    { name: "add", usage: "tasks add --title <t> [--due <date>] [--assignee <user|me>] [--record <id>]… [--body <md>] [--attach <path>]…", summary: "Create a task.", writes: true },
+    { name: "done", usage: "tasks done <id> [--undo]", summary: "Complete (or reopen) a task.", writes: true },
+    { name: "reassign", usage: "tasks reassign <id> --assignee <user>", summary: "Change the assignee.", writes: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    { name: "title", type: "string", description: "Task title." },
+    { name: "body", type: "string", description: "Details (Markdown or @file)." },
+    { name: "due", type: "string", description: "Due date / datetime (ISO)." },
+    { name: "assignee", type: "string", description: 'User id or email; "me" = the CLI user.' },
+    RECORD_OPT,
+    { name: "status", type: "string", description: "list: open (default), done or all." },
+    { name: "overdue", type: "boolean", description: "list: only overdue." },
+    { name: "due-within", type: "string", description: "list: due within N days." },
+    { name: "limit", type: "string", description: "Max items (default 50)." },
+    { name: "undo", type: "boolean", description: "done: reopen." },
+    ATTACH_OPTION
+  ],
+  async run({ io, options, positionals }) {
+    const [action, id] = positionals;
+    const assignee = async (ctx) => {
+      const a = strOpt(options, "assignee");
+      if (a === "me") return ctx.user?.id;
+      return userRef(ctx, a);
+    };
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { listTasks } = await import("./chunks/activities-Cj_SIOay.mjs");
+          const status = strOpt(options, "status") ?? "open";
+          if (!["open", "done", "all"].includes(status)) usage("--status must be open, done or all.");
+          const page = listTasks(ctx, { assigneeId: await assignee(ctx), target: multiOpt(options, "record")[0], status, overdue: boolOpt(options, "overdue"), dueWithinDays: numOpt(options, "due-within"), limit: Math.min(500, numOpt(options, "limit") ?? 50) });
+          return { total: page.total, tasks: page.items.map(activityOut) };
+        }, (r) => `${r.total} task(s)
+${table(r.tasks, ["id", "title", "dueAt", "assigneeId"])}`);
+      case "add": {
+        const title = requireStr(options, "title");
+        const files2 = attachPaths(options);
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const { addActivity } = await import("./chunks/activities-Cj_SIOay.mjs");
+          return activityOut(await addActivity(ctx, { type: "task", title, body: body(options), dueAt: strOpt(options, "due"), assigneeId: await assignee(ctx) ?? ctx.user?.id, targets: targets(multiOpt(options, "record")), attachments: await attachments(ctx, files2) }));
+        });
+      }
+      case "done":
+        if (!id) usage("tasks done needs a task id.");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => activityOut(await (await import("./chunks/activities-Cj_SIOay.mjs")).completeTask(ctx, id, !boolOpt(options, "undo"))));
+      case "reassign":
+        if (!id) usage("tasks reassign needs a task id.");
+        requireStr(options, "assignee");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => activityOut(await (await import("./chunks/activities-Cj_SIOay.mjs")).updateActivity(ctx, id, { assigneeId: await assignee(ctx) ?? null })));
+      default:
+        usage(`Unknown tasks action "${action ?? ""}".`, "Use list, add, done or reassign.");
+    }
+  }
+};
+async function recordOut(ctx, r, columns) {
+  const { recordLabel } = await import("./chunks/fields-B0bitgmr.mjs");
+  const { objectOf } = await import("./chunks/store-5gqRSKXg.mjs");
+  const fields = columns ? Object.fromEntries(columns.filter((c) => c in r.fields).map((c) => [c, r.fields[c]])) : r.fields;
+  return {
+    id: r.id,
+    object: r.object,
+    label: recordLabel(objectOf(ctx.store, r.object), r),
+    fields,
+    ...r.ownerId ? { ownerId: r.ownerId } : {},
+    createdAt: new Date(r.createdAt).toISOString(),
+    updatedAt: new Date(r.updatedAt).toISOString(),
+    ...r.deletedAt ? { deletedAt: new Date(r.deletedAt).toISOString() } : {}
+  };
+}
+const U = {
+  list: "records list --object <id> [--filter field:op:value]… [--sort field[:desc]] [--search <q>] [--view <id>] [--owner <userId>] [--limit n] [--offset n] [--columns a,b] [--deleted]",
+  get: "records get <id>",
+  create: "records create --object <id> [--fields <json|@file>] [--set key=value]… [--owner <userId>]",
+  update: "records update <id> [--fields <json|@file>] [--set key=value]… [--owner <userId>]",
+  delete: "records delete <id>… [--hard] [--yes]",
+  restore: "records restore <id>",
+  search: "records search <query> [--object <id>]… [--limit n]",
+  duplicates: "records duplicates --object <id> [--by email,domain,name,phone]",
+  merge: "records merge <primaryId> <duplicateId>… [--yes]",
+  image: "records image <recordId> <path> | --remove [--field <imageFieldId>]"
+};
+const recordsCommand = {
+  name: "records",
+  usage: "records <list|get|create|update|delete|restore|search|duplicates|merge|image> …",
+  summary: "Records of any object (companies, people, deals, custom objects): list with filters / sorts / pagination, get with relations and timeline counts, create, update (only the given fields), soft delete / restore, full-text search, find and merge duplicates.",
+  subcommands: [
+    { name: "list", usage: U.list, summary: `List records. Filter ops: ${FILTER_OPS.join(", ")}. Values: in/notIn comma-separated; dates YYYY-MM-DD, today, +30d.` },
+    { name: "get", usage: U.get, summary: "One record with its relations (both directions) and activity count." },
+    { name: "create", usage: U.create, summary: "Create a record (field ids from `objects get`; select fields take an option id or label).", writes: true },
+    { name: "update", usage: U.update, summary: "Update some fields (null clears a field).", writes: true },
+    { name: "delete", usage: U.delete, summary: "Soft delete (restorable until `compact`); --hard removes at once. Plan unless --yes.", writes: true, destructive: true },
+    { name: "restore", usage: U.restore, summary: "Restore a soft-deleted record.", writes: true },
+    { name: "search", usage: U.search, summary: "Full-text search (names, emails, domains, phones)." },
+    { name: "duplicates", usage: U.duplicates, summary: "Groups of likely duplicates (same email / domain / name / phone)." },
+    { name: "merge", usage: U.merge, summary: "Merge duplicates into the primary (empty fields filled, relations and activities moved). Plan unless --yes.", writes: true, destructive: true },
+    { name: "image", usage: U.image, summary: "Set the record's avatar / logo from a local image (the object's image field), or --remove it.", writes: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "object", type: "string", description: "Object id (companies, people, deals, …).", multiple: true },
+    { name: "filter", type: "string", description: "field:op:value (repeatable).", multiple: true },
+    { name: "sort", type: "string", description: "field[:asc|desc] (repeatable; --sort=-field also means desc).", multiple: true },
+    { name: "search", type: "string", description: "list: full-text filter." },
+    { name: "view", type: "string", description: "list: apply a saved view's filters and sorts." },
+    { name: "owner", type: "string", description: 'list: owned by this user id; create / update: set the owner ("" clears).' },
+    { name: "limit", type: "string", description: "Page size (default 50, max 500)." },
+    { name: "offset", type: "string", description: "Page offset." },
+    { name: "columns", type: "string", description: "list: only these field ids in the output (comma-separated)." },
+    { name: "deleted", type: "boolean", description: "list: only soft-deleted records." },
+    { name: "fields", type: "string", description: "create / update: field values as a JSON object or @file.json." },
+    { name: "set", type: "string", description: "create / update: key=value (repeatable; numbers / true / null / JSON parsed).", multiple: true },
+    { name: "hard", type: "boolean", description: "delete: remove immediately (no restore)." },
+    { name: "by", type: "string", description: "duplicates: email,domain,name,phone." },
+    { name: "remove", type: "boolean", description: "image: remove the record's image." },
+    { name: "field", type: "string", description: "image: image field id (default: the object's image field)." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action, ...args] = positionals;
+    const object = () => {
+      const o = listOpt(options, "object")?.[0];
+      if (!o) usage("--object is required.", "Objects: `agentcrm objects list`.");
+      return o;
+    };
+    switch (action) {
+      case "list": {
+        const objectId = object();
+        const columns = listOpt(options, "columns");
+        const filters = parseFilters(multiOpt(options, "filter"), FILTER_OPS);
+        const sorts = parseSorts(multiOpt(options, "sort"));
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { listRecords } = await import("./chunks/records-DoqiT9xR.mjs");
+          const page = listRecords(ctx, objectId, {
+            filters,
+            sorts,
+            search: strOpt(options, "search"),
+            viewId: strOpt(options, "view"),
+            ownerId: strOpt(options, "owner"),
+            offset: numOpt(options, "offset") ?? 0,
+            limit: Math.min(500, numOpt(options, "limit") ?? 50),
+            onlyDeleted: boolOpt(options, "deleted")
+          });
+          return { object: objectId, total: page.total, offset: page.offset, hasMore: page.hasMore, records: await Promise.all(page.items.map((r) => recordOut(ctx, r, columns))) };
+        }, (r) => `${r.total} record(s)${r.hasMore ? ` (showing ${r.records.length} from ${r.offset})` : ""}
+${table(r.records, ["id", "label", "updatedAt"])}`);
+      }
+      case "get": {
+        const id = positional(args, 0, "record id", U.get);
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { getRecordDetails } = await import("./chunks/records-DoqiT9xR.mjs");
+          const d = getRecordDetails(ctx, id);
+          return { ...await recordOut(ctx, d.record), relations: d.relations, related: d.inverse.filter((i) => i.records.length), activityCount: d.activityCount };
+        });
+      }
+      case "create": {
+        const objectId = object();
+        const fields = fieldsInput(options);
+        if (!Object.keys(fields).length) usage("records create needs --fields or --set.", `Usage: agentcrm ${U.create}`);
+        const owner = strOpt(options, "owner");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const { createRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          return recordOut(ctx, await createRecord(ctx, objectId, fields, owner ? { ownerId: owner } : {}));
+        }, (r) => `Created ${r.object} ${r.id} (${String(r.label)})`);
+      }
+      case "update": {
+        const id = positional(args, 0, "record id", U.update);
+        const fields = fieldsInput(options);
+        const owner = strOpt(options, "owner");
+        if (!Object.keys(fields).length && owner === void 0) usage("records update needs --fields, --set or --owner.");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const { updateRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          return recordOut(ctx, await updateRecord(ctx, id, fields, owner !== void 0 ? { ownerId: owner || null } : {}));
+        }, (r) => `Updated ${r.id} (${String(r.label)})`);
+      }
+      case "delete": {
+        if (!args.length) usage("records delete needs at least one id.", `Usage: agentcrm ${U.delete}`);
+        const hard = boolOpt(options, "hard");
+        return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
+          const { getRecord, deleteRecord, bulkDelete } = await import("./chunks/records-DoqiT9xR.mjs");
+          const { recordLabel } = await import("./chunks/fields-B0bitgmr.mjs");
+          const { objectOf } = await import("./chunks/store-5gqRSKXg.mjs");
+          const targets2 = args.map((id) => getRecord(ctx, id, { includeDeleted: true }));
+          const plan = { delete: targets2.map((r) => ({ id: r.id, object: r.object, label: recordLabel(objectOf(ctx.store, r.object), r) })), hard, restorable: !hard };
+          if (options.yes !== true) return { needsConfirmation: true, plan };
+          if (args.length === 1) return { deleted: [await deleteRecord(ctx, args[0], { hard })], hard };
+          return { ...await bulkDelete(ctx, args, { hard }), hard };
+        }, (r) => "needsConfirmation" in r && r.plan ? `Would delete ${r.plan.delete.length} record(s)${hard ? " permanently" : ""}. Re-run with --yes once the user agrees.` : `Deleted ${JSON.stringify(r.deleted)}`);
+      }
+      case "restore": {
+        const id = positional(args, 0, "record id", U.restore);
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const { restoreRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          return recordOut(ctx, await restoreRecord(ctx, id));
+        });
+      }
+      case "search": {
+        const query = args.join(" ").trim();
+        if (!query) usage("records search needs a query.", `Usage: agentcrm ${U.search}`);
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { searchRecords } = await import("./chunks/records-DoqiT9xR.mjs");
+          return searchRecords(ctx, query, { objects: listOpt(options, "object"), limit: Math.min(100, numOpt(options, "limit") ?? 20) });
+        });
+      }
+      case "duplicates": {
+        const objectId = object();
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const { findDuplicates } = await import("./chunks/dedupe-BepmsaHv.mjs");
+          const by = listOpt(options, "by");
+          const groups = findDuplicates(ctx, objectId, by ? { by } : {});
+          return { object: objectId, groups: groups.length, duplicates: groups };
+        });
+      }
+      case "merge": {
+        const [primary, ...dups] = args;
+        if (!primary || !dups.length) usage("records merge needs <primaryId> <duplicateId>….", `Usage: agentcrm ${U.merge}`);
+        return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
+          const { getRecord } = await import("./chunks/records-DoqiT9xR.mjs");
+          const all = [primary, ...dups].map((id) => getRecord(ctx, id));
+          const plan = { primary: await recordOut(ctx, all[0]), duplicates: await Promise.all(all.slice(1).map((r) => recordOut(ctx, r))) };
+          if (options.yes !== true) return { needsConfirmation: true, plan };
+          const { mergeRecords } = await import("./chunks/dedupe-BepmsaHv.mjs");
+          const res = await mergeRecords(ctx, primary, dups);
+          return { record: await recordOut(ctx, res.record), merged: res.merged, movedActivities: res.movedActivities };
+        }, (r) => "plan" in r && r.plan ? `Would merge ${r.plan.duplicates.length} duplicate(s) into ${r.plan.primary.id}. Re-run with --yes once the user agrees.` : "merged" in r ? `Merged ${r.merged.length} into ${r.record.id}` : "");
+      }
+      case "image":
+        return (await Promise.resolve().then(() => files)).recordImageAction(io, options, args);
+      default:
+        usage(`Unknown records action "${action ?? ""}".`, "Use list, get, create, update, delete, restore, search, duplicates, merge or image.");
+    }
+  }
+};
+const pipelinesCommand = {
+  name: "pipelines",
+  usage: "pipelines <list|move> …",
+  summary: "Pipelines and their stages (probability, open / won / lost); move a deal to a stage (updates probability; lostReason for lost stages).",
+  subcommands: [
+    { name: "list", usage: "pipelines list [--object <id>]", summary: "Pipelines with stages." },
+    { name: "move", usage: "pipelines move <recordId> <stage id or label> [--lost-reason <text>]", summary: "Move a record to a stage.", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, { name: "object", type: "string", description: "list: only this object's pipelines." }, { name: "lost-reason", type: "string", description: "move: why the deal was lost." }],
+  async run({ io, options, positionals }) {
+    const [action = "list", id, ...stage] = positionals;
+    if (action === "list") {
+      return withSession(
+        io,
+        options,
+        {},
+        async ({ ctx }) => (await import("./chunks/pipelines-DCdRBNBV.mjs")).listPipelines(ctx, strOpt(options, "object")),
+        (ps) => ps.map((p) => `${p.id} (${p.name}, ${p.object}): ${p.stages.map((s) => `${s.label} ${Math.round(s.probability * (s.probability <= 1 ? 100 : 1))}%`).join(" → ")}`).join("\n")
+      );
+    }
+    if (action === "move") {
+      if (!id || !stage.length) usage("pipelines move needs <recordId> <stage>.");
+      return withSession(io, options, { lock: true }, async ({ ctx }) => recordOut(ctx, await (await import("./chunks/pipelines-DCdRBNBV.mjs")).moveStage(ctx, id, stage.join(" "), { lostReason: strOpt(options, "lost-reason") })));
+    }
+    usage(`Unknown pipelines action "${action}".`, "Use list or move.");
+  }
+};
+const viewsCommand = {
+  name: "views",
+  usage: "views <list|create|delete> …",
+  summary: "Saved views (table / kanban) of an object: list, create with filters / sorts / columns, delete.",
+  subcommands: [
+    { name: "list", usage: "views list [--object <id>]", summary: "Views visible to the CLI user." },
+    { name: "create", usage: "views create --object <id> --name <n> [--type table|kanban] [--columns a,b] [--filter f:op:v]… [--sort f[:desc]] [--group-by <field>] [--shared]", summary: "Create a view.", writes: true },
+    { name: "delete", usage: "views delete <id> [--yes]", summary: "Delete a view. Plan unless --yes.", writes: true, destructive: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "object", type: "string", description: "Object id." },
+    { name: "name", type: "string", description: "View name." },
+    { name: "type", type: "string", description: "table (default) or kanban." },
+    { name: "columns", type: "string", description: "Column field ids, comma-separated." },
+    { name: "filter", type: "string", description: "field:op:value (repeatable).", multiple: true },
+    { name: "sort", type: "string", description: "field[:asc|desc] (repeatable).", multiple: true },
+    { name: "group-by", type: "string", description: "kanban: select field to group by." },
+    { name: "pipeline", type: "string", description: "kanban: pipeline id." },
+    { name: "shared", type: "boolean", description: "Visible to every user (admin)." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action = "list", id] = positionals;
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/views-fO_BM5U_.mjs")).listViews(ctx, strOpt(options, "object")), (vs) => table(vs, ["id", "object", "name", "type", "shared"]));
+      case "create": {
+        const type2 = strOpt(options, "type") ?? "table";
+        if (type2 !== "table" && type2 !== "kanban") usage("--type must be table or kanban.");
+        const input = {
+          object: requireStr(options, "object"),
+          name: requireStr(options, "name"),
+          type: type2,
+          ...listOpt(options, "columns") ? { columns: listOpt(options, "columns") } : {},
+          filters: parseFilters(multiOpt(options, "filter"), FILTER_OPS),
+          sorts: parseSorts(multiOpt(options, "sort")),
+          ...strOpt(options, "group-by") ? { groupBy: strOpt(options, "group-by") } : {},
+          ...strOpt(options, "pipeline") ? { pipelineId: strOpt(options, "pipeline") } : {},
+          shared: boolOpt(options, "shared")
+        };
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/views-fO_BM5U_.mjs")).createView(ctx, input));
+      }
+      case "delete":
+        if (!id) usage("views delete needs a view id.");
+        return withSession(io, options, { lock: options.yes === true }, async ({ ctx }) => {
+          const { getView, deleteView } = await import("./chunks/views-fO_BM5U_.mjs");
+          const v = getView(ctx, id);
+          if (options.yes !== true) return { needsConfirmation: true, plan: { delete: { id: v.id, name: v.name, object: v.object, shared: v.shared } } };
+          return deleteView(ctx, id);
+        });
+      default:
+        usage(`Unknown views action "${action}".`, "Use list, create or delete.");
+    }
+  }
+};
+const usersCommand = {
+  name: "users",
+  usage: "users <list|add|role|disable> …",
+  summary: `CRM users and roles (${USER_ROLES.join(", ")}): list, add, change role, disable / re-enable. Admin only for changes. (Firebase / git logins are created on that service.)`,
+  subcommands: [
+    { name: "list", usage: "users list [--all]", summary: "Users (--all includes disabled)." },
+    { name: "add", usage: "users add --email <e> [--name <n>] [--role admin|member|viewer]", summary: "Add a user.", writes: true },
+    { name: "role", usage: "users role <id|email> <admin|member|viewer>", summary: "Change a user's role.", writes: true },
+    { name: "disable", usage: "users disable <id|email> [--enable]", summary: "Disable (or re-enable) a user.", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, { name: "email", type: "string", description: "add: email." }, { name: "name", type: "string", description: "add: display name." }, { name: "role", type: "string", description: "add: role (default member)." }, { name: "all", type: "boolean", description: "list: include disabled users." }, { name: "enable", type: "boolean", description: "disable: re-enable instead." }],
+  async run({ io, options, positionals }) {
+    const [action = "list", ref, role] = positionals;
+    const resolveUser = async (ctx, r) => {
+      const { listUsers } = await import("./chunks/users-DI1BvS0f.mjs");
+      const u = listUsers(ctx, { includeDisabled: true }).find((x) => x.id === r || x.email.toLowerCase() === r.toLowerCase());
+      if (!u) usage(`No CRM user "${r}".`, "`agentcrm users list --all` lists them.");
+      return u;
+    };
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/users-DI1BvS0f.mjs")).listUsers(ctx, { includeDisabled: boolOpt(options, "all") }), (us) => table(us, ["id", "email", "name", "role", "disabled"]));
+      case "add": {
+        const r = strOpt(options, "role") ?? "member";
+        if (!USER_ROLES.includes(r)) usage(`--role must be one of ${USER_ROLES.join(", ")}.`);
+        const input = { email: requireStr(options, "email"), name: strOpt(options, "name"), role: r };
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/users-DI1BvS0f.mjs")).createUser(ctx, input));
+      }
+      case "role": {
+        if (!ref || !role) usage("users role needs <id|email> <role>.");
+        if (!USER_ROLES.includes(role)) usage(`Role must be one of ${USER_ROLES.join(", ")}.`);
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/users-DI1BvS0f.mjs")).setUserRole(ctx, (await resolveUser(ctx, ref)).id, role));
+      }
+      case "disable": {
+        const target = positional(positionals, 1, "user id or email", "users disable <id|email>");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/users-DI1BvS0f.mjs")).updateUser(ctx, (await resolveUser(ctx, target)).id, { disabled: !boolOpt(options, "enable") }));
+      }
+      default:
+        usage(`Unknown users action "${action}".`, "Use list, add, role or disable.");
+    }
+  }
+};
+const settingsCommand = {
+  name: "settings",
+  usage: "settings <get|set> …",
+  summary: "CRM settings (name, default currency, locale, timezone, week start, stale deal days).",
+  subcommands: [
+    { name: "get", usage: "settings get", summary: "Current settings." },
+    { name: "set", usage: "settings set [--set key=value]… [--data <json>]", summary: "Change settings (admin).", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, { name: "set", type: "string", description: "key=value (repeatable), e.g. --set staleDealDays=21 --set defaultCurrency=EUR.", multiple: true }, { name: "data", type: "string", description: "JSON object of settings, or @file." }],
+  async run({ io, options, positionals }) {
+    const [action = "get"] = positionals;
+    if (action === "get") return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/settings-BtvR_jdm.mjs")).getSettings(ctx));
+    if (action === "set") {
+      const patch = fieldsInput(options, "data");
+      if (!Object.keys(patch).length) usage("settings set needs --set key=value or --data.");
+      return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/settings-BtvR_jdm.mjs")).updateSettings(ctx, patch));
+    }
+    usage(`Unknown settings action "${action}".`, "Use get or set.");
+  }
+};
+function fromEnv(names, fields) {
+  if (names.length !== fields.length) {
+    throw new CliError("usage", `--from-env needs ${fields.length} variable name(s) (${fields.join(", ")}), comma-separated.`, void 0, 2);
+  }
+  return Object.fromEntries(
+    fields.map((field, i) => {
+      const value = process.env[names[i]];
+      if (!value) throw new CliError("env-missing", `Environment variable ${names[i]} is empty or not set.`);
+      return [field, value];
+    })
+  );
+}
+function fromGh(host) {
+  try {
+    const args = ["auth", "token", ...host ? ["--hostname", host] : []];
+    const token = execFileSync("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    if (!token) throw new Error("empty");
+    return { token };
+  } catch {
+    throw new CliError(
+      "gh-unavailable",
+      "Could not read a token from the GitHub CLI.",
+      "Install gh and run `gh auth login`, or create a fine-grained token and use `credentials set` without --from-gh."
+    );
+  }
+}
+function parseIni(text) {
+  const out = {};
+  let section = null;
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+    const s = /^\[([^\]]+)\]$/.exec(line);
+    if (s) {
+      section = out[s[1].trim()] = {};
+      continue;
+    }
+    const kv = /^([^=]+?)\s*=\s*(.*)$/.exec(line);
+    if (kv && section) section[kv[1].trim()] = kv[2].trim();
+  }
+  return out;
+}
+function fromAwsProfile(profile) {
+  const file2 = process.env.AWS_SHARED_CREDENTIALS_FILE || join(homedir(), ".aws", "credentials");
+  if (!existsSync(file2)) throw new CliError("aws-missing", `No aws credentials file at ${file2}.`, "Run `aws configure` first.");
+  const section = parseIni(readFileSync(file2, "utf8"))[profile];
+  if (!section?.aws_access_key_id || !section.aws_secret_access_key) {
+    throw new CliError("aws-profile-missing", `Profile "${profile}" has no access key pair in ${file2}.`);
+  }
+  return { accessKeyId: section.aws_access_key_id, secretAccessKey: section.aws_secret_access_key };
+}
+async function promptHidden(question) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) {
+    throw new CliError(
+      "needs-terminal",
+      "No terminal to type the secret in.",
+      "Ask the user to run this command themselves in their terminal (in Claude Code: prefix it with `!`), or pass --from-env / --from-gh / --from-aws-profile."
+    );
+  }
+  process.stderr.write(question);
+  stdin.setRawMode(true);
+  stdin.resume();
+  stdin.setEncoding("utf8");
+  return new Promise((resolve2, reject) => {
+    let value = "";
+    const done = (err) => {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.off("data", onData);
+      process.stderr.write("\n");
+      if (err) reject(err);
+      else resolve2(value);
+    };
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\r" || ch === "\n") return done();
+        if (ch === "") return done(new CliError("cancelled", "Cancelled."));
+        if (ch === "" || ch === "\b") value = value.slice(0, -1);
+        else value += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+function copyToClipboard(text) {
+  const candidates = process.platform === "darwin" ? [["pbcopy", []]] : process.platform === "win32" ? [["clip", []]] : [
+    ["wl-copy", []],
+    ["xclip", ["-selection", "clipboard"]],
+    ["xsel", ["--clipboard", "--input"]]
+  ];
+  for (const [cmd, args] of candidates) {
+    const res = spawnSync(cmd, args, { input: text, stdio: ["pipe", "ignore", "ignore"] });
+    if (res.status === 0) return cmd;
+  }
+  throw new CliError("no-clipboard", "No clipboard tool found (pbcopy, clip, wl-copy, xclip or xsel).", "Install one, or read the value from ~/.agentcrm/credentials.json yourself.");
+}
+const credentialsCommand = {
+  name: "credentials",
+  usage: "credentials <set|list|remove|copy|verify|types> [<type>:<name>] [--from-env VAR[,VAR]] [--from-gh] [--from-aws-profile <name>] [--generate]",
+  summary: "Store, list, copy, verify or remove access keys per account (<type>:<name>; types: s3, github, gitlab, firebase, passphrase, anthropic) in ~/.agentcrm/credentials.json (0600). `set` reads the secret from --from-env, --from-gh, --from-aws-profile, --generate (passphrases) or a hidden prompt the USER types in.",
+  subcommands: [
+    { name: "set", usage: "credentials set <type>:<name> [--from-env VAR[,VAR]] [--from-gh] [--from-aws-profile <p>] [--generate]", summary: "Store a credential (hidden prompt unless a --from-* source is given).", writes: true },
+    { name: "list", usage: "credentials list", summary: "Accounts stored on this computer (field names only) and the sites using them." },
+    { name: "remove", usage: "credentials remove <type>:<name>", summary: "Delete a stored credential.", writes: true },
+    { name: "copy", usage: "credentials copy <type>:<name> [--field <f>]", summary: "Put a secret on the clipboard without printing it (save the passphrase in a password manager)." },
+    { name: "verify", usage: "credentials verify <type>:<name> [--field <f>]", summary: "The USER pastes the value from their password manager at a hidden prompt: proves the saved copy is right." },
+    { name: "types", usage: "credentials types", summary: "Credential types, their fields and where to create them." }
+  ],
+  options: [
+    { name: "from-env", type: "string", description: "Read the value(s) from these environment variables (comma-separated, in field order — s3: KEY_ID,SECRET)." },
+    { name: "from-gh", type: "boolean", description: "github: take the token of the signed-in GitHub CLI (gh auth token)." },
+    { name: "from-aws-profile", type: "string", description: "s3: import the key pair of this aws CLI profile." },
+    { name: "generate", type: "boolean", description: "passphrase: generate a strong random passphrase." },
+    { name: "field", type: "string", description: "copy / verify: which field (default: the first)." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action = "list", account] = positionals;
+    if (action === "types") {
+      printResult(io, CREDENTIAL_TYPES, () => Object.entries(CREDENTIAL_TYPES).map(([type22, c]) => `${type22}: ${c.label} (${c.fields.join(", ")})
+  ${c.howTo}`).join("\n"));
+      return;
+    }
+    if (action === "list") {
+      const { sites } = listSites();
+      const list = listCredentials().map((c) => ({
+        ...c,
+        usedBy: sites.filter((s) => Object.values(s.credentials).includes(c.account)).map((s) => s.alias)
+      }));
+      printResult(io, list, () => list.length ? list.map((c) => `${c.account}  (${c.fields.join(", ")})${c.usedBy.length ? `  used by ${c.usedBy.join(", ")}` : ""}`).join("\n") : "No stored credentials.");
+      return;
+    }
+    if (!account) usage(`credentials ${action} needs an account, e.g. s3:main.`);
+    const { type: type2 } = parseAccount(account);
+    const spec = CREDENTIAL_TYPES[type2];
+    if (action === "remove") {
+      const removed = removeCredential(account);
+      printResult(io, { account, removed }, () => removed ? `Removed ${account}.` : `${account} was not stored.`);
+      return;
+    }
+    if (action === "copy" || action === "verify") {
+      const cred = requireCredential(account);
+      const field = strOpt(options, "field") ?? spec.fields[0];
+      const stored = cred.values[field];
+      if (!stored) usage(`${account} has no field "${field}".`, `Fields: ${Object.keys(cred.values).join(", ")}.`);
+      if (action === "copy") {
+        const tool = copyToClipboard(stored);
+        printResult(io, { account, field, copied: true, tool }, () => `Copied ${field} of ${account} to the clipboard.`);
+        return;
+      }
+      if (!process.stdin.isTTY) {
+        throw new CliError("needs-terminal", "verify reads the value the USER pastes in their own terminal.", `Ask the user to run it themselves (in Claude Code: \`! npx -y @fleox-agent-crm/agentcrm credentials verify ${account}\`).`);
+      }
+      try {
+        copyToClipboard("");
+      } catch {
+      }
+      io.err(`Paste the ${field} of ${account} from where you saved it (password manager), then press Enter.`);
+      const typed = Buffer.from((await promptHidden(`${field}: `)).trim());
+      const expected = Buffer.from(stored);
+      if (typed.length !== expected.length || !timingSafeEqual(typed, expected)) {
+        throw new CliError("mismatch", `That is not the ${field} of ${account}.`, `Copy it again (\`agentcrm credentials copy ${account}\`), save it again, and re-run verify.`);
+      }
+      printResult(io, { account, field, verified: true }, () => `${field} of ${account} verified.`);
+      return;
+    }
+    if (action !== "set") usage(`Unknown action "${action}".`, "Use set, list, remove, copy, verify or types.");
+    let values;
+    if (options.generate === true) {
+      if (type2 !== "passphrase") usage("--generate only applies to passphrase accounts.");
+      const { generatePassphrase } = await import("./chunks/index-CWrrF1wl.mjs");
+      values = { passphrase: generatePassphrase() };
+    } else if (typeof options["from-env"] === "string") {
+      values = fromEnv(options["from-env"].split(",").map((s) => s.trim()), spec.fields);
+    } else if (options["from-gh"] === true) {
+      if (type2 !== "github") usage("--from-gh only applies to github accounts.");
+      values = fromGh();
+    } else if (typeof options["from-aws-profile"] === "string") {
+      if (type2 !== "s3") usage("--from-aws-profile only applies to s3 accounts.");
+      values = fromAwsProfile(options["from-aws-profile"]);
+    } else {
+      io.err(`${spec.label} for ${account}. ${spec.howTo}`);
+      values = {};
+      for (const field of spec.fields) values[field] = await promptHidden(`${field}: `);
+    }
+    const saved = setCredential(account, values);
+    printResult(io, { account, type: type2, fields: Object.keys(saved.values) }, () => `Stored ${account} (${Object.keys(saved.values).join(", ")}).`);
+  }
+};
+async function dryRun(ctx, work) {
+  const [{ createMemoryStore }, { COLLECTIONS }, { createOpsContext }, { createPluginRegistry }] = await Promise.all([
+    import("./chunks/memory-WNR3VHUJ.mjs"),
+    import("./chunks/types-BOy9PUl7.mjs"),
+    import("./chunks/context-CxFfqS4D.mjs"),
+    import("./chunks/pluginRegistry-DyHtlkcr.mjs")
+  ]);
+  const initial = Object.fromEntries(COLLECTIONS.map((c) => [c, ctx.store.list(c).map((d) => structuredClone(d))]));
+  const store = createMemoryStore({ initial });
+  await store.ready();
+  const copy = createOpsContext(store, ctx.user, { now: ctx.now, plugins: createPluginRegistry(() => void 0) });
+  return { result: await work(copy), store };
+}
+const CASCADE_OPTION = { name: "cascade", type: "boolean", description: "enable / disable: also enable the dependencies / disable the dependents." };
+function parseJsonValue(raw, name2) {
+  const text = readTextValue(raw, name2);
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    usage(`--${name2} is not valid JSON: ${err.message}`, `Example: --${name2} '{"targets":{"owner":50000}}' or --${name2} @config.json`);
+  }
+}
+const modulesCommand = {
+  name: "modules",
+  usage: "modules <list|get|enable|disable|config> …",
+  summary: "Workspace modules (Settings → Modules): built-in features (dashboard, deals, reports, forms, tasks, automations, integrations, assistant…) and installed extension modules. Disabling hides pages, navigation, widgets and owned objects for everyone without deleting data. enable / disable / config set print a plan unless --yes.",
+  subcommands: [
+    { name: "list", usage: "modules list", summary: "Modules with category, source, enabled / required state and dependencies." },
+    { name: "get", usage: "modules get <id>", summary: "One module (dependents, missing dependencies, owned objects, settings section)." },
+    { name: "enable", usage: "modules enable <id> [--cascade] [--yes]", summary: "Enable a module (--cascade also enables its dependencies).", writes: true },
+    { name: "disable", usage: "modules disable <id> [--cascade] [--yes]", summary: "Disable a module (--cascade also disables the modules depending on it).", writes: true, destructive: true },
+    { name: "config", usage: "modules config get <id> | modules config set <id> --value <json|@file|-> [--yes] | modules config set <id> --clear [--yes]", summary: "Read or replace a module's configuration (JSON ≤ 256 KB, never secrets).", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, YES_OPTION, CASCADE_OPTION, { name: "value", type: "string", description: "config set: the new configuration as JSON, @file or - (stdin)." }, { name: "clear", type: "boolean", description: "config set: remove the module's configuration." }],
+  async run({ io, options, positionals }) {
+    const [action = "list"] = positionals;
+    const apply = options.yes === true;
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/modules-CqdVQVJb.mjs")).listModules(ctx), (rows) => table(
+          rows.map((m) => ({ ...m, enabled: m.enabled ? "yes" : "no", required: m.required ? "yes" : "", dependsOn: m.dependsOn.join(",") })),
+          ["id", "name", "category", "source", "enabled", "required", "dependsOn"]
+        ));
+      case "get": {
+        const id = positional(positionals, 1, "module id", "modules get <id>");
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/modules-CqdVQVJb.mjs")).getModule(ctx, id));
+      }
+      case "enable":
+      case "disable": {
+        const id = positional(positionals, 1, "module id", `modules ${action} <id> [--cascade] [--yes]`);
+        const enabled = action === "enable";
+        const cascade = boolOpt(options, "cascade");
+        return withSession(io, options, { lock: apply }, async ({ ctx }) => {
+          const { setModuleEnabled } = await import("./chunks/modules-CqdVQVJb.mjs");
+          if (apply) return setModuleEnabled(ctx, id, enabled, { cascade });
+          const { result } = await dryRun(ctx, (copy) => setModuleEnabled(copy, id, enabled, { cascade }));
+          return { needsConfirmation: true, plan: result };
+        }, (r) => "needsConfirmation" in r ? `${r.plan.changed.length ? `Would ${action}: ${r.plan.changed.map((c) => `${c.id} → ${c.enabled ? "on" : "off"}`).join(", ")}` : `${id} is already ${enabled ? "enabled" : "disabled"}`}.
+Nothing changed — re-run with --yes once the user agrees.` : r.changed.length ? `Changed: ${r.changed.map((c) => `${c.id} → ${c.enabled ? "on" : "off"}`).join(", ")}` : `${id} was already ${enabled ? "enabled" : "disabled"}.`);
+      }
+      case "config": {
+        const sub = positionals[1];
+        const id = positional(positionals, 2, "module id", "modules config <get|set> <id>");
+        if (sub === "get") return withSession(io, options, {}, async ({ ctx }) => ({ id, config: (await import("./chunks/modules-CqdVQVJb.mjs")).getModuleConfig(ctx, id) ?? null }));
+        if (sub !== "set") usage(`Unknown modules config action "${sub ?? ""}".`, "Use modules config get <id> or modules config set <id> --value <json>.");
+        const clear = boolOpt(options, "clear");
+        const raw = strOpt(options, "value");
+        if (!clear && raw === void 0) usage("modules config set needs --value <json|@file|-> (or --clear).");
+        const value = clear ? null : parseJsonValue(raw, "value");
+        return withSession(io, options, { lock: apply }, async ({ ctx }) => {
+          const mod = await import("./chunks/modules-CqdVQVJb.mjs");
+          mod.getModule(ctx, id);
+          const before = mod.getModuleConfig(ctx, id) ?? null;
+          if (apply) return { id, config: await mod.setModuleConfig(ctx, id, value) ?? null, before };
+          const { result } = await dryRun(ctx, (copy) => mod.setModuleConfig(copy, id, value));
+          return { needsConfirmation: true, plan: { id, before, after: result ?? null } };
+        });
+      }
+      default:
+        usage(`Unknown modules action "${action}".`, "Use list, get, enable, disable or config.");
+    }
+  }
+};
+const IMAGE_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon"
+};
+function imageDataUrl(file2) {
+  const abs = resolve(file2);
+  if (!existsSync(abs) || !statSync(abs).isFile()) usage(`${file2} does not exist.`);
+  const type2 = IMAGE_TYPES[extname(abs).toLowerCase()];
+  if (!type2) usage(`${file2}: unsupported image type.`, `Use ${Object.keys(IMAGE_TYPES).join(", ")} (≤ 200 KB).`);
+  return `data:${type2};base64,${readFileSync(abs).toString("base64")}`;
+}
+function view(a, full) {
+  if (full) return { ...a };
+  const { logo, favicon, customCss, ...rest } = a;
+  const kb2 = (s) => Math.round((s.length - s.indexOf(",") - 1) * 3 / 4 / 1024);
+  return {
+    ...rest,
+    logo: logo ? `${logo.slice(5, logo.indexOf(";"))}, ${kb2(logo)} KB` : null,
+    favicon: favicon ? `${favicon.slice(5, favicon.indexOf(";"))}, ${kb2(favicon)} KB` : null,
+    customCss: customCss ? `${new TextEncoder().encode(customCss).length} bytes` : null
+  };
+}
+function diff(before, after) {
+  const out = {};
+  for (const k of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
+    if (JSON.stringify(before[k] ?? null) !== JSON.stringify(after[k] ?? null)) out[k] = { from: before[k] ?? null, to: after[k] ?? null };
+  }
+  return out;
+}
+const SET_FLAGS = [
+  ["accent", "accent"],
+  ["neutral", "neutral"],
+  ["radius", "radius"],
+  ["density", "density"],
+  ["font", "font"],
+  ["sidebar", "sidebar"],
+  ["mode", "defaultMode"],
+  ["buttons", "buttons"],
+  ["contrast", "contrast"],
+  ["theme", "themeId"]
+];
+function setPatch(options) {
+  const patch = {};
+  for (const [opt, key] of SET_FLAGS) {
+    const v = strOpt(options, opt);
+    if (v === void 0) continue;
+    patch[key] = v === "null" || v === "" ? null : v;
+  }
+  if (!Object.keys(patch).length) usage("appearance set needs at least one value.", `Options: ${SET_FLAGS.map(([o]) => `--${o}`).join(", ")} ("null" resets one to its default).`);
+  return patch;
+}
+const appearanceCommand = {
+  name: "appearance",
+  usage: "appearance <get|presets|set|preset|logo|favicon|css|reset> …",
+  summary: "Workspace appearance (Settings → Appearance) for every user: accent color (a full scale is generated from one hex), neutral grays, radius, density, font, sidebar style, default light / dark mode, buttons, contrast, presets and theme extensions, logo, favicon, custom CSS. Changes print a plan (before → after) unless --yes.",
+  subcommands: [
+    { name: "get", usage: "appearance get [--full]", summary: "The effective appearance (defaults ← selected theme ← workspace values)." },
+    { name: "presets", usage: "appearance presets", summary: "Built-in presets and installed theme extensions." },
+    { name: "set", usage: "appearance set [--accent <#hex>] [--neutral zinc|slate|stone|gray|neutral] [--radius none|sm|md|lg|xl] [--density compact|comfortable] [--font <id>] [--sidebar default|dark|accent] [--mode system|light|dark] [--buttons neutral|accent] [--contrast normal|high] [--theme <id>] [--yes]", summary: 'Change some values ("null" resets one).', writes: true },
+    { name: "preset", usage: "appearance preset <id> [--yes]", summary: "Apply a preset (default, ocean, forest, sunset, graphite, rose, high-contrast) or an installed theme; logo, favicon and custom CSS are kept.", writes: true },
+    { name: "logo", usage: "appearance logo <file.png|svg|jpg> [--yes] | appearance logo --remove [--yes]", summary: "Set or remove the workspace logo (≤ 200 KB).", writes: true },
+    { name: "favicon", usage: "appearance favicon <file> [--yes] | appearance favicon --remove [--yes]", summary: "Set or remove the favicon (≤ 200 KB).", writes: true },
+    { name: "css", usage: "appearance css <file.css|-> [--yes] | appearance css --remove [--yes]", summary: "Replace the custom CSS of the workspace (≤ 50 KB, plain CSS).", writes: true },
+    { name: "reset", usage: "appearance reset [--branding] [--yes]", summary: "Back to the defaults (keeps logo / favicon unless --branding).", writes: true, destructive: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "accent", type: "string", description: "set: accent color #rrggbb." },
+    { name: "neutral", type: "string", description: "set: zinc, slate, stone, gray or neutral." },
+    { name: "radius", type: "string", description: "set: none, sm, md, lg or xl." },
+    { name: "density", type: "string", description: "set: compact or comfortable." },
+    { name: "font", type: "string", description: "set: system (no network) or a Google font id (inter, geist, roboto, ibm-plex-sans…)." },
+    { name: "sidebar", type: "string", description: "set: default, dark or accent." },
+    { name: "mode", type: "string", description: "set: default color mode — system, light or dark (users who never chose)." },
+    { name: "buttons", type: "string", description: "set: primary buttons neutral or accent." },
+    { name: "contrast", type: "string", description: "set: normal or high." },
+    { name: "theme", type: "string", description: 'set: installed theme extension id to use ("null" clears it).' },
+    { name: "remove", type: "boolean", description: "logo / favicon / css: remove it." },
+    { name: "branding", type: "boolean", description: "reset: also remove the logo and favicon." },
+    { name: "full", type: "boolean", description: "get: include the logo / favicon data URLs and the custom CSS." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action = "get"] = positionals;
+    const apply = options.yes === true;
+    const full = boolOpt(options, "full");
+    const appearance = () => import("./chunks/appearance-BaShelzt.mjs");
+    const change = (describe, op) => withSession(io, options, { lock: apply }, async ({ ctx }) => {
+      const before = view((await appearance()).getAppearance(ctx), full);
+      if (apply) {
+        const after = view(await op(ctx), full);
+        return { applied: describe, appearance: after, changes: diff(before, after) };
+      }
+      const { result } = await dryRun(ctx, op);
+      return { needsConfirmation: true, plan: { action: describe, changes: diff(before, view(result, full)) } };
+    }, (r) => {
+      const changes = r.plan ? r.plan.changes : r.changes ?? {};
+      const lines = Object.entries(changes).map(([k, c]) => `  ${k}: ${JSON.stringify(c.from)} → ${JSON.stringify(c.to)}`);
+      return [`${r.plan ? "Would apply" : "Applied"}: ${describe}`, ...lines.length ? lines : ["  (no visible change)"], ...r.plan ? ["Nothing changed — re-run with --yes once the user agrees."] : []].join("\n");
+    });
+    switch (action) {
+      case "get":
+        return withSession(io, options, {}, async ({ ctx }) => {
+          const ops = await appearance();
+          const doc = ops.getAppearanceDoc(ctx);
+          const explicit = doc ? Object.keys(doc).filter((k) => !["id", "updatedAt", "updatedBy"].includes(k)) : [];
+          return { appearance: view(ops.getAppearance(ctx), full), explicit };
+        }, (r) => Object.entries(r.appearance).map(([k, v]) => `${k.padEnd(12)} ${v ?? "—"}${r.explicit.includes(k) ? "" : "  (default)"}`).join("\n"));
+      case "presets":
+        return withSession(io, options, {}, async ({ ctx }) => (await appearance()).listPresets(ctx), (rows) => table(rows.map((p) => ({ id: p.id, name: p.name, source: p.source, accent: p.values.accent ?? "", enabled: p.enabled === void 0 ? "" : p.enabled ? "yes" : "no", description: p.description })), ["id", "name", "source", "accent", "enabled", "description"]));
+      case "set": {
+        const patch = setPatch(options);
+        return change(`set ${Object.entries(patch).map(([k, v]) => `${k}=${v ?? "default"}`).join(", ")}`, async (ctx) => (await appearance()).setAppearance(ctx, patch));
+      }
+      case "preset": {
+        const id = positional(positionals, 1, "preset or theme id", "appearance preset <id>");
+        return change(`preset ${id}`, async (ctx) => (await appearance()).applyPreset(ctx, id));
+      }
+      case "logo":
+      case "favicon": {
+        const remove = boolOpt(options, "remove");
+        const file2 = positionals[1];
+        if (!remove && !file2) usage(`appearance ${action} needs an image file (or --remove).`, `Usage: agentcrm appearance ${action} <file.png|svg|jpg>`);
+        const dataUrl = remove ? null : imageDataUrl(file2);
+        return change(remove ? `remove the ${action}` : `${action} ${file2}`, async (ctx) => (await appearance()).setLogo(ctx, dataUrl, { kind: action }));
+      }
+      case "css": {
+        const remove = boolOpt(options, "remove");
+        const source = positionals[1];
+        if (!remove && !source) usage("appearance css needs a CSS file or - (stdin), or --remove.");
+        const css = remove ? null : readTextValue(source === "-" ? "-" : `@${source}`, "file");
+        return change(remove ? "remove the custom CSS" : `custom CSS from ${source === "-" ? "stdin" : source}`, async (ctx) => (await appearance()).setAppearance(ctx, { customCss: css }));
+      }
+      case "reset": {
+        const branding = boolOpt(options, "branding");
+        return change(`reset${branding ? " (including logo and favicon)" : ""}`, async (ctx) => (await appearance()).resetAppearance(ctx, { branding }));
+      }
+      default:
+        usage(`Unknown appearance action "${action}".`, "Use get, presets, set, preset, logo, favicon, css or reset.");
+    }
+  }
+};
+const TRUST_NOTE = "Installing runs this extension's code in the admin (and in CLI / MCP sessions) with the rights of the user who opens it — admins included. Only install code from an author you trust.";
+function kb(n) {
+  return `${(n / 1024).toFixed(1)} KB`;
+}
+async function scaffold({ io, options, positionals }) {
+  const [, kind, id] = positionals;
+  if (kind !== "module" && kind !== "theme") usage("ext new needs module or theme, then an id.", "e.g. agentcrm ext new module my-module");
+  if (!id) usage(`ext new ${kind} needs an id (lowercase, dashes), e.g. ext new ${kind} my-${kind}.`);
+  const dir = resolve(strOpt(options, "dir") ?? id);
+  if (existsSync(dir) && readdirSync(dir).length > 0 && !boolOpt(options, "force")) {
+    throw new CliError("dir-not-empty", `${dir} already exists and is not empty.`, "Pick another --dir (or --force to write into it).", 2);
+  }
+  const { scaffoldExtension } = await import("./chunks/extScaffold-DqxI7R1e.mjs");
+  const res = scaffoldExtension({ kind, id, dir, name: strOpt(options, "name"), description: strOpt(options, "description"), author: strOpt(options, "author") });
+  printResult(io, res, () => [`Created ${kind} "${id}" in ${dir}:`, ...res.files.map((f) => `  ${f}`), "", "Next:", ...res.next.map((n) => `  ${n}`)].join("\n"));
+}
+async function check({ io, options, positionals }) {
+  const target = positionals[1] ?? ".";
+  const kind = strOpt(options, "kind");
+  if (kind && kind !== "module" && kind !== "theme") usage("--kind is module or theme.");
+  const { readRawPackage } = await import("./chunks/extPackage-BGl5Oqs8.mjs");
+  const { checkExtension } = await import("./chunks/extCheck--7lmVvl7.mjs");
+  const raw = await readRawPackage(target);
+  const report = await checkExtension(raw, { kind, callTools: !boolOpt(options, "no-call") });
+  printResult(io, report, () => {
+    const lines = [
+      `${report.valid ? "PASS" : "FAIL"}  ${report.kind ?? "?"} ${report.id ?? "?"} ${report.version ?? ""} (apiVersion ${report.apiVersion ?? "?"}, admin API ${report.hostApi.min} – ${report.hostApi.version}) — bundle ${kb(report.size.bundle)}${report.size.style ? `, style ${kb(report.size.style)}` : ""}`,
+      ...report.errors.map((e) => `  error  [${e.code}] ${e.message}${e.hint ? `
+         → ${e.hint}` : ""}`),
+      ...report.warnings.map((w) => `  warn   [${w.code}] ${w.message}${w.hint ? `
+         → ${w.hint}` : ""}`)
+    ];
+    const r = report.registered;
+    if (r) {
+      if (r.routes.length) lines.push(`  routes: ${r.routes.join(", ")}`);
+      if (r.navItems.length) lines.push(`  navigation: ${r.navItems.map((n) => `${n.id} → ${n.to}`).join(", ")}`);
+      for (const [slot, ids] of Object.entries(r.slots)) lines.push(`  slot ${slot}: ${ids.join(", ")}`);
+      if (r.settingsPage) lines.push("  settings page: Settings → Modules → " + report.name);
+      if (r.aiTools.length) lines.push(`  AI tools: ${r.aiTools.map((t) => `${t.name}${t.mutating ? " (writes)" : ""}`).join(", ")}`);
+      if (r.automationActions.length) lines.push(`  automation actions: ${r.automationActions.map((a) => a.id).join(", ")}`);
+      if (r.hooks.actions.length || r.hooks.filters.length) lines.push(`  hooks: ${[...r.hooks.actions, ...r.hooks.filters].join(", ")}`);
+      for (const c of report.toolCalls ?? []) lines.push(`  call ${c.name}({}): ${c.ok ? "ok" : `failed — ${c.error}`}`);
+    }
+    if (report.theme) lines.push(`  theme "${report.theme.name}": ${Object.entries(report.theme.appearance).map(([k, v]) => `${k}=${String(v)}`).join(", ")}${report.theme.css ? ` + ${kb(report.theme.css)} CSS` : ""}`);
+    return lines.join("\n");
+  });
+  return report.valid ? 0 : 1;
+}
+async function pack({ io, options, positionals }) {
+  const target = positionals[1] ?? ".";
+  const { readPackage } = await import("./chunks/extPackage-BGl5Oqs8.mjs");
+  const { raw, pkg: pkg2 } = await readPackage(target);
+  if (raw.sourceType === "zip") usage("ext pack takes a project or an unpacked folder, not a .zip.");
+  const { packExtension } = await import("./chunks/package-DWbn3t2R.mjs");
+  const bytes = await packExtension(pkg2);
+  const out = resolve(strOpt(options, "out") ?? join(raw.source, `${pkg2.manifest.id}-${pkg2.manifest.version}.zip`));
+  mkdirSync(dirname(out), { recursive: true });
+  writeFileSync(out, bytes);
+  const files2 = ["manifest.json", ...Object.keys(pkg2.files)];
+  printResult(io, { zip: out, bytes: bytes.length, id: pkg2.manifest.id, kind: pkg2.manifest.kind, version: pkg2.manifest.version, files: files2 }, () => `Packed ${basename(out)} (${files2.join(", ")}, ${kb(bytes.length)})`);
+}
+async function install({ io, options, positionals }) {
+  const target = positional(positionals, 1, "ZIP or folder", "ext install <zip|dir> [--site <alias>] [--yes]");
+  const { readPackage } = await import("./chunks/extPackage-BGl5Oqs8.mjs");
+  const { pkg: pkg2, raw } = await readPackage(target);
+  const apply = options.yes === true;
+  const disabled = boolOpt(options, "disabled");
+  return withSession(io, options, { lock: apply }, async (s) => {
+    const ext = await import("./chunks/extensions-BP1k60md.mjs");
+    const existing = s.store.get("extensions", pkg2.manifest.id);
+    const m = pkg2.manifest;
+    const plan = {
+      id: m.id,
+      kind: m.kind,
+      name: m.name,
+      version: m.version,
+      apiVersion: m.apiVersion,
+      description: m.description,
+      author: m.author ?? null,
+      homepage: m.homepage ?? null,
+      dependsOn: m.dependsOn ?? [],
+      mode: existing ? "upgrade" : "install",
+      ...existing?.manifest ? { from: existing.manifest.version, currentlyEnabled: !!existing.enabled } : {},
+      size: { bundle: new TextEncoder().encode(pkg2.files["bundle.js"]).length, style: pkg2.files["style.css"] ? new TextEncoder().encode(pkg2.files["style.css"]).length : 0, ...raw.zipBytes ? { zip: raw.zipBytes } : {} },
+      source: raw.source,
+      warning: TRUST_NOTE
+    };
+    if (!apply) {
+      const { result: result2 } = await dryRun(s.ctx, (copy) => ext.installExtension(copy, pkg2, disabled ? { enabled: false } : {}));
+      return { needsConfirmation: true, plan: { ...plan, enabled: result2.enabled, warnings: result2.warnings } };
+    }
+    const result = await ext.installExtension(s.ctx, pkg2, disabled ? { enabled: false } : {});
+    const report = await s.extensions.sync();
+    const { getLoadedExtension } = await import("./chunks/registry-Ceexawxl.mjs");
+    const loaded = getLoadedExtension(m.id);
+    const failure = report?.failed.find((f) => f.id === m.id || f.id === "*");
+    if (failure && !loaded) return { ...result, author: m.author ?? null, load: { status: "error", error: failure.error } };
+    return { ...result, author: m.author ?? null, load: loaded ? { status: loaded.status, ...loaded.error ? { error: loaded.error } : {} } : { status: result.enabled ? s.extensions.safeMode ? "skipped" : "unknown" : "disabled" } };
+  }, (r) => r.needsConfirmation ? [
+    `Would ${r.plan.mode} ${r.plan.kind} "${r.plan.name}" (${r.plan.id}) ${r.plan.mode === "upgrade" ? `${r.plan.from} → ` : ""}${r.plan.version}${r.plan.author ? ` by ${r.plan.author}` : ""}${r.plan.enabled ? "" : " (disabled)"}`,
+    `  apiVersion ${r.plan.apiVersion}, bundle ${kb(r.plan.size.bundle)}${r.plan.dependsOn.length ? `, needs ${r.plan.dependsOn.join(", ")}` : ""}`,
+    ...r.plan.warnings.map((w) => `  note: ${w}`),
+    `  ${r.plan.warning}`,
+    "Nothing changed — re-run with --yes once the user agrees."
+  ].join("\n") : `${r.mode === "upgrade" ? `Upgraded ${r.previousVersion} → ` : "Installed "}${r.id} ${r.version} (${r.enabled ? "enabled" : "disabled"}; load: ${r.load.status}${"error" in r.load ? ` — ${r.load.error}` : ""})${r.warnings.length ? `
+  ${r.warnings.join("\n  ")}` : ""}`);
+}
+const extCommand = {
+  name: "ext",
+  usage: "ext <new|check|pack|install|list|enable|disable|uninstall|export> …",
+  summary: "Extensions (modules and themes loaded at runtime, no rebuild): new module|theme <id> scaffolds a project (Vite, typings, i18n en/fr), check <dir|zip> validates and loads the bundle like the admin and lists what it registers (exit 1 on errors), pack <dir> builds the ZIP, install <zip|dir> adds it to a CRM (plan first; installing runs code with admin rights), list, enable / disable, uninstall, export (download as ZIP).",
+  subcommands: [
+    { name: "new", usage: "ext new <module|theme> <id> [--dir <path>] [--name <name>] [--description <text>] [--author <name>] [--force]", summary: "Scaffold a standalone extension project (package.json, vite.config.ts, tsconfig + runtime typings, src/index.tsx, README).", writes: true },
+    { name: "check", usage: "ext check [<dir|zip>] [--kind module|theme] [--no-call]", summary: "Validate manifest, ids, apiVersion, sizes, imports; load the bundle in a throw-away CRM and report routes, nav, slots, AI tools, automation actions, theme values." },
+    { name: "pack", usage: "ext pack [<dir>] [--out <file.zip>]", summary: "ZIP manifest.json + bundle.js (+ style.css) for Settings → Modules → Install or `ext install`.", writes: true },
+    { name: "install", usage: "ext install <zip|dir> [--site <alias>] [--disabled] [--yes]", summary: "Install or upgrade an extension on a CRM. Prints the plan (id, version, author, upgrade, size) unless --yes.", writes: true, destructive: true },
+    { name: "list", usage: "ext list [--kind module|theme]", summary: "Installed extensions with version, enabled state and load status in this process." },
+    { name: "enable", usage: "ext enable <id> [--cascade] [--yes]", summary: "Enable an installed extension (plan unless --yes).", writes: true },
+    { name: "disable", usage: "ext disable <id> [--cascade] [--yes]", summary: "Disable it without uninstalling (plan unless --yes).", writes: true },
+    { name: "uninstall", usage: "ext uninstall <id> [--force] [--yes]", summary: "Remove an extension (its module configuration is kept). Plan unless --yes.", writes: true, destructive: true },
+    { name: "export", usage: "ext export <id> [--out <file.zip>]", summary: "Download an installed extension as its ZIP." }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "dir", type: "string", description: "new: target folder (default: ./<id>)." },
+    { name: "name", type: "string", description: "new: display name." },
+    { name: "description", type: "string", description: "new: one-sentence description." },
+    { name: "author", type: "string", description: "new: author shown in the install plan and Settings → Modules." },
+    { name: "force", type: "boolean", description: "new: write into a non-empty folder. uninstall: even if enabled modules depend on it." },
+    { name: "kind", type: "string", description: "check: expected kind. list: only modules or themes." },
+    { name: "no-call", type: "boolean", description: "check: don't smoke-call the AI tools on the demo data." },
+    { name: "out", type: "string", description: "pack / export: ZIP path (default: <dir>/<id>-<version>.zip, ./<id>-<version>.zip)." },
+    { name: "disabled", type: "boolean", description: "install: install it disabled." },
+    { name: "cascade", type: "boolean", description: "enable / disable: also enable the dependencies / disable the dependents." }
+  ],
+  async run(ctx) {
+    const { io, options, positionals } = ctx;
+    const [action] = positionals;
+    const apply = options.yes === true;
+    switch (action) {
+      case "new":
+        return scaffold(ctx);
+      case "check":
+        return check(ctx);
+      case "pack":
+        return pack(ctx);
+      case "install":
+        return install(ctx);
+      case "list": {
+        const kind = strOpt(options, "kind");
+        if (kind && kind !== "module" && kind !== "theme") usage("--kind is module or theme.");
+        return withSession(io, options, {}, async (s) => {
+          const { listExtensions } = await import("./chunks/extensions-BP1k60md.mjs");
+          const { getLoadedExtension } = await import("./chunks/registry-Ceexawxl.mjs");
+          return listExtensions(s.ctx, kind ? { kind } : {}).map((e) => ({ ...e, load: s.extensions.safeMode ? "skipped" : getLoadedExtension(e.id)?.status ?? (e.enabled ? "not loaded" : "disabled"), ...getLoadedExtension(e.id)?.error ? { loadError: getLoadedExtension(e.id)?.error } : {} }));
+        }, (rows) => table(rows.map((r) => ({ ...r, enabled: r.enabled ? "yes" : "no" })), ["id", "kind", "name", "version", "enabled", "load", "author"]));
+      }
+      case "enable":
+      case "disable": {
+        const id = positional(positionals, 1, "extension id", `ext ${action} <id> [--yes]`);
+        const enabled = action === "enable";
+        const cascade = boolOpt(options, "cascade");
+        return withSession(io, options, { lock: apply }, async (s) => {
+          const ext = await import("./chunks/extensions-BP1k60md.mjs");
+          const before = ext.getExtension(s.ctx, id);
+          if (!apply) {
+            const { result } = await dryRun(s.ctx, async (copy) => {
+              await ext.setExtensionEnabled(copy, id, enabled, { cascade });
+              return (await import("./chunks/modules-CqdVQVJb.mjs")).moduleStates(copy.store);
+            });
+            const now = new Map(result.map((m) => [m.id, m.enabled]));
+            const changed = (await import("./chunks/modules-CqdVQVJb.mjs")).moduleStates(s.store).filter((m) => now.has(m.id) && now.get(m.id) !== m.enabled).map((m) => ({ id: m.id, enabled: now.get(m.id) }));
+            if (before.kind === "theme" && before.enabled !== enabled) changed.push({ id, enabled });
+            return { needsConfirmation: true, plan: { id, kind: before.kind, from: before.enabled, to: enabled, changed } };
+          }
+          const summary = await ext.setExtensionEnabled(s.ctx, id, enabled, { cascade });
+          await s.extensions.sync();
+          return summary;
+        }, (r) => "needsConfirmation" in r ? `Would ${action} ${id}${r.plan.changed.length > 1 ? ` (also: ${r.plan.changed.filter((c) => c.id !== id).map((c) => `${c.id} → ${c.enabled ? "on" : "off"}`).join(", ")})` : ""}.
+Nothing changed — re-run with --yes once the user agrees.` : `${r.id} is now ${r.enabled ? "enabled" : "disabled"}.`);
+      }
+      case "uninstall": {
+        const id = positional(positionals, 1, "extension id", "ext uninstall <id> [--yes]");
+        const force = boolOpt(options, "force");
+        return withSession(io, options, { lock: apply }, async (s) => {
+          const ext = await import("./chunks/extensions-BP1k60md.mjs");
+          const summary = ext.getExtension(s.ctx, id);
+          if (!apply) {
+            await dryRun(s.ctx, (copy) => ext.uninstallExtension(copy, id, { force }));
+            return { needsConfirmation: true, plan: { id, kind: summary.kind, name: summary.name, version: summary.version, enabled: summary.enabled, note: "The module configuration is kept; re-installing restores it." } };
+          }
+          const res = await ext.uninstallExtension(s.ctx, id, { force });
+          await s.extensions.sync();
+          return { ...res, name: summary.name, version: summary.version };
+        }, (r) => r.needsConfirmation ? `Would uninstall ${r.plan.kind} "${r.plan.name}" ${r.plan.version}.
+Nothing changed — re-run with --yes once the user agrees.` : `Uninstalled ${r.id} ${r.version}.`);
+      }
+      case "export": {
+        const id = positional(positionals, 1, "extension id", "ext export <id> [--out <file.zip>]");
+        return withSession(io, options, {}, async (s) => {
+          const { getExtensionPackage } = await import("./chunks/extensions-BP1k60md.mjs");
+          const { packExtension } = await import("./chunks/package-DWbn3t2R.mjs");
+          const pkg2 = getExtensionPackage(s.ctx, id);
+          const bytes = await packExtension(pkg2);
+          const out = resolve(strOpt(options, "out") ?? `${id}-${pkg2.manifest.version}.zip`);
+          mkdirSync(dirname(out), { recursive: true });
+          writeFileSync(out, bytes);
+          return { id, version: pkg2.manifest.version, zip: out, bytes: bytes.length };
+        }, (r) => `Wrote ${r.zip} (${kb(r.bytes)})`);
+      }
+      default:
+        usage(action ? `Unknown ext action "${action}".` : "ext needs an action.", "Actions: new, check, pack, install, list, enable, disable, uninstall, export.");
+    }
+  }
+};
+function printPlan(io, plan) {
+  printResult(io, plan, () => `Would restore ${String(plan.plan.restore)} (${String(plan.plan.mode)}). Re-run with --yes once the user agrees.`);
+}
+function mappingOpt(options) {
+  const raw = typeof options.map === "string" ? readTextValue(options.map, "map").trim() : void 0;
+  if (!raw) return void 0;
+  if (raw.startsWith("{")) {
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      usage(`--map is not valid JSON: ${err.message}`);
+    }
+  }
+  return Object.fromEntries(
+    raw.split(",").map((pair) => {
+      const i = pair.lastIndexOf("=");
+      if (i <= 0) usage(`--map expects Header=field pairs, got "${pair}".`);
+      return [pair.slice(0, i).trim(), pair.slice(i + 1).trim()];
+    })
+  );
+}
+const importCommand = {
+  name: "import",
+  usage: "import csv <file|-> --object <id> [--map <json|Header=field,…>] [--dedupe update|skip|create] [--delimiter ;] [--day-first] [--yes]",
+  summary: "Import a CSV into an object: columns mapped to fields automatically (or with --map), values coerced, duplicates (people by email, companies by domain, else by name) updated / skipped. DRY RUN by default — the report shows every row's outcome; --yes applies.",
+  subcommands: [
+    { name: "csv", usage: "import csv <file|-> --object <id> [--map …] [--dedupe update|skip|create] [--yes]", summary: "Dry run (default) or apply (--yes).", writes: true },
+    { name: "zip", usage: "import zip <backup.zip> [--replace] [--yes]", summary: "Restore a backup ZIP (data + files; merge, or --replace). Plan unless --yes.", writes: true, destructive: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "object", type: "string", description: "Target object id." },
+    { name: "map", type: "string", description: 'Column mapping: JSON {"Header":"fieldId"} or "Header=fieldId,…" ("" skips a column, $owner / $id special).' },
+    { name: "dedupe", type: "string", description: "Existing duplicate: update (default), skip, or create anyway." },
+    { name: "delimiter", type: "string", description: "Column delimiter (default: detected)." },
+    { name: "day-first", type: "boolean", description: "Ambiguous dates are DD/MM/YYYY." },
+    { name: "no-create-options", type: "boolean", description: "Don't add unknown select values as new options." },
+    { name: "dry-run", type: "boolean", description: "Explicit dry run (the default without --yes)." },
+    { name: "rows", type: "string", description: "Rows shown in the report (default 100)." },
+    { name: "replace", type: "boolean", description: "zip: also delete documents absent from the backup." }
+  ],
+  async run({ io, options, positionals }) {
+    const [kind, file2] = positionals;
+    if (kind === "zip") {
+      const path = positional(positionals, 1, "backup ZIP", "import zip <backup.zip> [--yes]");
+      const { existsSync: existsSync2, readFileSync: readFileSync2 } = await import("node:fs");
+      if (!existsSync2(path)) usage(`${path} does not exist.`);
+      const bytes = new Uint8Array(readFileSync2(path));
+      if (options.yes !== true) {
+        printPlan(io, { needsConfirmation: true, plan: { restore: resolve(path), bytes: bytes.length, mode: options.replace === true ? "replace" : "merge" } });
+        return;
+      }
+      return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/backup-ClSmxmFZ.mjs")).importBackupZip(ctx, bytes, { mode: options.replace === true ? "replace" : "merge" }), (r) => `Restored ${r.written} document(s) and ${r.files} file(s)`);
+    }
+    if (kind !== "csv") usage('Only "import csv" and "import zip" are supported.', "Usage: agentcrm import csv <file> --object <id>");
+    const source = positional(positionals, 1, "CSV file (or -)", "import csv <file|-> --object <id>");
+    const csv = readTextValue(source === "-" ? "-" : `@${source}`, "file");
+    const objectId = requireStr(options, "object");
+    const dedupe = strOpt(options, "dedupe") ?? "update";
+    if (!["update", "skip", "create"].includes(dedupe)) usage("--dedupe must be update, skip or create.");
+    const apply = options.yes === true && options["dry-run"] !== true;
+    const shown = numOpt(options, "rows") ?? 100;
+    return withSession(io, options, { lock: apply }, async ({ ctx }) => {
+      const { importCsv } = await import("./chunks/importCsv-DmE_sBch.mjs");
+      const report = await importCsv(ctx, {
+        object: objectId,
+        csv,
+        mapping: mappingOpt(options),
+        onDuplicate: dedupe,
+        dryRun: !apply,
+        dayFirst: boolOpt(options, "day-first"),
+        createOptions: !boolOpt(options, "no-create-options"),
+        delimiter: strOpt(options, "delimiter")
+      });
+      return { ...report, ...apply ? {} : { needsConfirmation: true }, rows: report.rows.slice(0, shown), rowsTruncated: report.rows.length > shown };
+    }, (r) => [
+      `${r.dryRun ? "DRY RUN — " : ""}${r.total} row(s): ${r.created} create, ${r.updated} update, ${r.skipped} skip, ${r.failed} error`,
+      `Mapping: ${Object.entries(r.mapping).map(([h, f]) => `${h} → ${f || "(skip)"}`).join(", ")}`,
+      ...r.rows.filter((x) => x.action === "error").map((x) => `  row ${x.row}: ${(x.messages ?? []).join("; ")}`),
+      ...r.dryRun ? ["Nothing changed — re-run with --yes once the user agrees."] : []
+    ].join("\n"));
+  }
+};
+const exportCommand = {
+  name: "export",
+  usage: "export <csv|json|zip> …",
+  summary: "Export one object as CSV (labels or raw values, filters, columns), the whole dataset as JSON (backup / migration, re-importable), or a ZIP backup with data + files.",
+  subcommands: [
+    { name: "csv", usage: "export csv --object <id> [--out <file>] [--filter f:op:v]… [--sort f] [--columns a,b] [--view <id>] [--raw] [--deleted]", summary: "CSV of one object." },
+    { name: "json", usage: "export json [--out <file>] [--collections records,activities,…]", summary: "Whole dataset (or some collections) as JSON." },
+    { name: "zip", usage: "export zip --out <file.zip> [--no-files]", summary: "Backup ZIP: data.json + the (decrypted) bytes of every file. Not encrypted: keep it safe." }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    { name: "object", type: "string", description: "csv: object id." },
+    { name: "out", type: "string", description: "Write to this file (default: stdout / the JSON result)." },
+    { name: "filter", type: "string", description: "field:op:value (repeatable).", multiple: true },
+    { name: "sort", type: "string", description: "field[:desc] (repeatable).", multiple: true },
+    { name: "columns", type: "string", description: "Field ids to export." },
+    { name: "view", type: "string", description: "Apply a saved view." },
+    { name: "raw", type: "boolean", description: "Stored values (ids, ISO dates) instead of labels." },
+    { name: "deleted", type: "boolean", description: "Include soft-deleted records." },
+    { name: "collections", type: "string", description: "json: collections to export." },
+    { name: "no-files", type: "boolean", description: "zip: data only (no file bytes)." }
+  ],
+  async run({ io, options, positionals }) {
+    const [kind] = positionals;
+    if (kind === "zip") {
+      const file2 = strOpt(options, "out");
+      if (!file2) usage("export zip needs --out <file.zip>.");
+      return withSession(io, options, {}, async ({ ctx }) => {
+        const { exportBackupZip } = await import("./chunks/backup-ClSmxmFZ.mjs");
+        const { zip, report } = await exportBackupZip(ctx, { includeFiles: options["no-files"] !== true });
+        writeFileSync(resolve(file2), zip);
+        return { file: resolve(file2), zipBytes: zip.length, files: report.files, missing: report.missing, fileBytes: report.bytes };
+      }, (r) => `Wrote ${r.zipBytes} bytes (${r.files} file(s)${r.missing.length ? `, ${r.missing.length} missing` : ""}) to ${r.file}`);
+    }
+    const out = strOpt(options, "out");
+    const deliver = (text, extra) => {
+      if (out) {
+        writeFileSync(resolve(out), text);
+        return { file: resolve(out), bytes: Buffer.byteLength(text), ...extra };
+      }
+      return { ...extra, content: text };
+    };
+    if (kind === "csv") {
+      const objectId = requireStr(options, "object");
+      const filters = parseFilters(multiOpt(options, "filter"), FILTER_OPS);
+      const sorts = parseSorts(multiOpt(options, "sort"));
+      return withSession(io, options, {}, async ({ ctx }) => {
+        const { exportCsv } = await import("./chunks/exportCsv-B5hRvkNm.mjs");
+        const csv = exportCsv(ctx, objectId, {
+          viewId: strOpt(options, "view"),
+          filters,
+          sorts,
+          fields: listOpt(options, "columns"),
+          values: boolOpt(options, "raw") ? "raw" : "labels",
+          includeDeleted: boolOpt(options, "deleted")
+        });
+        return deliver(csv, { object: objectId, rows: Math.max(0, csv.split(/\r?\n/).filter(Boolean).length - 1) });
+      }, (r) => "content" in r ? String(r.content) : `Wrote ${String(r.rows)} row(s) to ${String(r.file)}`);
+    }
+    if (kind === "json") {
+      return withSession(io, options, {}, async ({ ctx }) => {
+        const { exportJson } = await import("./chunks/exportCsv-B5hRvkNm.mjs");
+        const data = exportJson(ctx, { collections: listOpt(options, "collections") });
+        const text = JSON.stringify(data, null, 2);
+        if (out) return deliver(text, {});
+        return { export: data };
+      }, (r) => "export" in r ? JSON.stringify(r.export, null, 2) : `Wrote ${String(r.bytes)} bytes to ${String(r.file)}`);
+    }
+    usage(`Unknown export kind "${kind ?? ""}".`, "Use export csv, export json or export zip.");
+  }
+};
+const REPORT_ALIASES = {
+  pipeline: "pipelineByStage",
+  forecast: "forecast",
+  "won-lost": "wonLost",
+  activity: "activityByUser",
+  "lead-sources": "leadSources",
+  stale: "staleDeals",
+  conversion: "conversion"
+};
+const reportCommand = {
+  name: "report",
+  usage: "report <pipeline|forecast|won-lost|activity|lead-sources|stale|conversion> [--months n] [--days n] [--pipeline <id>] [--owner <userId>] [--params <json>]",
+  summary: "Sales reports: pipeline by stage, weighted forecast, won / lost per month (win rate), activity per user, lead sources, stale deals, lifecycle conversion funnel.",
+  subcommands: Object.keys(REPORT_ALIASES).map((name2) => ({ name: name2, usage: `report ${name2}`, summary: `The ${name2} report.` })),
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    { name: "months", type: "string", description: "won-lost: months back (default 6)." },
+    { name: "days", type: "string", description: "activity / stale: days (default 30 / settings.staleDealDays)." },
+    { name: "pipeline", type: "string", description: "Pipeline id." },
+    { name: "owner", type: "string", description: "Only deals owned by this user id." },
+    { name: "params", type: "string", description: "Raw report parameters (JSON)." }
+  ],
+  async run({ io, options, positionals }) {
+    const name2 = positional(positionals, 0, "report name", "report <name>");
+    const internal = REPORT_ALIASES[name2] ?? name2;
+    const params = {
+      ...jsonObjectOpt(options, "params") ?? {},
+      ...numOpt(options, "months") !== void 0 ? { months: numOpt(options, "months") } : {},
+      ...numOpt(options, "days") !== void 0 ? { days: numOpt(options, "days") } : {},
+      ...strOpt(options, "pipeline") ? { pipelineId: strOpt(options, "pipeline") } : {},
+      ...strOpt(options, "owner") ? { ownerId: strOpt(options, "owner") } : {}
+    };
+    return withSession(io, options, {}, async ({ ctx }) => ({ report: name2, data: (await import("./chunks/reports-BB59N6ke.mjs")).runReport(ctx, internal, params) }));
+  }
+};
+const statsCommand = {
+  name: "stats",
+  usage: "stats [--site <alias>]",
+  summary: "Dataset overview: records per object, activities by type, open / overdue tasks, users, open pipeline (+ journal segments).",
+  options: [SITE_OPTION, AS_OPTION],
+  async run({ io, options }) {
+    return withSession(io, options, {}, async ({ ctx, store }) => {
+      const stats = (await import("./chunks/stats-CfeJssSS.mjs")).getStats(ctx);
+      const journal = store.stats;
+      return { ...stats, ...journal ? { journal: await journal.call(store) } : {} };
+    }, (s) => [`backend: ${s.backend}`, ...s.objects.map((o) => `  ${o.label}: ${o.count}${o.deleted ? ` (+${o.deleted} deleted)` : ""}`), `open tasks: ${s.openTasks} (${s.overdueTasks} overdue)`, `users: ${s.users}`].join("\n"));
+  }
+};
+const compactCommand = {
+  name: "compact",
+  usage: "compact [--older-than <days>] [--keep-runs <n>] [--yes]",
+  summary: "Physical purge (GDPR erasure): hard-deletes soft-deleted records and activities and old automation runs, deletes the bytes of deleted / orphan files, then rewrites the storage without history (journal: new snapshot, merged segments deleted). Plan unless --yes.",
+  options: [SITE_OPTION, AS_OPTION, YES_OPTION, { name: "older-than", type: "string", description: "Only items deleted more than N days ago (default: all)." }, { name: "keep-runs", type: "string", description: "Automation runs kept (default 500)." }],
+  async run({ io, options }) {
+    const apply = options.yes === true;
+    return withSession(io, options, { lock: apply }, async ({ ctx }) => {
+      const { compactData } = await import("./chunks/compact-CsFPaAAq.mjs");
+      const report = await compactData(ctx, { olderThanDays: numOpt(options, "older-than"), keepRuns: numOpt(options, "keep-runs"), dryRun: !apply });
+      return apply ? report : { needsConfirmation: true, plan: report };
+    }, (r) => "plan" in r ? `Would purge ${r.plan.purgedRecords.length} record(s), ${r.plan.purgedActivities} activit(ies), ${r.plan.purgedRuns} run(s), ${r.plan.purgedFiles} file(s). Re-run with --yes once the user agrees.` : `Purged ${r.purgedRecords.length} record(s), ${r.purgedFiles} file(s); storage compacted: ${r.storageCompacted}`);
+  }
+};
+const automationsCommand = {
+  name: "automations",
+  usage: "automations <list|enable|disable|run> …",
+  summary: "Automations (event triggers run in-process on every write, also from the CLI): list, enable / disable, run the scheduled & inactivity ones (cron / GitHub Actions). `run` is a dry run unless --yes.",
+  subcommands: [
+    { name: "list", usage: "automations list", summary: "Automations with trigger, enabled state and last run." },
+    { name: "enable", usage: "automations enable <id>", summary: "Enable an automation.", writes: true },
+    { name: "disable", usage: "automations disable <id>", summary: "Disable an automation.", writes: true },
+    { name: "run", usage: "automations run [--id <automationId>] [--force] [--yes]", summary: "Evaluate schedule / inactivity triggers now (runScheduled). Dry run unless --yes.", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, YES_OPTION, { name: "id", type: "string", description: "run: only this automation." }, { name: "force", type: "boolean", description: "run: ignore the everyHours spacing." }],
+  async run({ io, options, positionals }) {
+    const [action = "list", id] = positionals;
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/automations-BWrvLqP6.mjs")).listAutomations(ctx).map((a) => ({ id: a.id, name: a.name, enabled: a.enabled, object: a.object, trigger: a.trigger, actions: a.actions.map((x) => x.type), lastRunAt: a.lastRunAt ? new Date(a.lastRunAt).toISOString() : null })), (rows) => table(rows, ["id", "name", "enabled", "object", "lastRunAt"]));
+      case "enable":
+      case "disable": {
+        if (!id) usage(`automations ${action} needs an id.`);
+        return withSession(io, options, { lock: true }, async ({ ctx }) => {
+          const mod = await import("./chunks/automations-BWrvLqP6.mjs");
+          return mod.setAutomationEnabled(ctx, id, action === "enable");
+        });
+      }
+      case "run": {
+        const apply = options.yes === true;
+        return withSession(io, options, { lock: apply }, async ({ ctx }) => {
+          const { runScheduled } = await import("./chunks/automations-BWrvLqP6.mjs");
+          const report = await runScheduled(ctx, { dryRun: !apply, automationId: strOpt(options, "id"), force: boolOpt(options, "force") });
+          return apply ? report : { needsConfirmation: true, ...report };
+        }, (r) => `${"needsConfirmation" in r ? "DRY RUN — " : ""}ran ${r.ran}, skipped ${r.skipped}, errors ${r.errors}`);
+      }
+      default:
+        usage(`Unknown automations action "${action}".`, "Use list, enable, disable or run.");
+    }
+  }
+};
+const formsCommand = {
+  name: "forms",
+  usage: "forms <list|publish|ingest> …",
+  summary: "Lead capture forms: list, publish the static form page to the hosting, ingest pending submissions from the inbox (records created / deduped, activity logged). publish and ingest print a plan / dry run unless --yes.",
+  subcommands: [
+    { name: "list", usage: "forms list", summary: "Forms with their inbox and published URL." },
+    { name: "publish", usage: "forms publish <formId> [--yes]", summary: "Upload the form page (+ print the embed snippet).", writes: true },
+    { name: "ingest", usage: "forms ingest [--form <id>] [--limit n] [--yes]", summary: "Turn inbox submissions into records. Dry run unless --yes.", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, YES_OPTION, { name: "form", type: "string", description: "ingest: only this form." }, { name: "limit", type: "string", description: "ingest: max submissions." }],
+  async run({ io, options, positionals }) {
+    const [action = "list", id] = positionals;
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/forms-BKU5F9WF.mjs")).listForms(ctx), (fs) => table(fs, ["id", "name", "object", "publishedPath"]));
+      case "publish": {
+        if (!id) usage("forms publish needs a form id.");
+        return withSession(io, options, { lock: options.yes === true }, async (s) => {
+          const forms = await import("./chunks/forms-BKU5F9WF.mjs");
+          const built = await forms.buildFormHtml(s.ctx, id);
+          const target = s.hostingTarget();
+          if (!target) usage(`${s.site.alias} has no hosting to publish the form to.`);
+          if (options.yes !== true) return { needsConfirmation: true, plan: { form: id, path: built.path, hosting: s.site.hosting?.type, bytes: built.html.length } };
+          const { buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+          const connector = buildConnector(target);
+          const siteUrl = typeof s.site.hosting?.settings.siteUrl === "string" ? s.site.hosting.settings.siteUrl.replace(/\/+$/, "") : "";
+          return forms.publishForm(s.ctx, id, { put: (input) => connector.put(input), publicUrl: async (path) => siteUrl ? `${siteUrl}/${path}` : connector.publicUrl(path) });
+        });
+      }
+      case "ingest": {
+        const apply = options.yes === true;
+        return withSession(io, options, { lock: apply }, async ({ ctx }) => {
+          const { ingestInbox } = await import("./chunks/forms-BKU5F9WF.mjs");
+          const report = await ingestInbox(ctx, strOpt(options, "form"), { dryRun: !apply, limit: numOpt(options, "limit") });
+          return apply ? report : { needsConfirmation: true, ...report };
+        }, (r) => `${"needsConfirmation" in r ? "DRY RUN — " : ""}processed ${r.processed}: ${r.created} created, ${r.updated} updated, ${r.failed} failed`);
+      }
+      default:
+        usage(`Unknown forms action "${action}".`, "Use list, publish or ingest.");
+    }
+  }
+};
+function parse(v) {
+  const m = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(v.trim());
+  if (!m) throw new Error(`Invalid version: ${v}`);
+  return [Number(m[1]), Number(m[2]), Number(m[3]), m[4] ?? ""];
+}
+function compareVersions(a, b) {
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] < pb[i] ? -1 : 1;
+  }
+  if (pa[3] === pb[3]) return 0;
+  if (!pa[3]) return 1;
+  if (!pb[3]) return -1;
+  return pa[3] < pb[3] ? -1 : 1;
+}
+async function fetchText(url, init = {}, fetchImpl = fetch) {
+  try {
+    const u = new URL(url);
+    if (!init.method || init.method === "GET") u.searchParams.set("agentcrm", String(Date.now()));
+    const res = await fetchImpl(u.href, { cache: "no-store", redirect: "follow", signal: AbortSignal.timeout(15e3), ...init });
+    const text = await res.text();
+    return { ok: res.ok, status: res.status, contentType: res.headers.get("content-type") ?? "", text, headers: res.headers };
+  } catch (err) {
+    return { ok: false, status: 0, contentType: "", text: "", headers: null, error: err.message };
+  }
+}
+function parseConfigJs(source) {
+  const m = /window\.__AGENTCRM_CONFIG__\s*=\s*([\s\S]*?);?\s*$/.exec(source.trim());
+  if (!m) throw new Error("config.js does not set window.__AGENTCRM_CONFIG__");
+  const value = JSON.parse(m[1].trim().replace(/;$/, ""));
+  return value && typeof value === "object" ? value : null;
+}
+function findSecretKeys(value, path = "") {
+  if (!value || typeof value !== "object") return [];
+  return Object.entries(value).flatMap(([k, v]) => {
+    const here = path ? `${path}.${k}` : k;
+    if (/^(token|apiKey|secretAccessKey|accessKeyId|accessToken|password|passphrase|refreshToken|clientSecret)$/.test(k) && typeof v === "string" && v) {
+      if (k === "apiKey" && path === "firebase") return [];
+      return [here];
+    }
+    return findSecretKeys(v, here);
+  });
+}
+async function fetchHostedAdmin(adminUrl, fetchImpl = fetch) {
+  const base = adminUrl.replace(/\/?$/, "/");
+  let res = await fetchText(`${base}version.json`, {}, fetchImpl);
+  if (!res.ok) {
+    const manifest = await fetchText(`${base}admin-files.json`, {}, fetchImpl);
+    if (manifest.ok) res = manifest;
+  }
+  if (!res.ok) return { version: null, dataSchema: null, error: res.error ?? `HTTP ${res.status}` };
+  try {
+    const m = JSON.parse(res.text);
+    return { version: m.version ?? null, dataSchema: m.dataSchema ?? null };
+  } catch {
+    return { version: null, dataSchema: null, error: "version.json is not valid JSON" };
+  }
+}
+function readChangelog() {
+  try {
+    const data = JSON.parse(readFileSync(join(packageRoot(), "changelog.json"), "utf8"));
+    return data.versions ?? [];
+  } catch {
+    return [];
+  }
+}
+function changesBetween(entries, from, to) {
+  const list = entries.filter((e) => compareVersions(e.version, from) > 0 && compareVersions(e.version, to) <= 0);
+  return {
+    versions: list.map((e) => e.version),
+    breaking: list.some((e) => e.breaking),
+    changes: list.flatMap((e) => e.changes.map((c) => `${e.version}: ${c}`)),
+    actions: [...new Set(list.flatMap((e) => e.actions))]
+  };
+}
+async function fetchLatestVersion(pkg2, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(`https://registry.npmjs.org/${pkg2.replace("/", "%2F")}/latest`, { signal: AbortSignal.timeout(5e3) });
+    if (!res.ok) return null;
+    const v = await res.json();
+    return typeof v.version === "string" ? v.version : null;
+  } catch {
+    return null;
+  }
+}
+const deployAdminCommand = {
+  name: "deploy-admin",
+  usage: "deploy-admin [--site <alias> | --all] [--yes] [--allow-downgrade]",
+  summary: "Upload this release's admin (+ version.json + config.js, never secrets) to a CRM's hosting. Prints the plan unless --yes; refuses downgrades and admins that store a newer data format.",
+  options: [
+    { name: "site", type: "string", description: "Site alias." },
+    { name: "all", type: "boolean", description: "Every registered site with a hosting." },
+    { name: "yes", type: "boolean", description: "Apply — only after the user confirmed the plan." },
+    { name: "allow-downgrade", type: "boolean", description: "Allow installing an older admin than the hosted one." }
+  ],
+  async run({ io, options }) {
+    const info = readVersionInfo();
+    const sites = options.all === true ? listSites().sites.filter((s) => s.hosting) : [resolveSite(strOpt(options, "site"))];
+    if (!sites.length) throw new CliError("no-sites", "No registered CRM has a hosting.");
+    installBrowserEnv();
+    const { adminOps, applyOps, buildConnector } = await import("./chunks/hosting-Bme7LxPc.mjs");
+    const { hostingTargetOf: hostingTargetOf2 } = await Promise.resolve().then(() => session);
+    const plans = [];
+    for (const site of sites) {
+      if (!site.hosting) throw new CliError("not-hosted", `${site.alias} has no hosting recorded.`, "Register it with `site add --admin-url …` from a CRM whose admin is hosted, or reinstall with a hosting.");
+      const hosted = site.adminUrl ? await fetchHostedAdmin(site.adminUrl) : { version: null, dataSchema: null };
+      const plan = {
+        alias: site.alias,
+        adminUrl: site.adminUrl,
+        hosting: site.hosting.type,
+        from: hosted.version,
+        to: info.version,
+        files: adminOps(site.hosting.folder, site.runtime).ops.length,
+        changes: hosted.version ? changesBetween(readChangelog(), hosted.version, info.version) : null
+      };
+      if (hosted.dataSchema !== null && hosted.dataSchema > info.dataSchema) plan.refused = `the hosted admin stores data format ${hosted.dataSchema}, this release only knows ${info.dataSchema} — update agentcrm instead`;
+      else if (hosted.version && compareVersions(hosted.version, info.version) > 0 && options["allow-downgrade"] !== true) plan.refused = `the hosted admin (${hosted.version}) is newer than this release — update agentcrm, or pass --allow-downgrade`;
+      plans.push(plan);
+    }
+    if (options.yes !== true) {
+      printResult(
+        io,
+        { needsConfirmation: true, plans },
+        () => [...plans.map((p) => p.refused ? `${p.alias}: refused — ${p.refused}` : `${p.alias}: admin ${p.from ?? "(none)"} → ${p.to} on ${p.hosting}, ${p.files} files`), "Nothing was changed. Re-run with --yes once the user agrees."].join("\n")
+      );
+      return;
+    }
+    const results = [];
+    for (const [i, site] of sites.entries()) {
+      const plan = plans[i];
+      if (plan.refused) {
+        results.push({ alias: site.alias, deployed: false, reason: plan.refused });
+        continue;
+      }
+      const unlock = lockSite(site.alias);
+      try {
+        const { ops } = adminOps(site.hosting.folder, site.runtime);
+        io.err(`• ${site.alias}: uploading ${ops.length} files…`);
+        await applyOps(buildConnector(hostingTargetOf2(site)), ops);
+        putSite({ ...site, adminVersion: info.version });
+        results.push({ alias: site.alias, deployed: true, from: plan.from, to: info.version, files: ops.length });
+      } catch (err) {
+        results.push({ alias: site.alias, deployed: false, reason: err.message });
+      } finally {
+        unlock();
+      }
+    }
+    printResult(io, { results }, () => results.map((r) => r.deployed ? `${r.alias}: admin ${r.from ?? "(none)"} → ${r.to}` : `${r.alias}: not deployed — ${r.reason}`).join("\n"));
+    if (results.some((r) => !r.deployed)) return 1;
+  }
+};
+function corsRule(origin) {
+  return [
+    {
+      AllowedOrigins: [origin],
+      AllowedMethods: ["GET", "PUT", "DELETE", "HEAD"],
+      AllowedHeaders: ["authorization", "content-type", "cache-control", "x-amz-*"],
+      ExposeHeaders: ["ETag"],
+      MaxAgeSeconds: 3600
+    }
+  ];
+}
+function s3BucketUrl(settings) {
+  const bucket = typeof settings.bucket === "string" ? settings.bucket : "";
+  if (!bucket) return null;
+  const region = typeof settings.region === "string" && settings.region ? settings.region : "us-east-1";
+  const endpoint = (typeof settings.endpoint === "string" && settings.endpoint ? settings.endpoint : `https://s3.${region}.amazonaws.com`).replace(/\/+$/, "");
+  const pathStyle = settings.forcePathStyle ?? !new URL(endpoint).hostname.endsWith("amazonaws.com");
+  return pathStyle ? `${endpoint}/${bucket}/` : endpoint.replace("://", `://${bucket}.`) + "/";
+}
+async function corsCheck(id, what, settings, origin) {
+  const url = s3BucketUrl(settings);
+  if (!url || !origin) return { id, status: "skip", message: `${what}: no admin origin to check CORS for (admin not hosted).` };
+  const res = await fetchText(url, { method: "OPTIONS", headers: { Origin: origin, "Access-Control-Request-Method": "PUT", "Access-Control-Request-Headers": "authorization,content-type" } });
+  const allowed = res.headers?.get("access-control-allow-origin");
+  if (allowed === "*" || allowed === origin) return { id, status: "ok", message: `${what}: CORS allows ${origin}.` };
+  return {
+    id,
+    status: "warn",
+    message: `${what}: the bucket did not confirm a CORS rule for ${origin}${res.status ? ` (preflight HTTP ${res.status})` : res.error ? ` (${res.error})` : ""} — the browser admin can't reach it without one.`,
+    fix: `Add this CORS rule to bucket "${String(settings.bucket)}" (AWS console → Permissions → CORS, or \`aws s3api put-bucket-cors\`; R2 / OVH / Scaleway have the same JSON): ${JSON.stringify(corsRule(origin))}`
+  };
+}
+async function runDoctor(site, opts = {}) {
+  const checks = [];
+  const add = (c) => checks.push(c);
+  const info = readVersionInfo();
+  let repaired = null;
+  for (const role of ["data", "hosting", "passphrase"]) {
+    const account = site.credentials[role];
+    if (!account) continue;
+    add(
+      getCredential(account) ? { id: `credential-${role}`, status: "ok", message: `${role} credential ${account} stored.` } : { id: `credential-${role}`, status: "fail", message: `${role} credential ${account} is not stored on this computer.`, fix: `The user runs \`agentcrm credentials set ${account}\` in their own terminal (hidden input) or with --from-env.` }
+    );
+  }
+  if (site.runtime.backend === "journal" && site.runtime.journal.encrypted && !site.credentials.passphrase) {
+    add({ id: "credential-passphrase", status: "fail", message: "The dataset is encrypted and no passphrase account is attached.", fix: `\`agentcrm credentials set passphrase:${site.alias}\`, then \`agentcrm site credentials ${site.alias} --passphrase-credential passphrase:${site.alias}\`.` });
+  }
+  if (site.runtime.backend === "journal" && !site.runtime.journal.encrypted) {
+    add({ id: "encryption", status: "warn", message: "The dataset is stored UNENCRYPTED: anyone who can read the storage reads every contact.", fix: "Keep the location strictly private; encryption can be enabled by exporting (`export json`) and re-importing into a new encrypted install." });
+  }
+  installBrowserEnv();
+  try {
+    if (site.runtime.backend === "journal" && site.runtime.journal.connectorId === "git-pages") {
+      const { probeTarget } = await import("./chunks/install-CpHoUFtL.mjs");
+      const { dataTargetOf: dataTargetOf2 } = await Promise.resolve().then(() => session);
+      const probe = await probeTarget(dataTargetOf2(site), { requireSiteUrl: false, requirePrivate: true });
+      add(probe.ok ? { id: "data-repo", status: "ok", message: probe.detail } : { id: "data-repo", status: "fail", message: probe.detail, fix: "Make the data repository private and check the token's Contents permission." });
+    }
+    const { openSession: openSession2 } = await Promise.resolve().then(() => session);
+    const session$1 = await openSession2(site.alias);
+    try {
+      const store = session$1.store;
+      add({ id: "data-access", status: "ok", message: `Dataset opened (${store.kind}${session$1.user ? `, acting as ${session$1.user.email} (${session$1.user.role})` : ""}).` });
+      const { usersOf, objectsOf, pipelinesOf, settingsDoc, recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
+      const missing = [];
+      for (const id of ["companies", "people", "deals"]) if (!objectsOf(store).some((o) => o.id === id)) missing.push(`object ${id}`);
+      if (!pipelinesOf(store).length) missing.push("a pipeline");
+      if (!settingsDoc(store)) missing.push("settings");
+      if (!usersOf(store).some((u) => u.role === "admin" && !u.disabled)) missing.push("an active admin user");
+      if (missing.length && opts.repair) {
+        const { seedCrm } = await import("./chunks/seed-CugPGYZL.mjs");
+        repaired = await seedCrm(session$1.system, { admin: site.user ? { name: site.user.split("@")[0], email: site.user } : void 0 });
+        add({ id: "dataset", status: "ok", message: `Repaired: seeded ${missing.join(", ")}.` });
+      } else {
+        add(
+          missing.length ? { id: "dataset", status: "fail", message: `The dataset lacks ${missing.join(", ")}.`, fix: `\`agentcrm doctor --site ${site.alias} --repair\` seeds what's missing (idempotent, keeps existing data).` } : { id: "dataset", status: "ok", message: `${objectsOf(store).length} objects, ${recordsOf(store).length} records, ${usersOf(store).length} users.` }
+        );
+      }
+      if (session$1.user && session$1.user.role !== "admin") {
+        add({ id: "cli-user", status: "warn", message: `The CLI acts as ${session$1.user.email}, a ${session$1.user.role}: schema, settings and compaction will be refused.`, fix: `\`agentcrm site credentials ${site.alias} --user <admin email>\`.` });
+      }
+      const deleted = recordsOf(store, void 0, { includeDeleted: true }).filter((r) => r.deletedAt).length;
+      if (deleted) add({ id: "purge", status: "warn", message: `${deleted} deleted record(s) are still stored (restorable) until compaction.`, fix: `When the user wants them erased for good (GDPR): \`agentcrm compact --site ${site.alias}\` (plan), then with --yes.` });
+      const stats = store.stats;
+      if (stats) {
+        const s = await stats.call(store);
+        add(
+          s.pendingSegments > 300 ? { id: "journal", status: "warn", message: `${s.pendingSegments} journal segments since the last snapshot: loading gets slower.`, fix: `\`agentcrm compact --site ${site.alias} --yes\` (run it from one place).` } : { id: "journal", status: "ok", message: `Journal: ${s.segments} segment(s), ${s.pendingSegments} since the last snapshot.` }
+        );
+      }
+    } finally {
+      await session$1.close();
+    }
+  } catch (err) {
+    const e = toCliError(err);
+    add({ id: "data-access", status: "fail", message: e.message, fix: e.hint });
+  }
+  const adminUrl = site.adminUrl;
+  let origin = null;
+  if (!adminUrl) {
+    add({ id: "admin", status: "skip", message: "Admin not hosted (use `agentcrm serve`)." });
+  } else {
+    origin = new URL(adminUrl).origin;
+    add(
+      adminUrl.startsWith("https://") || /^http:\/\/(localhost|127\.0\.0\.1)/.test(adminUrl) ? { id: "https", status: "ok", message: "Admin served over HTTPS (or localhost)." } : { id: "https", status: "fail", message: `${adminUrl} is plain HTTP: browsers refuse WebCrypto (signing, encryption) there.`, fix: "Serve the admin over HTTPS (CDN / custom domain with TLS, the bucket's https endpoint, GitHub Pages)." }
+    );
+    const index = await fetchText(`${adminUrl}index.html`);
+    if (!index.ok) {
+      add({ id: "admin", status: "fail", message: `Admin page not served (${index.error ?? `HTTP ${index.status}`}).`, fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\` (Pages hosts take a minute after a commit).` });
+    } else {
+      add({ id: "admin", status: "ok", message: `Admin served at ${adminUrl}.` });
+      const hosted = await fetchHostedAdmin(adminUrl);
+      add(
+        !hosted.version ? { id: "admin-version", status: "warn", message: "version.json missing next to the admin.", fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\`.` } : compareVersions(hosted.version, info.version) >= 0 ? { id: "admin-version", status: "ok", message: `Admin ${hosted.version} is up to date.` } : { id: "admin-version", status: "warn", message: `Admin ${hosted.version} is older than ${info.version}.`, fix: `Offer \`agentcrm deploy-admin --site ${site.alias}\`.` }
+      );
+      const cfg = await fetchText(`${adminUrl}config.js`);
+      try {
+        if (!cfg.ok) throw new Error(cfg.error ?? `HTTP ${cfg.status}`);
+        const runtime = parseConfigJs(cfg.text);
+        const secrets = findSecretKeys(runtime);
+        if (secrets.length) add({ id: "config-js", status: "fail", message: `config.js publishes secrets: ${secrets.join(", ")}.`, fix: "Revoke those keys NOW, then redeploy the admin (config.js is regenerated without secrets)." });
+        else if (!runtime || runtime.backend !== site.runtime.backend) add({ id: "config-js", status: "fail", message: `config.js backend is ${String(runtime?.backend ?? "empty")}, expected ${site.runtime.backend}.`, fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\`.` });
+        else add({ id: "config-js", status: "ok", message: `config.js: ${site.runtime.backend}, no secrets.` });
+      } catch (err) {
+        add({ id: "config-js", status: "fail", message: `config.js unreadable: ${err.message}.`, fix: `\`agentcrm deploy-admin --site ${site.alias} --yes\`.` });
+      }
+    }
+  }
+  if (site.runtime.backend === "journal" && site.runtime.journal.connectorId === "s3") {
+    const loc = site.runtime.journal.settings;
+    add(await corsCheck("cors-data", "Data bucket", loc, origin));
+    const hs = site.hosting?.connectorId === "s3" ? site.hosting.settings : null;
+    if (hs && hs.bucket === loc.bucket && (hs.endpoint ?? "") === (loc.endpoint ?? "") && typeof hs.siteUrl === "string") {
+      const rel = [String(loc.prefix ?? ""), site.runtime.journal.root].map((p) => p.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+      const stripped = String(hs.prefix ?? "").replace(/^\/+|\/+$/g, "");
+      const path = stripped && rel.startsWith(`${stripped}/`) ? rel.slice(stripped.length + 1) : rel;
+      const probe = await fetchText(`${hs.siteUrl.replace(/\/+$/, "")}/${path ? `${path}/` : ""}keyinfo.json`);
+      if (probe.ok && /agentcrm-journal/.test(probe.text)) {
+        add(
+          site.runtime.journal.encrypted ? { id: "data-exposure", status: "warn", message: "The encrypted data files are downloadable from the public site.", fix: "Move the dataset to a separate private bucket (export json → new install → import)." } : { id: "data-exposure", status: "fail", message: "The UNENCRYPTED dataset is downloadable from the public site: every contact is exposed.", fix: "Make the files private now (bucket policy), then move the data to a private bucket with encryption." }
+        );
+      } else add({ id: "data-exposure", status: "ok", message: "The dataset is not served by the public site." });
+    }
+  }
+  if (site.hosting?.connectorId === "s3" && !(site.runtime.backend === "journal" && site.runtime.journal.connectorId === "s3" && site.runtime.journal.settings.bucket === site.hosting.settings.bucket)) {
+    add({ id: "cors-hosting", status: "skip", message: "Hosting bucket: only read by browsers (no CORS needed unless forms post to it)." });
+  }
+  return { checks, repaired };
+}
+const doctorCommand = {
+  name: "doctor",
+  usage: "doctor [--site <alias>] [--repair]",
+  summary: "Health check of a CRM: credentials, data access (passphrase), dataset health, journal size, pending purge, hosted admin (HTTPS, version, config.js without secrets), bucket CORS rules, public exposure of the data. Every problem has a `fix`. Exit 1 when a check fails.",
+  options: [SITE_OPTION, { name: "repair", type: "boolean", description: "Seed what the dataset lacks (standard objects, pipeline, settings, admin) — idempotent." }],
+  async run({ io, options }) {
+    const site = resolveSite(strOpt(options, "site"));
+    const { checks, repaired } = await runDoctor(site, { repair: options.repair === true });
+    const failed = checks.filter((c) => c.status === "fail").length;
+    const warned = checks.filter((c) => c.status === "warn").length;
+    printResult(
+      io,
+      { site: site.alias, ok: failed === 0, failed, warnings: warned, checks, ...repaired ? { repaired } : {} },
+      () => [
+        `${site.alias}: ${failed ? `${failed} problem(s)` : "healthy"}${warned ? `, ${warned} warning(s)` : ""}`,
+        ...checks.map((c) => `  [${c.status}] ${c.id}: ${c.message}${c.fix ? `
+         fix: ${c.fix}` : ""}`)
+      ].join("\n")
+    );
+    return failed ? 1 : 0;
+  }
+};
+function readPlan(source) {
+  let text;
+  try {
+    text = source === "-" ? readFileSync(0, "utf8") : readFileSync(source, "utf8");
+  } catch (err) {
+    throw new CliError("invalid-plan", `Could not read the plan: ${err.message}`, void 0, 2);
+  }
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new CliError("invalid-plan", `The plan is not valid JSON: ${err.message}`, void 0, 2);
+  }
+}
+const installCommand = {
+  name: "install",
+  usage: "install --plan <file|-> [--dry-run]",
+  summary: "Install a CRM from a JSON plan (see `options`): checks access, creates the (encrypted) dataset on the chosen location, seeds the standard objects, pipeline, views and first admin (+ optional demo data), uploads the admin + config.js to the hosting, registers the site. --dry-run only checks.",
+  options: [
+    { name: "plan", type: "string", description: "Plan file path, or - for stdin." },
+    { name: "dry-run", type: "boolean", description: "Validate the plan and test every access without writing anything." }
+  ],
+  async run({ io, options }) {
+    const planPath = strOpt(options, "plan");
+    if (!planPath) usage("install needs --plan <file|->.", "Run `agentcrm options` for the format.");
+    installBrowserEnv();
+    const { resolvePlan } = await import("./chunks/plan-C0TBrU92.mjs");
+    const plan = resolvePlan(readPlan(planPath));
+    if (getSite(plan.alias)) throw new CliError("site-exists", `A site named "${plan.alias}" is already registered.`, "Use another alias, or `agentcrm site forget` it first.");
+    const { checkPlan, runInstall } = await import("./chunks/install-CpHoUFtL.mjs");
+    io.err("Checking access…");
+    const checks = await checkPlan(plan);
+    const summary = {
+      alias: plan.alias,
+      name: plan.name,
+      backend: plan.backend,
+      location: plan.dataType ?? null,
+      hosting: plan.hosting?.type ?? null,
+      adminUrl: plan.adminUrl,
+      owner: plan.owner,
+      credentials: plan.credentials,
+      encrypted: plan.runtime.backend === "journal" ? plan.runtime.journal.encrypted : null,
+      checks,
+      warnings: plan.warnings
+    };
+    if (!checks.data.ok || checks.hosting && !checks.hosting.ok) {
+      throw new CliError(
+        "check-failed",
+        [!checks.data.ok && `Data: ${checks.data.detail}`, checks.hosting && !checks.hosting.ok && `Hosting: ${checks.hosting.detail}`].filter(Boolean).join(" — "),
+        "Fix the access (key / token permissions, bucket / repo names, URL, CORS) and retry the dry run."
+      );
+    }
+    if (options["dry-run"] === true) {
+      printResult(io, { ...summary, dryRun: true, existingData: checks.data.existing }, () => `Plan OK for ${plan.alias}: ${plan.backend}${plan.dataType ? ` on ${plan.dataType}` : ""} → ${plan.hosting?.type ?? "not hosted"}. Nothing was written.`);
+      return;
+    }
+    const unlock = lockSite(plan.alias);
+    try {
+      const outcome = await runInstall(plan, (label) => io.err(`• ${label}`));
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      putSite({
+        alias: plan.alias,
+        name: plan.name,
+        runtime: plan.runtime,
+        ...plan.dataPath ? { dataPath: plan.dataPath } : {},
+        hosting: plan.hosting,
+        adminUrl: plan.adminUrl,
+        credentials: plan.credentials,
+        user: plan.owner.email,
+        ...outcome.adminVersion ? { adminVersion: outcome.adminVersion } : {},
+        installedAt: now,
+        updatedAt: now
+      });
+      const nextSteps = [];
+      if (plan.adminUrl) nextSteps.push(`Open the admin: ${plan.adminUrl}`);
+      else nextSteps.push("The admin was not uploaded: run `agentcrm serve` to use it on this computer.");
+      if (plan.backend === "journal") {
+        nextSteps.push(`Each new browser asks once for the data location keys${plan.passphraseAccount ? " and the passphrase" : ""} (they stay in that browser).`);
+      } else if (plan.backend === "git-json") {
+        nextSteps.push("Each user signs in to the admin with their own git token (Contents read/write on the data repository).");
+      } else {
+        nextSteps.push("Users sign in with their Firebase accounts; add them with `agentcrm users add` and create their logins in the Firebase console.");
+      }
+      for (const w of plan.warnings) nextSteps.push(`Warning: ${w}`);
+      nextSteps.push(`Check everything with \`agentcrm doctor --site ${plan.alias}\`.`);
+      const savePassphrase = plan.passphraseAccount ? {
+        account: plan.passphraseAccount,
+        generated: outcome.generatedPassphrase,
+        why: "The CRM data is encrypted with this passphrase. It is stored only on this computer: without it no browser or computer can open the data, and nobody can recover it.",
+        steps: [
+          `\`agentcrm credentials copy ${plan.passphraseAccount}\` puts it on the clipboard (never print it).`,
+          "The user pastes it into their password manager NOW (entry: the CRM admin URL) and confirms.",
+          `The user runs \`agentcrm credentials verify ${plan.passphraseAccount}\` in their own terminal and pastes it FROM the password manager: it must say "verified".`
+        ]
+      } : null;
+      printResult(
+        io,
+        { ...summary, installed: true, seed: outcome.seed, files: outcome.files, adminVersion: outcome.adminVersion, notices: outcome.notices, savePassphrase, nextSteps },
+        () => [
+          `Installed ${plan.alias}.`,
+          ...savePassphrase ? ["", "!!! ACTION REQUIRED — SAVE THE PASSPHRASE NOW !!!", savePassphrase.why, ...savePassphrase.steps.map((s, i) => `  ${i + 1}. ${s}`), ""] : [],
+          ...nextSteps.map((s) => `- ${s}`)
+        ].join("\n")
+      );
+    } finally {
+      unlock();
+    }
+  }
+};
+const DATA_BACKENDS = [
+  {
+    id: "journal",
+    summary: "Encrypted files (snapshot + append-only journal) on storage you own: an S3-compatible bucket, a private GitHub / GitLab repo, or a folder of this computer.",
+    goodFor: "Default. Personal data stays encrypted (AES-256-GCM) on your own storage; several users / computers work at the same time without conflicts.",
+    cli: true,
+    fields: [
+      { key: "location", required: true, description: "Where the files live: { type, settings, credential } — see `locations`." },
+      { key: "root", required: false, description: "Folder of the dataset on the location.", default: "agentcrm" },
+      {
+        key: "encryption",
+        required: false,
+        description: 'Default: encrypted with a passphrase generated at install and stored as passphrase:<alias>. { "credential": "passphrase:<name>" } uses an existing one; false stores plain JSON (not recommended: personal data).'
+      }
+    ],
+    credentialTypes: ["s3", "github", "gitlab", "passphrase"],
+    notes: [
+      "Losing the passphrase means losing the data: right after install the user saves it in a password manager (`agentcrm credentials copy passphrase:<alias>`).",
+      "No login screen: anyone with the storage keys and the passphrase can open the CRM; each browser asks for them once.",
+      "`agentcrm compact` rewrites the snapshot and physically purges deleted records (GDPR erasure)."
+    ]
+  },
+  {
+    id: "git-json",
+    summary: "One JSON file per record in a PRIVATE GitHub / GitLab repository; every change is a commit.",
+    goodFor: "Small teams who want a readable history; each user signs in with their own token (repo permission = role).",
+    cli: true,
+    fields: [
+      { key: "git.provider", required: true, description: "github | gitlab", example: "github" },
+      { key: "git.owner", required: false, description: "GitHub user or organisation (github).", example: "acme" },
+      { key: "git.repo", required: false, description: "GitHub repository (github), private.", example: "acme-crm-data" },
+      { key: "git.project", required: false, description: "GitLab project path (gitlab).", example: "acme/crm-data" },
+      { key: "git.branch", required: false, description: "Branch.", default: "main" },
+      { key: "git.dir", required: false, description: 'Folder inside the repo ("" = root).', default: "" },
+      { key: "credential", required: true, description: "github:<name> / gitlab:<name> token account." }
+    ],
+    credentialTypes: ["github", "gitlab"],
+    notes: ["Git history keeps every past value: deleting a record does not erase it from the history (warn the user about personal data)."]
+  },
+  {
+    id: "firebase",
+    summary: "Firestore + Firebase Auth in the user's own Firebase project.",
+    goodFor: "Real-time teams with email / Google logins and per-user roles enforced by Firestore rules.",
+    cli: true,
+    fields: [
+      { key: "firebase", required: true, description: "The web app config (apiKey, authDomain, projectId, appId…) from Firebase console → Project settings → Your apps." },
+      { key: "credential", required: true, description: "firebase:<name> — email + password of the first admin (Authentication → Users)." },
+      { key: "signInMethods", required: false, description: 'Login buttons: ["password"] (default) and/or "google".' }
+    ],
+    credentialTypes: ["firebase"],
+    notes: ["Publish the security rules first (see docs/firebase.md)."]
+  },
+  {
+    id: "local",
+    summary: "This browser only (IndexedDB), single user, no login.",
+    goodFor: "Trying AgentCRM. Not reachable from the CLI.",
+    cli: false,
+    fields: [],
+    credentialTypes: [],
+    notes: ["Use `agentcrm serve` and pick “This browser” in the setup wizard."]
+  }
+];
+const LOCATIONS = [
+  {
+    id: "s3",
+    connectorId: "s3",
+    summary: "Any S3-compatible bucket (AWS S3, Cloudflare R2, OVHcloud, Scaleway, Backblaze B2, MinIO). Use a PRIVATE bucket.",
+    fields: [
+      { key: "endpoint", required: false, description: "S3 API endpoint (omit for AWS).", example: "https://s3.gra.io.cloud.ovh.net" },
+      { key: "region", required: true, description: "Region.", example: "eu-west-3" },
+      { key: "bucket", required: true, description: "Bucket name.", example: "acme-crm-data" },
+      { key: "prefix", required: false, description: "Key prefix inside the bucket.", default: "" },
+      { key: "forcePathStyle", required: false, description: "Path-style URLs (default: on outside AWS)." }
+    ],
+    credentialTypes: ["s3"],
+    notes: ["The bucket needs a CORS rule for the admin's origin (GET, PUT, DELETE, HEAD; headers authorization, content-type, x-amz-*): `agentcrm doctor` prints it."]
+  },
+  {
+    id: "github",
+    connectorId: "git-pages",
+    summary: "A PRIVATE GitHub repository (files committed with [skip ci], never published).",
+    fields: [
+      { key: "owner", required: true, description: "User or organisation.", example: "acme" },
+      { key: "repo", required: true, description: "Private repository.", example: "acme-crm-data" },
+      { key: "branch", required: false, description: "Branch.", default: "main" },
+      { key: "apiBaseUrl", required: false, description: "GitHub Enterprise API URL." }
+    ],
+    credentialTypes: ["github"],
+    notes: ["One commit per write: fine for small teams; a bucket is faster."]
+  },
+  {
+    id: "gitlab",
+    connectorId: "git-pages",
+    summary: "A PRIVATE GitLab project.",
+    fields: [
+      { key: "project", required: true, description: "Project path.", example: "acme/crm-data" },
+      { key: "branch", required: false, description: "Branch.", default: "main" },
+      { key: "apiBaseUrl", required: false, description: "Self-hosted GitLab API URL." }
+    ],
+    credentialTypes: ["gitlab"],
+    notes: []
+  },
+  {
+    id: "local-folder",
+    connectorId: "local-folder",
+    summary: "A folder on this computer (absolute path). The browser admin opens the same folder with its folder picker (Chrome / Edge).",
+    fields: [{ key: "path", required: true, description: "Absolute folder path (created if missing).", example: "/Users/me/Documents/acme-crm" }],
+    credentialTypes: [],
+    notes: ["Back the folder up (or put it in a synced drive): it is the only copy."]
+  }
+];
+const HOSTINGS = [
+  {
+    id: "s3",
+    connectorId: "s3",
+    summary: "An S3-compatible bucket with static website hosting (or a CDN in front).",
+    cli: true,
+    fields: [
+      { key: "endpoint", required: false, description: "S3 API endpoint (omit for AWS)." },
+      { key: "region", required: true, description: "Region." },
+      { key: "bucket", required: true, description: "Bucket serving the admin." },
+      { key: "prefix", required: false, description: "Key prefix.", default: "" },
+      { key: "siteUrl", required: true, description: "Public HTTPS URL of the bucket / CDN root.", example: "https://crm.acme.com" },
+      { key: "publicRead", required: false, description: "Send x-amz-acl: public-read (OVH / Scaleway buckets without a bucket policy)." }
+    ],
+    credentialTypes: ["s3"],
+    notes: ["Use HTTPS: the admin signs storage requests with WebCrypto, which browsers only allow on secure pages."]
+  },
+  {
+    id: "github-pages",
+    connectorId: "git-pages",
+    summary: "GitHub Pages (a public repo on free plans).",
+    cli: true,
+    fields: [
+      { key: "owner", required: true, description: "User or organisation." },
+      { key: "repo", required: true, description: "Repository served by Pages." },
+      { key: "branch", required: false, description: "Branch.", default: "main" },
+      { key: "dir", required: false, description: 'Folder served ("" or docs).', default: "" },
+      { key: "siteUrl", required: false, description: "Pages URL.", default: "https://<owner>.github.io/<repo>" }
+    ],
+    credentialTypes: ["github"],
+    notes: ["The admin holds no data: a public repo only exposes the app code and config.js (no secrets)."]
+  },
+  {
+    id: "gitlab-pages",
+    connectorId: "git-pages",
+    summary: "GitLab Pages (a .gitlab-ci.yml is added when missing).",
+    cli: true,
+    fields: [
+      { key: "project", required: true, description: "Project path." },
+      { key: "branch", required: false, description: "Branch.", default: "main" },
+      { key: "dir", required: false, description: "Folder published.", default: "public" },
+      { key: "siteUrl", required: true, description: "Pages URL." }
+    ],
+    credentialTypes: ["gitlab"],
+    notes: []
+  },
+  {
+    id: "cloudflare-pages",
+    connectorId: "git-pages",
+    summary: "Cloudflare Pages connected to a GitHub / GitLab repo (works with private repos on the free plan).",
+    cli: true,
+    fields: [
+      { key: "provider", required: false, description: "github | gitlab", default: "github" },
+      { key: "owner", required: false, description: "GitHub owner." },
+      { key: "repo", required: false, description: "GitHub repo." },
+      { key: "project", required: false, description: "GitLab project." },
+      { key: "branch", required: false, description: "Branch.", default: "main" },
+      { key: "siteUrl", required: true, description: "The *.pages.dev or custom domain URL." }
+    ],
+    credentialTypes: ["github", "gitlab"],
+    notes: ["Create the Pages project in the Cloudflare dashboard (no build command, output directory = the repo root)."]
+  },
+  {
+    id: "local-folder",
+    connectorId: "local-folder",
+    summary: "A folder on this computer (serve it with `agentcrm serve` or any static server).",
+    cli: true,
+    fields: [
+      { key: "path", required: true, description: "Absolute folder path." },
+      { key: "siteUrl", required: false, description: "URL the folder is served at, if any.", example: "http://localhost:4173" }
+    ],
+    credentialTypes: [],
+    notes: []
+  },
+  {
+    id: "zip",
+    connectorId: "browser-mirror",
+    summary: "Download the admin as a ZIP and upload it anywhere by hand.",
+    cli: false,
+    fields: [],
+    credentialTypes: [],
+    notes: ["Setup wizard only (`agentcrm serve`). From the CLI, use `hosting: false` and copy dist/admin yourself."]
+  }
+];
+function findBackend(id) {
+  return DATA_BACKENDS.find((b) => b.id === id);
+}
+function findLocation(id) {
+  return LOCATIONS.find((l) => l.id === id);
+}
+function findHosting(id) {
+  return HOSTINGS.find((h) => h.id === id);
+}
+const versionCommand = {
+  name: "version",
+  usage: "version",
+  summary: "Print the AgentCRM version (CLI, minimum skills version, data schema).",
+  options: [],
+  async run({ io }) {
+    const info = readVersionInfo();
+    printResult(io, { ...info, bundled: isBundled(), node: process.versions.node }, () => info.version);
+  }
+};
+async function siteStatus(site, version2, dataSchema) {
+  const base = { alias: site.alias, adminUrl: site.adminUrl };
+  if (!site.adminUrl) return { ...base, adminVersion: null, state: "not-hosted" };
+  const hosted = await fetchHostedAdmin(site.adminUrl);
+  if (!hosted.version) return { ...base, adminVersion: null, state: "unreachable", error: hosted.error };
+  if (hosted.version !== site.adminVersion) putSite({ ...site, adminVersion: hosted.version });
+  const cmp = compareVersions(hosted.version, version2);
+  if (cmp === 0) return { ...base, adminVersion: hosted.version, state: "current" };
+  if (cmp > 0) return { ...base, adminVersion: hosted.version, state: "newer" };
+  return {
+    ...base,
+    adminVersion: hosted.version,
+    state: "update",
+    update: changesBetween(readChangelog(), hosted.version, version2),
+    blockedByDataSchema: hosted.dataSchema !== null && hosted.dataSchema > dataSchema
+  };
+}
+const statusCommand = {
+  name: "status",
+  usage: "status [--site <alias>]",
+  summary: "Versions overview — run it first: this tool (= the skills) vs the latest npm release, and every registered CRM's hosted admin vs this release.",
+  options: [{ name: "site", type: "string", description: "Only this site (default: every registered site)." }],
+  async run({ io, options }) {
+    const info = readVersionInfo();
+    const alias = strOpt(options, "site");
+    const sites = alias ? [resolveSite(alias)] : listSites().sites;
+    const [latest, statuses] = await Promise.all([fetchLatestVersion(PACKAGE_NAME), Promise.all(sites.map((s) => siteStatus(s, info.version, info.dataSchema)))]);
+    const updateAvailable = latest ? compareVersions(latest, info.version) > 0 : null;
+    const data = {
+      tool: { version: info.version, latest, updateAvailable, minSkillsVersion: info.minSkillsVersion, dataSchema: info.dataSchema },
+      sites: statuses,
+      advice: [
+        ...updateAvailable ? [`agentcrm ${latest} is available (this is ${info.version}): offer to update the skills first (Claude Code: /plugin marketplace update agentcrm, then /reload-plugins).`] : [],
+        ...statuses.filter((s) => s.state === "update").map(
+          (s) => s.blockedByDataSchema ? `${s.alias}: the hosted admin stores data in a newer format than this tool — update the tool, never downgrade.` : `${s.alias}: admin ${s.adminVersion} → ${info.version} available${s.update?.breaking ? " (BREAKING — read the changes)" : ""}: offer \`agentcrm deploy-admin --site ${s.alias}\`.`
+        ),
+        ...statuses.filter((s) => s.state === "newer").map((s) => `${s.alias}: hosted admin ${s.adminVersion} is newer than this tool — update the tool before deploying.`),
+        ...statuses.filter((s) => s.state === "unreachable").map((s) => `${s.alias}: admin not reachable (${s.error}) — run \`agentcrm doctor --site ${s.alias}\`.`)
+      ]
+    };
+    printResult(
+      io,
+      data,
+      () => [
+        `agentcrm ${info.version}${updateAvailable ? ` — ${latest} available` : latest ? " (latest)" : ""}`,
+        ...statuses.map((s) => `  ${s.alias.padEnd(20)} admin ${s.adminVersion ?? "-"}  ${s.state}${s.error ? ` (${s.error})` : ""}`),
+        ...data.advice.length ? ["", ...data.advice.map((a) => `- ${a}`)] : []
+      ].join("\n")
+    );
+  }
+};
+const optionsCommand = {
+  name: "options",
+  usage: "options",
+  summary: "Data backends, data locations, admin hostings, credential types and the install plan format — ask the user about the data first, then the hosting. --firebase-rules <admin email> prints the Firestore security rules to publish.",
+  options: [{ name: "firebase-rules", type: "string", description: "Print the Firestore rules for a Firebase CRM with this email as bootstrap admin." }],
+  async run({ io, options }) {
+    const rulesEmail = strOpt(options, "firebase-rules");
+    if (rulesEmail) {
+      const { buildFirestoreRules } = await import("./chunks/firebaseRules-iori-s7U.mjs");
+      const rules = buildFirestoreRules({ adminEmail: rulesEmail });
+      printResult(io, { email: rulesEmail, rules, where: "Firebase console → Firestore Database → Rules → paste → Publish (or `firebase deploy --only firestore:rules`)." }, () => rules);
+      return;
+    }
+    const { PLAN_EXAMPLE } = await import("./chunks/plan-C0TBrU92.mjs");
+    const data = {
+      order: ["data backend", "data location", "admin hosting"],
+      backends: DATA_BACKENDS,
+      locations: LOCATIONS,
+      hostings: HOSTINGS,
+      credentialTypes: CREDENTIAL_TYPES,
+      planFormat: {
+        alias: "lower-case-alias (required)",
+        name: "Display name of the CRM",
+        owner: "{ name, email } — the first admin; the CLI acts as this user",
+        data: '{ backend: "journal", location: { type, settings, credential }, root?, encryption? } | { backend: "git-json", git: {…}, credential } | { backend: "firebase", firebase: {…}, credential }',
+        hosting: "{ type, settings, credential?, folder? } | false",
+        demo: "true seeds ~30 companies, 80 people, 40 deals and their activities",
+        currency: "ISO code, default EUR / USD from settings",
+        locale: "BCP-47, e.g. en-US / fr-FR"
+      },
+      planExample: PLAN_EXAMPLE,
+      planNotes: [
+        "Secrets never go in the plan: store them first with `agentcrm credentials set <type>:<name>` (the user types them, or --from-env) and reference the account id.",
+        "Journal data is encrypted by default: a passphrase is generated at install and stored as passphrase:<alias> on this computer — the user must save it in a password manager.",
+        "hosting.credential may be omitted for git hostings on the same provider as the data credential.",
+        "hosting: false skips uploading the admin (run `agentcrm serve` to use it locally).",
+        "Run `agentcrm install --plan plan.json --dry-run` first: it checks every access without writing."
+      ]
+    };
+    printResult(
+      io,
+      data,
+      () => [
+        "1. Data backend:",
+        ...DATA_BACKENDS.map((d) => `   ${d.id.padEnd(10)} ${d.summary}${d.cli ? "" : "  (browser only)"}`),
+        "",
+        "2. Data location (journal):",
+        ...LOCATIONS.map((l) => `   ${l.id.padEnd(13)} ${l.summary}`),
+        "",
+        "3. Admin hosting:",
+        ...HOSTINGS.map((h) => `   ${h.id.padEnd(17)} ${h.summary}${h.cli ? "" : "  (wizard only)"}`),
+        "",
+        "Plan example (agentcrm install --plan plan.json):",
+        JSON.stringify(PLAN_EXAMPLE, null, 2)
+      ].join("\n")
+    );
+  }
+};
+const objectsCommand = {
+  name: "objects",
+  usage: "objects <list|get|create|update|delete> …",
+  summary: "The data model: list objects, describe one (fields, types, select options, relations, pipelines), create custom objects, rename / recolor, delete a custom object (admin).",
+  subcommands: [
+    { name: "list", usage: "objects list", summary: "Objects with record counts." },
+    { name: "get", usage: "objects get <id>", summary: "Fields (ids, types, options, relations) and pipelines of one object — read it before writing records." },
+    { name: "create", usage: "objects create --singular <label> --plural <label> [--id <slug>] [--icon <name>] [--color <c>] [--data <json>]", summary: "Create a custom object (with a name field; add fields with `fields add`).", writes: true },
+    { name: "update", usage: "objects update <id> [--singular …] [--plural …] [--icon …] [--color …] [--label-field <fieldId>]", summary: "Rename, change icon / color / label field.", writes: true },
+    { name: "delete", usage: "objects delete <id> [--yes]", summary: "Delete a custom object, ALL its records, its views and relation fields pointing at it. Plan unless --yes.", writes: true, destructive: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "singular", type: "string", description: "Singular label." },
+    { name: "plural", type: "string", description: "Plural label." },
+    { name: "id", type: "string", description: "create: object id (slug; default from the plural label)." },
+    { name: "icon", type: "string", description: "Icon name (lucide)." },
+    { name: "color", type: "string", description: "Color name." },
+    { name: "label-field", type: "string", description: "update: field used as the record label." },
+    { name: "data", type: "string", description: "create: full ObjectInput JSON (with fields) or @file." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action = "list", id] = positionals;
+    switch (action) {
+      case "list":
+        return withSession(io, options, {}, async ({ ctx, store }) => {
+          const { listObjects } = await import("./chunks/schema-DlHt2PxI.mjs");
+          const { recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
+          return listObjects(ctx).map((o) => ({ id: o.id, labelSingular: o.labelSingular, labelPlural: o.labelPlural, standard: o.standard, labelField: o.labelField, fields: o.fields.length, records: recordsOf(store, o.id).length }));
+        }, (rows) => table(rows, ["id", "labelPlural", "fields", "records", "standard"]));
+      case "get": {
+        const objectId = positional(positionals, 1, "object id", "objects get <id>");
+        return withSession(io, options, {}, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).describeSchema(ctx, objectId));
+      }
+      case "create": {
+        const data = jsonObjectOpt(options, "data") ?? {};
+        const input = {
+          ...data,
+          ...strOpt(options, "id") ? { id: strOpt(options, "id") } : {},
+          labelSingular: strOpt(options, "singular") ?? data.labelSingular,
+          labelPlural: strOpt(options, "plural") ?? data.labelPlural,
+          ...strOpt(options, "icon") ? { icon: strOpt(options, "icon") } : {},
+          ...strOpt(options, "color") ? { color: strOpt(options, "color") } : {}
+        };
+        if (!input.labelSingular || !input.labelPlural) usage("objects create needs --singular and --plural (or --data).");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).createObject(ctx, input));
+      }
+      case "update": {
+        const objectId = positional(positionals, 1, "object id", "objects update <id> …");
+        const patch = {
+          ...strOpt(options, "singular") ? { labelSingular: strOpt(options, "singular") } : {},
+          ...strOpt(options, "plural") ? { labelPlural: strOpt(options, "plural") } : {},
+          ...strOpt(options, "icon") ? { icon: strOpt(options, "icon") } : {},
+          ...strOpt(options, "color") ? { color: strOpt(options, "color") } : {},
+          ...strOpt(options, "label-field") ? { labelField: strOpt(options, "label-field") } : {}
+        };
+        if (!Object.keys(patch).length) usage("objects update needs --singular, --plural, --icon, --color or --label-field.");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).updateObject(ctx, objectId, patch));
+      }
+      case "delete": {
+        if (!id) usage("objects delete needs an object id.");
+        return withSession(io, options, { lock: options.yes === true }, async ({ ctx, store }) => {
+          const { getObject, deleteObject } = await import("./chunks/schema-DlHt2PxI.mjs");
+          const { recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
+          const o = getObject(ctx, id);
+          const plan = { object: o.id, label: o.labelPlural, standard: o.standard, recordsDeleted: recordsOf(store, o.id, { includeDeleted: true }).length };
+          if (options.yes !== true) return { needsConfirmation: true, plan };
+          return deleteObject(ctx, id);
+        });
+      }
+      default:
+        usage(`Unknown objects action "${action}".`, "Use list, get, create, update or delete.");
+    }
+  }
+};
+const fieldsCommand = {
+  name: "fields",
+  usage: "fields <add|update|delete> --object <id> …",
+  summary: "Custom fields: add (any type, select options, relations), update (label, options, required, type change with data migration), delete (values cleared). Admin only.",
+  subcommands: [
+    { name: "add", usage: `fields add --object <id> --label <label> --type <${FIELD_TYPES.join("|")}> [--options a,b,c] [--relation-object <id> --cardinality one|many] [--required] [--unique] [--description …] [--id <fieldId>]`, summary: "Add a field.", writes: true },
+    { name: "update", usage: "fields update <fieldId> --object <id> [--label …] [--options a,b] [--type <t>] [--required|--optional] [--data <json>]", summary: "Change a field (type changes migrate existing values).", writes: true },
+    { name: "delete", usage: "fields delete <fieldId> --object <id> [--yes]", summary: "Delete a custom field and clear its values. Plan unless --yes.", writes: true, destructive: true }
+  ],
+  options: [
+    SITE_OPTION,
+    AS_OPTION,
+    YES_OPTION,
+    { name: "object", type: "string", description: "Object id." },
+    { name: "label", type: "string", description: "Field label." },
+    { name: "type", type: "string", description: `Field type: ${FIELD_TYPES.join(", ")}.` },
+    { name: "id", type: "string", description: "add: field id (default: camelCase of the label)." },
+    { name: "options", type: "string", description: "select / multiSelect option labels, comma-separated." },
+    { name: "relation-object", type: "string", description: "relation: target object id." },
+    { name: "cardinality", type: "string", description: "relation: one (default) or many." },
+    { name: "required", type: "boolean", description: "Value required." },
+    { name: "optional", type: "boolean", description: "update: no longer required." },
+    { name: "unique", type: "boolean", description: "Values must be unique." },
+    { name: "description", type: "string", description: "Help text." },
+    { name: "data", type: "string", description: "update: raw FieldPatch JSON." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action, fieldId] = positionals;
+    const objectId = requireStr(options, "object", "Objects: `agentcrm objects list`.");
+    switch (action) {
+      case "add": {
+        const type2 = requireStr(options, "type");
+        if (!FIELD_TYPES.includes(type2)) usage(`Unknown field type "${type2}".`, `Types: ${FIELD_TYPES.join(", ")}.`);
+        const rel = strOpt(options, "relation-object");
+        if (type2 === "relation" && !rel) usage("relation fields need --relation-object <id>.");
+        const input = {
+          label: requireStr(options, "label"),
+          type: type2,
+          ...strOpt(options, "id") ? { id: strOpt(options, "id") } : {},
+          ...listOpt(options, "options") ? { options: listOpt(options, "options") } : {},
+          ...rel ? { relation: { object: rel, cardinality: strOpt(options, "cardinality") === "many" ? "many" : "one" } } : {},
+          ...boolOpt(options, "required") ? { required: true } : {},
+          ...boolOpt(options, "unique") ? { unique: true } : {},
+          ...strOpt(options, "description") ? { description: strOpt(options, "description") } : {}
+        };
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).createField(ctx, objectId, input));
+      }
+      case "update": {
+        if (!fieldId) usage("fields update needs a field id.");
+        const type2 = strOpt(options, "type");
+        if (type2 && !FIELD_TYPES.includes(type2)) usage(`Unknown field type "${type2}".`);
+        const patch = {
+          ...jsonObjectOpt(options, "data") ?? {},
+          ...strOpt(options, "label") ? { label: strOpt(options, "label") } : {},
+          ...listOpt(options, "options") ? { options: listOpt(options, "options") } : {},
+          ...type2 ? { type: type2 } : {},
+          ...boolOpt(options, "required") ? { required: true } : {},
+          ...boolOpt(options, "optional") ? { required: false } : {},
+          ...boolOpt(options, "unique") ? { unique: true } : {},
+          ...strOpt(options, "description") !== void 0 ? { description: strOpt(options, "description") } : {}
+        };
+        if (!Object.keys(patch).length) usage("fields update needs at least one change.");
+        return withSession(io, options, { lock: true }, async ({ ctx }) => (await import("./chunks/schema-DlHt2PxI.mjs")).updateField(ctx, objectId, fieldId, patch));
+      }
+      case "delete": {
+        if (!fieldId) usage("fields delete needs a field id.");
+        return withSession(io, options, { lock: options.yes === true }, async ({ ctx, store }) => {
+          const { getObject, deleteField } = await import("./chunks/schema-DlHt2PxI.mjs");
+          const { recordsOf } = await import("./chunks/store-5gqRSKXg.mjs");
+          const field = getObject(ctx, objectId).fields.find((f) => f.id === fieldId);
+          if (!field) usage(`No field "${fieldId}" on ${objectId}.`, `\`agentcrm objects get ${objectId}\` lists them.`);
+          const plan = { object: objectId, field: field.id, label: field.label, standard: !!field.standard, valuesCleared: recordsOf(store, objectId).filter((r) => r.fields[fieldId] !== void 0).length };
+          if (options.yes !== true) return { needsConfirmation: true, plan };
+          return deleteField(ctx, objectId, fieldId);
+        });
+      }
+      default:
+        usage(`Unknown fields action "${action ?? ""}".`, "Use add, update or delete.");
+    }
+  }
+};
+const MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8",
+  ".wasm": "application/wasm"
+};
+const NO_CACHE = /* @__PURE__ */ new Set(["/index.html", "/config.js", "/version.json", "/admin-files.json"]);
+function resolveRequestPath(root, url) {
+  let pathname;
+  try {
+    pathname = decodeURIComponent(new URL(url, "http://localhost").pathname);
+  } catch {
+    return null;
+  }
+  if (pathname.endsWith("/")) pathname += "index.html";
+  const file2 = normalize(join(root, pathname));
+  if (file2 !== root && !file2.startsWith(root.endsWith(sep) ? root : root + sep)) return null;
+  return file2;
+}
+function startStaticServer(root, host, port) {
+  const server = createServer((req, res) => {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      res.writeHead(405).end();
+      return;
+    }
+    const file2 = resolveRequestPath(root, req.url ?? "/");
+    if (!file2 || !existsSync(file2) || !statSync(file2).isFile()) {
+      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" }).end("Not found");
+      return;
+    }
+    const rel = "/" + file2.slice(root.length).split(sep).filter(Boolean).join("/");
+    res.writeHead(200, {
+      "content-type": MIME[extname(file2).toLowerCase()] ?? "application/octet-stream",
+      "cache-control": NO_CACHE.has(rel) ? "no-store" : "no-cache",
+      "x-content-type-options": "nosniff"
+    });
+    if (req.method === "HEAD") res.end();
+    else createReadStream(file2).pipe(res);
+  });
+  return new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      server.off("error", reject);
+      resolve2(server);
+    });
+  });
+}
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => void 0).unref();
+  } catch {
+  }
+}
+const serveCommand = {
+  name: "serve",
+  usage: "serve [--port <n>] [--dir <folder>] [--no-open]",
+  summary: "Serve the admin on this computer (127.0.0.1) and open the setup wizard in the browser. Runs until stopped (Ctrl+C).",
+  options: [
+    { name: "port", type: "string", description: "First port to try (the next free one is used).", default: "4173" },
+    { name: "dir", type: "string", description: "Serve this folder instead of the bundled admin (e.g. a local-folder hosting)." },
+    { name: "no-open", type: "boolean", description: "Don't open a browser." }
+  ],
+  async run({ io, options }) {
+    const root = strOpt(options, "dir") ?? join(distRoot(), "admin");
+    if (!existsSync(join(root, "index.html"))) throw new CliError("admin-missing", `No index.html in ${root}.`, "Use the npm package, or run `npm run build` in a clone.");
+    const first = Number(strOpt(options, "port") ?? 4173);
+    if (!Number.isInteger(first) || first < 1 || first > 65535) usage(`Invalid port: ${String(options.port)}`);
+    let server = null;
+    let port = first;
+    for (; port < first + 20 && port <= 65535; port++) {
+      try {
+        server = await startStaticServer(root, "127.0.0.1", port);
+        break;
+      } catch (e) {
+        if (e.code !== "EADDRINUSE") throw e;
+      }
+    }
+    if (!server) throw new CliError("port-busy", `Ports ${first}-${port - 1} are all in use.`, "Pass --port <n>.");
+    const url = `http://localhost:${port}/`;
+    printResult(io, { url, root }, () => `AgentCRM admin running at ${url}
+Press Ctrl+C to stop.`);
+    if (!boolOpt(options, "no-open")) openBrowser(url);
+    await new Promise((resolve2) => {
+      const stop = () => server.close(() => resolve2());
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    });
+  }
+};
+function missingCredentials(site) {
+  const out = [];
+  const c = site.credentials;
+  const set = `\`agentcrm site credentials ${site.alias} --<role>-credential <account>\``;
+  const rt = site.runtime;
+  if (rt.backend === "journal") {
+    if (rt.journal.connectorId !== "local-folder" && !c.data) out.push(`No credential can open the data location: add one with ${set} (role data).`);
+    if (rt.journal.connectorId === "local-folder" && !site.dataPath) out.push("The data folder of this computer is unknown: re-register with --data-path <folder>.");
+    if (rt.journal.encrypted && !c.passphrase) out.push(`The dataset is encrypted and no passphrase credential is recorded: store it (\`agentcrm credentials set passphrase:${site.alias}\`) then ${set} (role passphrase).`);
+  }
+  if ((rt.backend === "git-json" || rt.backend === "firebase") && !c.data) out.push(`No ${rt.backend === "firebase" ? "Firebase login" : "git token"}: add it with ${set} (role data).`);
+  if (site.hosting && site.hosting.connectorId !== "local-folder" && !c.hosting) out.push(`No hosting credential: deploy-admin and forms publish will fail until one is added with ${set} (role hosting).`);
+  return out;
+}
+function checkAccount(v) {
+  parseAccount(v);
+  if (!getCredential(v)) throw new CliError("credential-missing", `${v} is not stored on this computer.`, `Store it first: \`agentcrm credentials set ${v}\` (in the user's own terminal).`, 2);
+  return v;
+}
+const siteCommand = {
+  name: "site",
+  usage: "site <list|show|add|use|rename|forget|credentials> [args] [--admin-url <url>] [--data-credential <acct>] [--hosting-credential <acct>] [--passphrase-credential <acct>] [--user <email>]",
+  summary: "The registry of CRMs this computer drives (~/.agentcrm/sites.json, no secrets): list, show, add an existing CRM, choose the default, rename, forget (local only — nothing is deleted online), attach credentials.",
+  subcommands: [
+    { name: "list", usage: "site list", summary: "Registered CRMs (* = default)." },
+    { name: "show", usage: "site show [<alias>]", summary: "One site's record (backend, location, hosting, credential accounts, CLI user)." },
+    { name: "add", usage: "site add <alias> (--admin-url <url> | --runtime <json|@file>) [--data-credential …] [--hosting-credential …] [--passphrase-credential …] [--data-path <folder>] [--user <email>]", summary: "Register a CRM installed elsewhere: reads its config.js, opens the data to prove the credentials, reads its hosting.", writes: true },
+    { name: "use", usage: "site use <alias>", summary: "Default site for commands without --site.", writes: true },
+    { name: "rename", usage: "site rename <from> <to>", summary: "Rename an alias.", writes: true },
+    { name: "forget", usage: "site forget <alias>", summary: "Remove from this computer's registry (nothing is deleted online).", writes: true },
+    { name: "credentials", usage: "site credentials <alias> [--data-credential <acct>] [--hosting-credential <acct>] [--passphrase-credential <acct>] [--user <email>]", summary: 'Attach / change the accounts a site uses ("" removes one).', writes: true }
+  ],
+  options: [
+    { name: "site", type: "string", description: "Site alias (show / credentials)." },
+    { name: "admin-url", type: "string", description: "add: URL of the hosted admin, e.g. https://crm.acme.com/admin/." },
+    { name: "runtime", type: "string", description: "add: the runtime config (config.js object) as JSON or @file, when the admin isn't hosted." },
+    { name: "data-credential", type: "string", description: "Account of the data location / git token / Firebase login." },
+    { name: "hosting-credential", type: "string", description: "Account used to write to the admin hosting." },
+    { name: "passphrase-credential", type: "string", description: "Passphrase account of an encrypted dataset." },
+    { name: "data-path", type: "string", description: "add: folder of this computer holding a local-folder dataset." },
+    { name: "user", type: "string", description: "Email of the CRM user the CLI acts as (default: the store identity / first admin)." }
+  ],
+  async run({ io, options, positionals }) {
+    const [action = "list", a, b] = positionals;
+    switch (action) {
+      case "list": {
+        const { default: def, sites } = listSites();
+        const rows = sites.map((s) => ({
+          alias: s.alias,
+          name: s.name ?? s.alias,
+          default: s.alias === def,
+          backend: s.runtime.backend,
+          location: s.runtime.backend === "journal" ? s.runtime.journal.connectorId : null,
+          hosting: s.hosting?.type ?? null,
+          adminUrl: s.adminUrl,
+          adminVersion: s.adminVersion ?? null
+        }));
+        printResult(
+          io,
+          { default: def, sites: rows },
+          () => rows.length ? rows.map((r) => `${r.default ? "*" : " "} ${r.alias.padEnd(20)} ${r.backend}${r.location ? `/${r.location}` : ""} → ${r.hosting ?? "not hosted"}  ${r.adminUrl ?? ""}`).join("\n") : "No CRM registered. Install one with `agentcrm install --plan …` or register one with `agentcrm site add`."
+        );
+        return;
+      }
+      case "show": {
+        const site = resolveSite(a ?? strOpt(options, "site"));
+        printResult(io, { ...site, warnings: missingCredentials(site) }, () => JSON.stringify(site, null, 2));
+        return;
+      }
+      case "use": {
+        if (!a) usage("site use needs an alias.");
+        setDefaultSite(a);
+        printResult(io, { default: a }, () => `Default site: ${a}`);
+        return;
+      }
+      case "rename": {
+        if (!a || !b) usage("site rename needs <from> <to>.");
+        renameSite(a, b);
+        printResult(io, { from: a, to: b }, () => `Renamed ${a} → ${b}`);
+        return;
+      }
+      case "forget": {
+        if (!a) usage("site forget needs an alias.");
+        const removed = removeSite(a);
+        printResult(io, { alias: a, removed }, () => removed ? `Forgot ${a} (nothing was deleted online).` : `${a} was not registered.`);
+        return;
+      }
+      case "credentials": {
+        const site = resolveSite(a ?? strOpt(options, "site"));
+        const roles = { data: "data-credential", hosting: "hosting-credential", passphrase: "passphrase-credential" };
+        const next = { ...site.credentials };
+        let changed = false;
+        for (const [role, flag] of Object.entries(roles)) {
+          const v = options[flag];
+          if (typeof v !== "string") continue;
+          if (v === "") delete next[role];
+          else next[role] = checkAccount(v);
+          changed = true;
+        }
+        const user = strOpt(options, "user");
+        if (user !== void 0) changed = true;
+        if (!changed) usage('site credentials needs --data-credential, --hosting-credential, --passphrase-credential and/or --user ("" removes one).');
+        const updated = { ...site, credentials: next, ...user !== void 0 ? { user: user || void 0 } : {} };
+        putSite(updated);
+        const warnings = missingCredentials(updated);
+        printResult(io, { alias: site.alias, credentials: next, user: updated.user ?? null, warnings }, () => [`${site.alias}: ${JSON.stringify(next)}`, ...warnings.map((w) => `  warning: ${w}`)].join("\n"));
+        return;
+      }
+      case "add": {
+        if (!a) usage("site add needs an alias.");
+        validateAlias(a);
+        if (getSite(a)) throw new CliError("site-exists", `A site named "${a}" already exists.`, "Pick another alias or `site forget` it first.");
+        const adminUrlRaw = strOpt(options, "admin-url");
+        let runtimeRaw = jsonObjectOpt(options, "runtime");
+        let adminUrl = null;
+        if (adminUrlRaw) {
+          adminUrl = adminUrlRaw.replace(/(index\.html)?$/, "").replace(/\/?$/, "/");
+          const res = await fetchText(`${adminUrl}config.js`);
+          if (!res.ok) throw new CliError("admin-unreachable", `Could not read ${adminUrl}config.js (${res.error ?? `HTTP ${res.status}`}).`, "Check the admin URL (it ends with the admin folder, e.g. …/admin/).");
+          try {
+            runtimeRaw = parseConfigJs(res.text);
+          } catch (err) {
+            throw new CliError("config-invalid", `${adminUrl}config.js: ${err.message}.`);
+          }
+        }
+        if (!runtimeRaw) usage("site add needs --admin-url <url> or --runtime <json|@file>.");
+        installBrowserEnv();
+        const { parseRuntimeConfig } = await import("./chunks/runtimeConfig-CCOFg1RM.mjs");
+        const runtime = parseRuntimeConfig(runtimeRaw);
+        if (!runtime) throw new CliError("config-invalid", "The runtime config is not a valid AgentCRM config.", "It is the object config.js assigns to window.__AGENTCRM_CONFIG__.");
+        const dataPath = strOpt(options, "data-path");
+        if (dataPath && !isAbsolute(dataPath)) usage("--data-path must be an absolute folder.");
+        const credentials$1 = {};
+        for (const [role, flag] of [["data", "data-credential"], ["hosting", "hosting-credential"], ["passphrase", "passphrase-credential"]]) {
+          const v = strOpt(options, flag);
+          if (v) credentials$1[role] = checkAccount(v);
+        }
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const site = {
+          alias: a,
+          name: runtime.name,
+          runtime,
+          ...dataPath ? { dataPath: resolve(dataPath) } : {},
+          hosting: null,
+          adminUrl,
+          credentials: credentials$1,
+          ...strOpt(options, "user") ? { user: strOpt(options, "user") } : {},
+          installedAt: now,
+          updatedAt: now
+        };
+        const warnings = [];
+        const { openStore: openStore2 } = await Promise.resolve().then(() => session);
+        const { dataTargetOf: dataTargetOf2 } = await Promise.resolve().then(() => session);
+        try {
+          const passphrase = credentials$1.passphrase ? (await Promise.resolve().then(() => credentials)).requireCredential(credentials$1.passphrase).values.passphrase : null;
+          const secrets = credentials$1.data && runtime.backend !== "journal" ? (await Promise.resolve().then(() => credentials)).requireCredential(credentials$1.data).values : void 0;
+          const store = await openStore2(runtime, { dataTarget: runtime.backend === "journal" ? dataTargetOf2(site) : void 0, secrets, passphrase });
+          try {
+            await store.ready();
+            const hosting = store.get("config", "hosting");
+            if (hosting?.connectorId) {
+              site.hosting = { type: hosting.type ?? hosting.connectorId, connectorId: hosting.connectorId, settings: hosting.settings ?? {}, folder: hosting.folder ?? "admin" };
+            }
+          } finally {
+            store.close?.();
+          }
+        } catch (err) {
+          const e = err;
+          if (e.name === "PassphraseError") throw err;
+          warnings.push(`Could not open the data yet: ${e.message}`);
+        }
+        putSite(site);
+        warnings.push(...missingCredentials(site));
+        printResult(io, { ...site, warnings }, () => [`Registered ${a}: ${runtime.backend} → ${site.hosting?.type ?? "hosting unknown"}`, ...warnings.map((w) => `  warning: ${w}`)].join("\n"));
+        return;
+      }
+      default:
+        usage(`Unknown action "${action}".`, "Use list, show, add, use, rename, forget or credentials.");
+    }
+  }
+};
+const toolsCommand = {
+  name: "tools",
+  usage: "tools <list|call> [<name>] [--input <json|@file>]",
+  summary: "The AI tool catalog (src/ai/tools.ts + the tools of the site's enabled extension modules) — exactly what the MCP server and the in-admin assistant expose: list the tools with their JSON schemas, or call one with a JSON input.",
+  subcommands: [
+    { name: "list", usage: "tools list [--site <alias>]", summary: "Tools with description, input schema, whether they write and their source (builtin / extension)." },
+    { name: "call", usage: "tools call <name> --input <json|@file>", summary: "Run one tool as the site's CLI user.", writes: true }
+  ],
+  options: [SITE_OPTION, AS_OPTION, { name: "input", type: "string", description: "call: the tool input as a JSON object or @file." }],
+  async run({ io, options, positionals }) {
+    const [action = "list"] = positionals;
+    if (action === "list") {
+      const { listAiTools, AI_TOOLS } = await import("./chunks/tools-Bew8lxKx.mjs");
+      const builtin = new Set(AI_TOOLS.map((t) => t.name));
+      const shape = () => listAiTools().map((t) => ({ name: t.name, description: t.description, mutating: t.mutating, source: builtin.has(t.name) ? "builtin" : "extension", inputSchema: t.inputSchema }));
+      const human = (r) => table(r.tools, ["name", "mutating", "source", "description"]);
+      let site = strOpt(options, "site");
+      if (!site) {
+        try {
+          site = resolveSite().alias;
+        } catch {
+          site = void 0;
+        }
+      }
+      if (!site) {
+        printResult(io, { tools: shape(), site: null }, () => human({ tools: shape() }));
+        return;
+      }
+      return withSession(io, { ...options, site }, {}, async (s) => ({ tools: shape(), site: s.site.alias }), human);
+    }
+    if (action === "call") {
+      const name2 = positional(positionals, 1, "tool name", "tools call <name> --input <json>");
+      const { findTool, callTool, listAiTools } = await import("./chunks/tools-Bew8lxKx.mjs");
+      const input = jsonObjectOpt(options, "input") ?? {};
+      const builtin = findTool(name2);
+      return withSession(io, options, { lock: builtin ? builtin.mutating : true }, async ({ ctx }) => {
+        if (!findTool(name2)) usage(`Unknown tool "${name2}".`, `\`agentcrm tools list\` lists them (${listAiTools().length} available).`);
+        return { tool: name2, result: await callTool(ctx, name2, input) };
+      });
+    }
+    usage(`Unknown tools action "${action}".`, "Use list or call.");
+  }
+};
+const mcpCommand = {
+  name: "mcp",
+  usage: "mcp [--site <alias>] [--read-only] [--as <user>]",
+  summary: "Run the MCP server on stdio (JSON-RPC 2.0, protocol 2025-06-18 / 2024-11-05): tools = the AI catalog incl. the site's extension tools (read-only mode hides the ones that write; --safe skips extensions), resources = schema, pipelines, modules, appearance, prompts = pipeline review, follow-up email, lead qualification. For Claude Desktop / Claude Code / Cursor.",
+  options: [SITE_OPTION, AS_OPTION, { name: "read-only", type: "boolean", description: "Expose only the tools that don't write." }],
+  async run({ options }) {
+    const readOnly = boolOpt(options, "read-only");
+    const session2 = await openSession(strOpt(options, "site"), { as: strOpt(options, "as"), safe: options.safe === true });
+    const log = (msg) => process.stderr.write(`${msg}
+`);
+    for (const w of session2.warnings) log(`[agentcrm mcp] note: ${w}`);
+    const { listAiTools } = await import("./chunks/tools-Bew8lxKx.mjs");
+    const { createMcpServer, serveStdio } = await import("./chunks/server-ISwlDRCN.mjs");
+    let lastRefresh = Date.now();
+    const server = createMcpServer({
+      readOnly,
+      // Built-ins + the tools of the site's loaded extensions, live.
+      tools: () => listAiTools(),
+      log,
+      backend: {
+        serverName: "agentcrm",
+        version: readVersionInfo().version,
+        siteLabel: `site ${session2.site.alias}${session2.user ? `, acting as ${session2.user.email} (${session2.user.role})` : ""}`,
+        async context() {
+          if (Date.now() - lastRefresh > 5e3) {
+            lastRefresh = Date.now();
+            await session2.store.refresh().catch((err) => log(`[agentcrm mcp] refresh failed: ${err.message}`));
+            const report = await session2.extensions.sync();
+            for (const f of report?.failed ?? []) log(`[agentcrm mcp] extension ${f.id} failed to load: ${f.error}`);
+          }
+          return session2.ctx;
+        },
+        async withWrite(fn) {
+          const unlock = lockSite(session2.site.alias);
+          try {
+            return await fn();
+          } finally {
+            unlock();
+          }
+        }
+      }
+    });
+    log(`[agentcrm mcp] serving ${session2.site.alias}${readOnly ? " (read-only)" : ""} on stdio — ${server.toolNames().length} tools`);
+    try {
+      await serveStdio(server, process.stdin, (line) => process.stdout.write(line + "\n"), log);
+    } finally {
+      await session2.close();
+    }
+    return 0;
+  }
+};
+const GLOBAL_OPTIONS = [
+  { name: "json", type: "boolean", description: "Print one JSON object on stdout: { ok, data } or { ok: false, error: { code, message, hint } }." },
+  { name: "help", type: "boolean", description: "Show the command's usage and options instead of running it." },
+  { name: "safe", type: "boolean", description: "Safe mode: don't load the site's extensions (modules / themes) in this run (also AGENTCRM_SAFE=1)." }
+];
+const helpCommand = {
+  name: "help",
+  usage: "help [<command>]",
+  summary: "List commands with their subcommands and options (--json gives a machine-readable list).",
+  options: [],
+  async run({ io, positionals }) {
+    const wanted = positionals[0];
+    const list = wanted ? COMMANDS.filter((c) => c.name === wanted) : COMMANDS;
+    if (wanted && !list.length) {
+      const { CliError: CliError2 } = await Promise.resolve().then(() => output);
+      throw new CliError2("unknown-command", `Unknown command "${wanted}".`, `Available: ${COMMANDS.map((c) => c.name).join(", ")}.`, 2);
+    }
+    const { version: version2 } = readVersionInfo();
+    const data = {
+      name: "agentcrm",
+      version: version2,
+      globalOptions: GLOBAL_OPTIONS,
+      commands: list.map(({ name: name2, summary, usage: usage2, options, subcommands }) => ({ name: name2, summary, usage: usage2, options, ...subcommands ? { subcommands } : {} }))
+    };
+    printResult(
+      io,
+      data,
+      () => [
+        `agentcrm ${version2} — the static CRM your AI agent can run.`,
+        "",
+        "Usage: agentcrm <command> [options] [--json]",
+        "",
+        ...list.flatMap((c) => [
+          `  ${c.usage}`,
+          `      ${c.summary}`,
+          ...wanted ? (c.subcommands ?? []).map((s) => `      · ${s.usage}
+          ${s.summary}`) : [],
+          ...wanted ? c.options.map((o) => `      --${o.name}${o.type === "string" ? " <value>" : ""}  ${o.description}`) : []
+        ]),
+        "",
+        "Global options:",
+        ...GLOBAL_OPTIONS.map((o) => `  --${o.name}  ${o.description}`),
+        ...wanted ? [] : ["", "`agentcrm help <command>` shows a command's actions and options."]
+      ].join("\n")
+    );
+  }
+};
+const COMMANDS = [
+  helpCommand,
+  versionCommand,
+  statusCommand,
+  optionsCommand,
+  credentialsCommand,
+  installCommand,
+  siteCommand,
+  doctorCommand,
+  serveCommand,
+  deployAdminCommand,
+  recordsCommand,
+  objectsCommand,
+  fieldsCommand,
+  activitiesCommand,
+  notesCommand,
+  tasksCommand,
+  filesCommand,
+  pipelinesCommand,
+  viewsCommand,
+  usersCommand,
+  settingsCommand,
+  importCommand,
+  exportCommand,
+  reportCommand,
+  automationsCommand,
+  formsCommand,
+  compactCommand,
+  statsCommand,
+  modulesCommand,
+  appearanceCommand,
+  extCommand,
+  toolsCommand,
+  mcpCommand
+];
+function findCommand(name2) {
+  return COMMANDS.find((c) => c.name === name2);
+}
+async function main(argv, io) {
+  const json = argv.includes("--json");
+  const out = createIo(json);
+  try {
+    const [name2 = "help", ...rest] = argv.filter((a) => a !== "--json");
+    if (name2 === "--help" || name2 === "-h") return await run("help", rest, out) ?? 0;
+    if (name2 === "--version" || name2 === "-v") return await run("version", rest, out) ?? 0;
+    return await run(name2, rest, out) ?? 0;
+  } catch (error) {
+    return printError(out, error);
+  }
+}
+async function run(name2, args, io) {
+  const command = findCommand(name2);
+  if (!command) {
+    throw new CliError("unknown-command", `Unknown command "${name2}".`, `Available: ${COMMANDS.map((c) => c.name).join(", ")}. Run \`agentcrm help\`.`, 2);
+  }
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args,
+      allowPositionals: true,
+      strict: true,
+      options: Object.fromEntries([...command.options, ...GLOBAL_OPTIONS].map((o) => [o.name, { type: o.type, ...o.multiple ? { multiple: true } : {} }]))
+    });
+  } catch (e) {
+    throw new CliError("usage", e.message, `Usage: agentcrm ${command.usage}`, 2);
+  }
+  if (parsed.values.help && command.name !== "help") return run("help", [command.name], io);
+  return command.run({
+    io,
+    options: parsed.values,
+    positionals: parsed.positionals
+  });
+}
+installBrowserEnv();
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    console.error(err);
+    process.exit(1);
+  }
+);
+export {
+  ACTIVITY_TYPES as A,
+  CliError as C,
+  FILTER_OPS as F,
+  HOSTINGS as H,
+  LOCATIONS as L,
+  PACKAGE_NAME as P,
+  USER_ROLES as U,
+  parseAccount as a,
+  requireCredential as b,
+  findLocation as c,
+  findHosting as d,
+  FIELD_TYPES as e,
+  findBackend as f,
+  getCredential as g,
+  openStore as h,
+  distRoot as i,
+  nodeImportBundle as n,
+  ownPackageRoot as o,
+  packageRoot as p,
+  readVersionInfo as r,
+  setCredential as s,
+  toCliError as t,
+  validateAlias as v
+};