@growrk/cli 4.9.0

package/dist/cli.mjs

@@ -0,0 +1,1568 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { config } from "dotenv";
+import cac from "cac";
+
+// src/commands/auth.ts
+import chalk2 from "chalk";
+
+// src/config.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { parse, stringify } from "yaml";
+var CONFIG_DIR = join(homedir(), ".growrk");
+var CONFIG_FILE = join(CONFIG_DIR, "config.yml");
+function loadConfig() {
+  if (!existsSync(CONFIG_FILE)) {
+    return { defaultAccount: "", accounts: {} };
+  }
+  const raw = readFileSync(CONFIG_FILE, "utf-8");
+  return parse(raw) || { defaultAccount: "", accounts: {} };
+}
+function saveConfig(config2) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_FILE, stringify(config2), "utf-8");
+}
+function getActiveAccount() {
+  const config2 = loadConfig();
+  if (!config2.defaultAccount || !config2.accounts[config2.defaultAccount]) {
+    return null;
+  }
+  return config2.accounts[config2.defaultAccount];
+}
+function removeAccount(name) {
+  const config2 = loadConfig();
+  if (!config2.accounts[name]) return false;
+  const { [name]: _, ...rest } = config2.accounts;
+  config2.accounts = rest;
+  if (config2.defaultAccount === name) {
+    config2.defaultAccount = Object.keys(config2.accounts)[0] || "";
+  }
+  saveConfig(config2);
+  return true;
+}
+
+// src/environments.ts
+var ENVIRONMENTS = {
+  prod: "https://ai.growrk.com",
+  // io.growrk.com is the same host behind the ai.growrk.com alias — kept for
+  // anyone who pinned it before the cutover.
+  io: "https://io.growrk.com",
+  // The `next` branch deploys to the growrk-staging project, whose io hosting
+  // site is `growrk-staging-io` (the pipeline's io job ends with
+  // `hosting[growrk-staging-io]: release complete`). growrk-next-io was never
+  // created and 404s, so this pointed at nothing.
+  next: "https://growrk-staging-io.web.app",
+  danielgdev: "https://growrk-danielgdev-io.web.app",
+  elsayedfarahat: "https://growrk-elsayedfarahat-io-test.web.app",
+  // `localhost`, not `127.0.0.1`: the io dev server binds IPv6 (`[::1]:3001`)
+  // on macOS, so the IPv4 literal fails with an opaque
+  // "NETWORK_ERROR: <no response> fetch failed". `localhost` resolves on both
+  // stacks.
+  local: "http://localhost:3001"
+};
+function resolveEnvironment(env, opts) {
+  const url = ENVIRONMENTS[env];
+  if (!url) {
+    const allowed = Object.keys(ENVIRONMENTS).join(", ");
+    throw new Error(`Unknown environment '${env}'. Allowed: ${allowed}`);
+  }
+  if (env === "local" && !opts?.allowLocalhost) {
+    throw new Error("Local environment requires --allow-localhost flag.");
+  }
+  return url;
+}
+function environmentLabel(ctx) {
+  if (ctx.environment) return ctx.environment;
+  const match = Object.entries(ENVIRONMENTS).find(([, url]) => url === ctx.apiUrl);
+  return match ? match[0] : "custom";
+}
+function validateApiUrl(url, opts) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid API URL '${url}'. Must use https:// (or http://localhost / http://127.0.0.1 with --allow-localhost).`);
+  }
+  if (parsed.protocol === "https:") return;
+  if (opts?.allowLocalhost && parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1")) return;
+  throw new Error(`Invalid API URL '${url}'. Must use https:// (or http://localhost / http://127.0.0.1 with --allow-localhost).`);
+}
+
+// src/auth.ts
+var VALID_FORMATS = ["json", "table", "text"];
+function resolveContext(argv) {
+  const account = getActiveAccount();
+  const apiKey = argv.apiKey || process.env.GROWRK_API_KEY || account?.apiKey;
+  if (!apiKey) {
+    throw new Error("No API key configured. Run `growrk auth login` or set GROWRK_API_KEY.");
+  }
+  const localhostOpts = { allowLocalhost: argv.allowLocalhost };
+  let apiUrl;
+  let environment;
+  if (argv.apiUrl) {
+    validateApiUrl(argv.apiUrl, localhostOpts);
+    apiUrl = argv.apiUrl;
+  } else if (argv.environment) {
+    environment = argv.environment;
+    apiUrl = resolveEnvironment(argv.environment, localhostOpts);
+  } else if (process.env.GROWRK_ENVIRONMENT) {
+    environment = process.env.GROWRK_ENVIRONMENT;
+    apiUrl = resolveEnvironment(process.env.GROWRK_ENVIRONMENT, localhostOpts);
+  } else if (account?.environment) {
+    environment = account.environment;
+    apiUrl = resolveEnvironment(account.environment, localhostOpts);
+  } else {
+    apiUrl = process.env.GROWRK_API_URL || account?.apiUrl || "https://ai.growrk.com";
+  }
+  const format = argv.format || "table";
+  if (!VALID_FORMATS.includes(format)) {
+    throw new Error(`Invalid format "${argv.format}". Valid formats: ${VALID_FORMATS.join(", ")}`);
+  }
+  return { apiKey, apiUrl, format, environment };
+}
+
+// src/v4/client.ts
+import { ofetch } from "ofetch";
+import { randomUUID } from "crypto";
+var meta = (correlationId) => ({ correlationId, timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: "v4" });
+function httpStatusToCode(status) {
+  switch (status) {
+    case 401:
+      return "UNAUTHORIZED";
+    case 403:
+      return "FORBIDDEN";
+    case 404:
+      return "NOT_FOUND";
+    case 400:
+    case 409:
+      return "VALIDATION_ERROR";
+    case 429:
+      return "RATE_LIMITED";
+    default:
+      return status && status >= 500 ? "INTERNAL_ERROR" : "API_ERROR";
+  }
+}
+var REQUEST_TIMEOUT_MS = 6e4;
+function createV4Client(ctx) {
+  const baseURL = `${ctx.apiUrl}/v4`;
+  const request = async (method, path, opts = {}) => {
+    const correlationId = randomUUID();
+    try {
+      const data = await ofetch(path, {
+        baseURL,
+        method,
+        query: opts.query,
+        body: opts.body,
+        // Without this a server that accepts the connection and never answers
+        // leaves the CLI hanging with no output and no way to tell whether the
+        // write landed. ofetch (1.5.x) aborts the request itself.
+        timeout: REQUEST_TIMEOUT_MS,
+        headers: { "X-API-KEY": ctx.apiKey, "X-Correlation-Id": correlationId }
+      });
+      return { ok: true, data, meta: meta(correlationId) };
+    } catch (e) {
+      const err = e;
+      const status = err.response?.status ?? err.data?.statusCode;
+      if (status) {
+        const message2 = err.data?.statusMessage || err.data?.message || err.message || "Request failed";
+        return { ok: false, error: { code: httpStatusToCode(status), message: message2 }, meta: meta(correlationId) };
+      }
+      const message = e instanceof Error ? e.message : "Failed to connect to GroWrk API";
+      return { ok: false, error: { code: "NETWORK_ERROR", message }, meta: meta(correlationId) };
+    }
+  };
+  return {
+    get: (path, query) => request("GET", path, { query }),
+    post: (path, body) => request("POST", path, { body }),
+    patch: (path, body) => request("PATCH", path, { body })
+  };
+}
+
+// src/output.ts
+import chalk from "chalk";
+function stringifyValue(v) {
+  if (v === null || v === void 0) return "";
+  if (Array.isArray(v)) return v.length ? `[${v.length} items]` : "(empty)";
+  if (typeof v === "object") return JSON.stringify(v);
+  return String(v);
+}
+function formatOutput(response, format) {
+  if (format === "json") {
+    return JSON.stringify(response, null, 2);
+  }
+  if (!response.ok) {
+    return chalk.red(`Error [${response.error?.code}]: ${response.error?.message}`);
+  }
+  if (format === "text") {
+    return typeof response.data === "string" ? response.data : JSON.stringify(response.data, null, 2);
+  }
+  const data = response.data;
+  if (Array.isArray(data)) {
+    return formatTable(data);
+  }
+  if (typeof data === "object" && data !== null) {
+    const obj = data;
+    const arrayKey = Object.keys(obj).find((k) => Array.isArray(obj[k]));
+    if (arrayKey) {
+      const arr = obj[arrayKey];
+      if (arr.length === 0) {
+        const footer2 = Object.entries(obj).filter(([k]) => k !== arrayKey).map(([k, v]) => `${k}: ${v}`).join("  ");
+        return footer2 ? `${chalk.dim("No results found.")}
+${chalk.dim(footer2)}` : chalk.dim("No results found.");
+      }
+      const tableOutput = formatTable(arr);
+      const footer = Object.entries(obj).filter(([k]) => k !== arrayKey).map(([k, v]) => `${k}: ${v}`).join("  ");
+      return footer ? `${tableOutput}
+${chalk.dim(footer)}` : tableOutput;
+    }
+    return formatKeyValue(obj);
+  }
+  return String(data);
+}
+function formatTable(rows) {
+  if (rows.length === 0) return chalk.dim("No results found.");
+  const keys = Object.keys(rows[0]);
+  const widths = keys.map(
+    (k) => Math.max(k.length, ...rows.map((r) => stringifyValue(r[k]).length))
+  );
+  const header = keys.map((k, i) => chalk.bold(k.padEnd(widths[i]))).join("  ");
+  const separator = widths.map((w) => "-".repeat(w)).join("  ");
+  const body = rows.map(
+    (row) => keys.map((k, i) => stringifyValue(row[k]).padEnd(widths[i])).join("  ")
+  ).join("\n");
+  return `${header}
+${separator}
+${body}`;
+}
+function formatKeyValue(obj) {
+  const keys = Object.keys(obj);
+  if (keys.length === 0) return chalk.dim("(empty)");
+  const maxKeyLen = Math.max(...keys.map((k) => k.length));
+  return Object.entries(obj).map(([k, v]) => `${chalk.bold(k.padEnd(maxKeyLen))}  ${stringifyValue(v)}`).join("\n");
+}
+function printResponse(response, format) {
+  console.log(formatOutput(response, format));
+  if (!response.ok) {
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/auth.ts
+import { ofetch as ofetch2 } from "ofetch";
+async function authLogin(options) {
+  const inquirer = await import("inquirer");
+  const apiKey = options.apiKey || (await inquirer.default.prompt([{
+    type: "password",
+    name: "apiKey",
+    message: "Enter your GroWrk API key:",
+    mask: "*"
+  }])).apiKey;
+  let apiUrl;
+  let environment;
+  if (options.apiUrl) {
+    validateApiUrl(options.apiUrl, { allowLocalhost: !!options.allowLocalhost });
+    apiUrl = options.apiUrl;
+  } else if (options.environment) {
+    environment = options.environment;
+    apiUrl = resolveEnvironment(options.environment, { allowLocalhost: !!options.allowLocalhost });
+  } else {
+    environment = "prod";
+    apiUrl = process.env.GROWRK_API_URL || "https://ai.growrk.com";
+  }
+  if (environment === "local") {
+    console.log(chalk2.yellow(`\u26A0 WARNING: Using local API at ${apiUrl}`));
+  }
+  console.log(chalk2.dim("Testing connection..."));
+  try {
+    const health = await ofetch2(`${apiUrl}/cli/health`);
+    if (!health.ok) throw new Error("Health check failed");
+  } catch {
+    console.log(chalk2.red("Failed to connect to GroWrk API. Check your API URL."));
+    process.exitCode = 1;
+    return;
+  }
+  let companyName = "Unknown";
+  try {
+    await ofetch2(`${apiUrl}/v4/me`, { headers: { "X-API-KEY": apiKey } });
+    companyName = "Verified";
+  } catch {
+  }
+  const accountName = options.name || (await inquirer.default.prompt([{
+    type: "input",
+    name: "name",
+    message: "Account name (for reference):",
+    default: "default"
+  }])).name;
+  const config2 = loadConfig();
+  config2.accounts[accountName] = { apiKey, apiUrl, companyName, environment };
+  const previous = config2.defaultAccount;
+  config2.defaultAccount = accountName;
+  saveConfig(config2);
+  console.log(chalk2.green(`
+Authenticated successfully as "${accountName}".`));
+  console.log(chalk2.dim("Config saved to ~/.growrk/config.yml"));
+  console.log(chalk2.bold("Active account:"), accountName, chalk2.dim(`(${environmentLabel({ apiUrl, environment })})`));
+  if (previous && previous !== accountName) {
+    console.log(chalk2.dim(`Switched from "${previous}". Run \`growrk auth login --name ${previous}\` to switch back.`));
+  }
+  console.log(chalk2.dim("\nTry: growrk orders list"));
+}
+async function authLogout(options) {
+  const name = options.name || loadConfig().defaultAccount;
+  if (!name) {
+    console.log(chalk2.yellow("No account configured."));
+    return;
+  }
+  if (removeAccount(name)) {
+    console.log(chalk2.green(`Removed account "${name}".`));
+  } else {
+    console.log(chalk2.yellow(`Account "${name}" not found.`));
+  }
+}
+async function authStatus(options) {
+  const account = getActiveAccount();
+  const config2 = loadConfig();
+  let ctx;
+  try {
+    ctx = resolveContext(options);
+  } catch (error) {
+    const hasKey = Boolean(options.apiKey || process.env.GROWRK_API_KEY || account);
+    console.log(chalk2.yellow(hasKey ? error.message : "Not authenticated. Run `growrk auth login`."));
+    return;
+  }
+  console.log(chalk2.bold("Active account:"), config2.defaultAccount || chalk2.dim("(none \u2014 using flags/env)"));
+  console.log(chalk2.bold("Environment:"), environmentLabel(ctx));
+  console.log(chalk2.bold("API URL:"), ctx.apiUrl);
+  console.log(chalk2.bold("API Key:"), ctx.apiKey.slice(0, 8) + "...");
+  console.log(chalk2.bold("Company:"), account?.companyName ?? "Unknown");
+  const resp = await createV4Client(ctx).get("/me");
+  if (resp.ok) {
+    console.log(chalk2.bold("\nIdentity (whoami):"));
+    printResponse(resp, ctx.format);
+  } else {
+    console.log(chalk2.dim(`
+whoami: ${resp.error?.message ?? "unavailable"} (this key may be a service/monitoring key, not a per-user key)`));
+  }
+}
+function registerAuthCommands(cli2) {
+  cli2.command("auth <subcommand>", "Authentication (login | logout | status)").allowUnknownOptions().option("--api-key <key>", "API key").option("--api-url <url>", "Link API URL").option("--environment <env>", "Target environment (prod, next, danielgdev, local)").option("--allow-localhost", "Allow local environment (http://localhost)").option("--name <name>", "Account name").action(async (subcommand, options) => {
+    switch (subcommand) {
+      case "login":
+        await authLogin(options);
+        break;
+      case "logout":
+        await authLogout(options);
+        break;
+      case "status":
+        await authStatus(options);
+        break;
+      default:
+        console.error(`Unknown auth subcommand: ${subcommand}`);
+        console.error("Available: login, logout, status");
+        process.exitCode = 1;
+    }
+  });
+}
+
+// ../../dist/runtime/mcp/order-types.js
+var VALIDATABLE_ORDER_TYPES = [
+  "Deployment",
+  "Offboarding",
+  "Collection",
+  "Collect for Maintenance",
+  "Maintenance",
+  "Swap from Inventory"
+];
+
+// ../../dist/runtime/mcp/schemas.js
+import { z } from "zod";
+var countryCode = z.string().regex(/^[A-Za-z]{2}$/, "Use an ISO 3166-1 alpha-2 code").transform((c) => c.toUpperCase());
+var getOrderInput = {
+  orderId: z.string().describe("The order ID to retrieve"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var listOrdersInput = {
+  query: z.string().optional().describe("Search query (employee email, product name, order ID, etc.)"),
+  status: z.array(z.string()).optional().describe('Filter by order status. Accepts one or more values (e.g. ["processing"], ["shipped", "delivered"]). Valid values: "order placed", "in progress", "processing", "shipped", "delivered", "on hold", "pending payment", "awaiting client", "awaiting recipient", "pending approval", "delayed", "closed", "cancelled"'),
+  type: z.array(z.string()).optional().describe('Filter by order type. Accepts one or more values (e.g. ["Offboarding"], ["Purchase for Employee", "Deployment"]). Valid values: "Purchase for Employee", "Deployment", "Offboarding", "Collection", "Maintenance" ("Assign to Employee" is the legacy name for "Deployment" and may appear on older orders)'),
+  page: z.number().int().min(0).default(0).describe("Page number for pagination (0-indexed)"),
+  limit: z.number().int().min(1).max(50).default(20).describe("Maximum number of results per page"),
+  sort: z.string().optional().describe('Field to sort by (e.g. "createdAt", "status", "type")'),
+  sortDirection: z.enum(["asc", "desc"]).optional().describe('Sort direction (default: "desc")'),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var validateOrderInput = {
+  orderType: z.enum(VALIDATABLE_ORDER_TYPES).describe("Order type to validate"),
+  employeeId: z.string().optional().describe("Employee whose devices the order acts on \u2014 required for every type except Maintenance (device-only)"),
+  productIds: z.array(z.string()).min(1).describe("Inventory product IDs. For Swap from Inventory: exactly one id \u2014 the device being replaced."),
+  replacementProductId: z.string().optional().describe("Swap from Inventory: the replacement device from company inventory"),
+  country: countryCode.optional().describe("Optional cross-check country (ISO 3166-1 alpha-2, case-insensitive). The order country always comes from the employee's stored delivery address; providing a different country here fails validation."),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var createOrderInput = {
+  orderType: z.enum(VALIDATABLE_ORDER_TYPES).describe("Order type to create"),
+  employeeId: z.string().optional().describe("Employee the order acts on \u2014 required for every type except Maintenance (device-only). The destination/collection country and address are taken from the employee's stored delivery address."),
+  productIds: z.array(z.string()).min(1).describe("Inventory product IDs to assign/collect/offboard/maintain. For Swap from Inventory: exactly one id \u2014 the device being replaced."),
+  notes: z.array(z.string()).optional().describe("Optional order notes"),
+  reason: z.string().optional().describe("Collection / Collect for Maintenance / Maintenance / Swap: manager reason for the request"),
+  replacementProductId: z.string().optional().describe("Swap from Inventory: the replacement device from company inventory (must be Ready to Use, unassigned, same region and product type as the old device)"),
+  shippingType: z.enum(["standard", "expedited", "overnight"]).optional().describe("Deployment / Swap from Inventory: shipping speed (default: standard)"),
+  neededBy: z.string().optional().describe("Deployment: desired arrival date (ISO 8601), stored as the order's desired time of arrival"),
+  includeCharger: z.boolean().optional().describe("Deployment / Swap from Inventory: purchase replacement chargers (per-country power-accessory fee applies). ONLY devices whose charger status is 'Damaged' or 'Not Included' are eligible \u2014 devices that already include a charger are skipped, and the result's `charger` field reports what was requested vs skipped"),
+  termination: z.enum(["voluntary", "involuntary"]).optional().describe("Offboarding: termination type (required for Offboarding)"),
+  dispositions: z.record(z.string(), z.enum(["keep", "clientRecover", "growrkRecover"])).optional().describe("Offboarding: per-productId device disposition (required for every product on Offboarding orders)"),
+  offboardingTime: z.string().optional().describe("Offboarding: optional scheduled offboarding time (ISO 8601)"),
+  scheduledTimeZone: z.string().optional().describe('Offboarding: human-readable timezone label that offboardingTime was given in (e.g. "America/Mexico_City")'),
+  legalHold: z.record(z.string(), z.object({ instructions: z.string().optional() })).optional().describe('Offboarding: per-productId legal hold request, with optional preservation instructions (e.g. {"prod1": {"instructions": "Preserve mailbox"}})'),
+  pickupWindow: z.object({
+    fromDate: z.string().describe("Pickup window start (ISO 8601)"),
+    toDate: z.string().describe("Pickup window end (ISO 8601)"),
+    instructions: z.string().optional().describe("Pickup instructions")
+  }).optional().describe("Offboarding: scheduled pickup window for device recovery"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getOrderHistoryInput = {
+  orderId: z.string().describe("The order ID to get the history for (parent order ID also works for compound orders)"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var addPowerAccessoryInput = {
+  orderId: z.string().describe("The order the device belongs to (parent order ID also works for compound orders)"),
+  productId: z.string().optional().describe("The inventory product (device) to request a replacement charger for. Provide this OR serialNumber."),
+  serialNumber: z.string().optional().describe("The device's serial number \u2014 resolved to the product automatically. Provide this OR productId."),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getEmployeeInput = {
+  employeeId: z.string().describe("The employee ID to retrieve"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var listEmployeesInput = {
+  query: z.string().optional().describe("Search query (name, email, department, etc.)"),
+  email: z.string().optional().describe("Exact email address match (case-insensitive). Unlike `query`, this is an equality filter, not a free-text search \u2014 use it to resolve one known employee."),
+  status: z.string().optional().describe('Filter by status (e.g. "Active", "Offboarded")'),
+  country: countryCode.optional().describe('Filter by country (ISO 3166-1 alpha-2, case-insensitive, e.g. "US", "BR", "MX")'),
+  page: z.number().int().min(0).default(0).describe("Page number for pagination (0-indexed)"),
+  limit: z.number().int().min(1).max(50).default(20).describe("Maximum number of results per page"),
+  sort: z.string().optional().describe('Field to sort by (e.g. "displayName", "createdAt", "startDate", "status")'),
+  sortDirection: z.enum(["asc", "desc"]).optional().describe('Sort direction (default: "asc")'),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var createEmployeeInput = {
+  displayName: z.string().min(1).describe("Employee full name"),
+  email: z.string().email().describe("Employee email address"),
+  companyId: z.string().optional().describe("Company ID"),
+  teamName: z.string().optional().describe("Team name the employee belongs to"),
+  department: z.string().optional().describe("Department the employee belongs to"),
+  division: z.string().optional().describe("Division the employee belongs to"),
+  jobTitle: z.string().optional().describe("Employee job title"),
+  personalEmail: z.string().email().optional().describe("Employee personal email address"),
+  taxId: z.string().optional().describe("Employee tax identification number"),
+  address: z.string().optional().describe("Street address"),
+  city: z.string().optional().describe("City"),
+  state: z.string().optional().describe("State or province"),
+  zipCode: z.string().optional().describe("ZIP or postal code"),
+  country: countryCode.optional().describe('Country (ISO 3166-1 alpha-2, case-insensitive, e.g. "US", "BR")')
+};
+var updateEmployeeInput = {
+  employeeId: z.string().describe("The employee ID to update"),
+  displayName: z.string().min(1).optional().describe("New employee full name"),
+  email: z.string().email().optional().describe("New employee email address (must be unique within the company). Only allowed for employees WITHOUT an active login."),
+  // Stored as the employee's `secondaryEmail` — the same field `create_employee`
+  // writes from its own `personalEmail`. Nullable because clearing it is a real
+  // operation (v2 `PATCH /employees/:id` accepted null or '' to unset).
+  personalEmail: z.union([z.string().email(), z.literal("")]).nullable().optional().describe('New personal / secondary email address (must be unique within the company). Pass null or "" to clear it.'),
+  department: z.string().optional().describe("New department"),
+  division: z.string().optional().describe("New division"),
+  jobTitle: z.string().optional().describe("New job title"),
+  taxId: z.string().optional().describe("New tax identification number (e.g. CPF \u2014 required for collections in Brazil)"),
+  teamName: z.string().optional().describe("Team name to move the employee to (created if it does not exist)"),
+  address: z.string().optional().describe("New street address (affects future orders only)"),
+  addressTwo: z.string().optional().describe("New address line two"),
+  city: z.string().optional().describe("New city"),
+  state: z.string().optional().describe("New state or province"),
+  zipCode: z.string().optional().describe("New ZIP or postal code"),
+  country: countryCode.optional().describe('New country (ISO 3166-1 alpha-2, case-insensitive, e.g. "US", "BR")'),
+  phone: z.string().optional().describe("New contact phone for deliveries"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getTrackingInput = {
+  orderId: z.string().optional().describe("Order ID to get tracking for (returns all shipments on the order)"),
+  trackingNumber: z.string().optional().describe("A specific tracking number to look up"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getOrderSlaInput = {
+  orderId: z.string().describe("The order ID to get SLA / delay status for"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var searchInventoryInput = {
+  query: z.string().optional().describe("Free-text search (model, serial, etc.)"),
+  category: z.string().optional().describe("Product type / category filter. Known values: Accessories, Adapters, Cables, Desktops, Headsets, Keyboards, Laptops, Mice, Mobile, Monitors, Network Gear A, Network Gear B, Power Protection, Tablet, VR Headsets, Webcams, Wifi"),
+  inStock: z.boolean().optional().describe("Only return available (in-stock) devices"),
+  country: countryCode.optional().describe('Filter by country (ISO 3166-1 alpha-2, case-insensitive, e.g. "US", "BR")'),
+  status: z.string().optional().describe("Filter by inventory status"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)"),
+  limit: z.number().int().min(1).max(50).default(20).describe("Maximum results")
+};
+var getAssignedDevicesInput = {
+  employeeId: z.string().describe("Employee ID to list assigned devices for"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getDeviceOptionsInput = {
+  productType: z.string().optional().describe("Desired product type / category. Known values: accessories, adapters, cables, desktops, headsets, keyboards, laptops, mice, mobile, monitors, network gear a, network gear b, power protection, tablet, vr headsets, webcams, wifi. Matched case- and plural-insensitively"),
+  location: z.string().optional().describe('Location to filter by (e.g. "GroWrk Warehouse", "Employee Address", "Client Location", "In transit")'),
+  specs: z.string().optional().describe('Free-text desired specs (e.g. "16GB 512GB M3")'),
+  companyId: z.string().optional().describe("Company ID (optional for staff)"),
+  limit: z.number().int().min(1).max(25).default(10).describe("Maximum options")
+};
+var suggestAlternativeInput = {
+  country: countryCode.describe('Destination country (ISO 3166-1 alpha-2, case-insensitive, e.g. "US") \u2014 catalog availability is per region'),
+  productType: z.string().optional().describe("Product type / category. Known values: accessories, adapters, cables, desktops, headsets, keyboards, laptops, mice, mobile, monitors, network gear a, network gear b, power protection, tablet, vr headsets, webcams, wifi. Matched case- and plural-insensitively; an unknown value returns an error listing the region's valid options"),
+  manufacturer: z.string().optional().describe(`Preferred manufacturer (e.g. "Apple", "Lenovo", "Dell") \u2014 matched against the catalog's manufacturers; an unknown value returns an error listing the valid options`),
+  specs: z.string().optional().describe('Free-text desired specs (e.g. "16GB 512GB M3")'),
+  targetPrice: z.number().positive().optional().describe("Rank alternatives by proximity to this price (USD)"),
+  excludeItemId: z.string().optional().describe("Catalog item ID to exclude (the device being replaced)"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)"),
+  limit: z.number().int().min(1).max(15).default(5).describe("Maximum suggestions")
+};
+var listTeamsInput = {
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getTeamInput = {
+  teamId: z.string().describe("The team ID to retrieve"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var createTeamInput = {
+  name: z.string().min(1).describe("Team name. Must be unique within the company \u2014 employee tools address teams by name, so a duplicate would make that lookup ambiguous."),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var updateTeamInput = {
+  teamId: z.string().describe("The team ID to update"),
+  name: z.string().min(1).describe("New team name. Must be unique within the company."),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var getProductInput = {
+  productId: z.string().describe("The inventory product ID to retrieve"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var addProductPinCodeInput = {
+  productId: z.string().optional().describe("The inventory product to set the PIN on. Provide this OR serialNumber."),
+  serialNumber: z.string().optional().describe("The device's serial number \u2014 resolved to the product automatically. Provide this OR productId."),
+  pinCode: z.string().min(1).describe("The device PIN code to store"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var listCompanyAddressesInput = {
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var createCompanyAddressInput = {
+  alias: z.string().min(1).describe('Short label for the location (e.g. "HQ", "Madrid office")'),
+  address: z.string().min(1).describe("Street address"),
+  addressTwo: z.string().optional().describe("Address line two"),
+  city: z.string().min(1).describe("City"),
+  state: z.string().optional().describe("State or province"),
+  zipCode: z.string().min(1).describe("ZIP or postal code"),
+  country: countryCode.describe('Country (ISO 3166-1 alpha-2, case-insensitive, e.g. "US", "ES"). Must be in the GroWrk regional catalog.'),
+  contactName: z.string().min(1).describe("Name of the on-site contact"),
+  contactEmail: z.string().email().describe("Email of the on-site contact"),
+  phone: z.string().min(1).describe("Contact phone number for deliveries and collections"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var listAvailableCountriesInput = {
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+var createPurchaseOrderInput = {
+  orderType: z.enum(["Purchase for Employee", "Purchase for Inventory"]).describe("Purchase for Employee ships to an employee's stored delivery address; Purchase for Inventory stocks the company pool."),
+  employeeId: z.string().optional().describe('Employee to purchase for \u2014 required for "Purchase for Employee", ignored otherwise.'),
+  items: z.array(z.object({
+    itemId: z.string().describe("GroWrk catalog item ID (items/{id}) \u2014 NOT the legacy v2 companyItem id"),
+    quantity: z.number().int().min(1).describe("How many of this item to purchase"),
+    country: countryCode.describe("Country the item ships from (ISO 3166-1 alpha-2). Quotes are per region, resolved from this country.")
+  })).min(1).describe("Catalog items to purchase"),
+  shippingType: z.enum(["standard", "expedited", "overnight"]).optional().describe("Shipping speed (default: standard)"),
+  notes: z.array(z.string()).optional().describe("Optional order notes"),
+  companyId: z.string().optional().describe("Company ID (optional for staff)")
+};
+
+// ../../dist/runtime/mcp/descriptors.js
+import { z as z2 } from "zod";
+var descriptors = {
+  whoami: {
+    name: "whoami",
+    group: "identity",
+    title: "Who Am I",
+    description: "Get information about the authenticated user and their access level.",
+    inputSchema: {}
+  },
+  get_order: {
+    name: "get_order",
+    group: "orders",
+    title: "Get Order",
+    description: "Retrieve a single order by ID with full hierarchy (parent + sub-orders, device requests, tracking). Staff may omit companyId \u2014 it is resolved from the order id. Requires mcp:orders:read scope.",
+    inputSchema: getOrderInput,
+    scope: "mcp:orders:read",
+    permission: { group: "orders", page: "ordersPage", value: 1 }
+    // VIEW
+  },
+  list_orders: {
+    name: "list_orders",
+    group: "orders",
+    title: "List Orders",
+    description: "Search and list orders for a company. Supports free-text search, status/type filtering, sorting, and pagination. Staff may omit companyId to search across all companies. Requires mcp:orders:read scope.",
+    inputSchema: listOrdersInput,
+    scope: "mcp:orders:read",
+    permission: { group: "orders", page: "ordersPage", value: 1 }
+    // VIEW
+  },
+  get_order_history: {
+    name: "get_order_history",
+    group: "orders",
+    title: "Get Order History",
+    description: "Get an order's full event history: order logs (status updates, comments) plus a per-device timeline merging product logs and courier tracking events. Works for compound (parent) orders \u2014 child-order devices are included and labeled. Staff may omit companyId \u2014 it is resolved from the order id. Requires mcp:orders:read scope.",
+    inputSchema: getOrderHistoryInput,
+    scope: "mcp:orders:read",
+    permission: { group: "orders", page: "ordersPage", value: 1 }
+    // VIEW
+  },
+  validate_order_constraints: {
+    name: "validate_order_constraints",
+    group: "orders",
+    title: "Validate Order Constraints",
+    description: "Check whether an order type (Deployment, Offboarding, Collection, Collect for Maintenance, Maintenance, Swap from Inventory) can be placed for an employee and their devices \u2014 validates region availability, delivery address, and device eligibility (Deployment also requires the device to be stocked in the employee's region). The order country is derived from the employee's stored delivery address (same as create_order). Read-only; run this before create_order. Requires mcp:orders:read scope.",
+    inputSchema: validateOrderInput,
+    scope: "mcp:orders:read",
+    permission: { group: "orders", page: "ordersPage", value: 1 }
+    // VIEW
+  },
+  create_order: {
+    name: "create_order",
+    group: "orders",
+    title: "Create Order",
+    description: "Place an order (Deployment, Offboarding, Collection, Collect for Maintenance, device-only Maintenance, or Swap from Inventory) for a company's devices. Validates constraints first and refuses to place if invalid (call validate_order_constraints to preview). The destination/collection address is the employee's stored delivery address. Requires mcp:orders:write scope and explicit approval.",
+    inputSchema: createOrderInput,
+    scope: "mcp:orders:write",
+    // the dashboard gates order placement on `teams.makeRequest` CREATE (HomeActions.vue, EmployeeProfileProductOptions.vue) — NOT `orders.orders`.
+    permission: { group: "teams", page: "makeRequest", value: 2 },
+    // CREATE
+    write: true
+  },
+  add_power_accessory: {
+    name: "add_power_accessory",
+    group: "orders",
+    title: "Add Power Accessory",
+    description: "Request a replacement charger (power accessory) for a device on an EXISTING order \u2014 same flow as the hub dashboard. Only allowed within 24 hours of placing the order, while the order is still 'order placed', and for devices whose charger status is 'Damaged' or 'Not Included'. The per-country power-accessory fee is added to the order cost. Requires mcp:orders:write scope and explicit approval.",
+    inputSchema: addPowerAccessoryInput,
+    scope: "mcp:orders:write",
+    // amending a placed order.
+    permission: { group: "orders", page: "orders", value: 4 },
+    // EDIT
+    write: true
+  },
+  get_employee: {
+    name: "get_employee",
+    group: "employees",
+    title: "Get Employee",
+    description: "Retrieve a single employee by ID, including their stored delivery address (deliveryAddress \u2014 null when none is set; set it with update_employee). Requires mcp:employees:read scope.",
+    inputSchema: getEmployeeInput,
+    scope: "mcp:employees:read",
+    permission: { group: "teams", page: "employees", value: 1 }
+    // VIEW
+  },
+  list_employees: {
+    name: "list_employees",
+    group: "employees",
+    title: "List Employees",
+    description: "Search and list employees for a company. Supports free-text search, status filtering, sorting, and pagination. Requires mcp:employees:read scope.",
+    inputSchema: listEmployeesInput,
+    scope: "mcp:employees:read",
+    permission: { group: "teams", page: "employees", value: 1 }
+    // VIEW
+  },
+  create_employee: {
+    name: "create_employee",
+    group: "employees",
+    title: "Create Employee",
+    description: "Create a new employee record. Requires name and email. Requires mcp:employees:write scope.",
+    inputSchema: createEmployeeInput,
+    scope: "mcp:employees:write",
+    permission: { group: "teams", page: "employees", value: 2 },
+    // CREATE
+    write: true
+  },
+  update_employee: {
+    name: "update_employee",
+    group: "employees",
+    title: "Update Employee",
+    description: "Update an existing employee's editable fields (name, email, department, division, job title, team, delivery address). Email changes are checked for uniqueness; address changes affect future orders only. Requires mcp:employees:write scope.",
+    inputSchema: updateEmployeeInput,
+    scope: "mcp:employees:write",
+    permission: { group: "teams", page: "employees", value: 4 },
+    // EDIT
+    write: true
+  },
+  get_tracking: {
+    name: "get_tracking",
+    group: "tracking",
+    title: "Get Tracking",
+    description: "Get shipment tracking for an order, merging GroWrk records with live TrackingMore courier data. Works for compound (parent) orders too \u2014 child-order shipments are included and labeled. Provide orderId (optionally with trackingNumber to filter to one shipment). Bare trackingNumber lookups are staff-only. Requires mcp:orders:read scope.",
+    inputSchema: getTrackingInput,
+    scope: "mcp:orders:read",
+    permission: { group: "orders", page: "ordersPage", value: 1 }
+    // VIEW
+  },
+  get_order_sla: {
+    name: "get_order_sla",
+    group: "orders",
+    title: "Get Order SLA",
+    description: "Get the SLA / delay status for a single order: days elapsed vs the expected SLA days for its order type, whether it is delayed and by how much, the specific reasons for any delay (paused-SLA periods, blocking device statuses), and recent activity. Staff may omit companyId \u2014 it is resolved from the order id. Requires mcp:orders:read scope.",
+    inputSchema: getOrderSlaInput,
+    scope: "mcp:orders:read",
+    permission: { group: "orders", page: "ordersPage", value: 1 }
+    // VIEW
+  },
+  search_inventory: {
+    name: "search_inventory",
+    group: "inventory",
+    title: "Search Inventory",
+    description: "Search a company's device inventory with optional filters (category, country, status, in-stock). Requires mcp:inventory:read scope.",
+    inputSchema: searchInventoryInput,
+    scope: "mcp:inventory:read",
+    permission: { group: "inventory", page: "inventoryManagementPage", value: 1 }
+    // VIEW
+  },
+  get_assigned_devices: {
+    name: "get_assigned_devices",
+    group: "inventory",
+    title: "Get Assigned Devices",
+    description: "List the devices currently assigned to an employee. Requires mcp:inventory:read scope.",
+    inputSchema: getAssignedDevicesInput,
+    scope: "mcp:inventory:read",
+    // reading an employee's devices is the read side of the `teams.employeeProducts` gate the assign flow uses (TeamsEmployeeAppData.vue).
+    permission: { group: "teams", page: "employeeProducts", value: 1 }
+    // VIEW
+  },
+  get_device_options: {
+    name: "get_device_options",
+    group: "inventory",
+    title: "Get Device Options",
+    description: "List available device options (anonymized model + availability), ranked by spec proximity and availability \u2014 use this both for initial device choices and for suggesting alternatives. Requires mcp:inventory:read scope.",
+    inputSchema: getDeviceOptionsInput,
+    scope: "mcp:inventory:read",
+    permission: { group: "inventory", page: "inventoryManagementPage", value: 1 }
+    // VIEW
+  },
+  suggest_alternative_device: {
+    name: "suggest_alternative_device",
+    group: "inventory",
+    title: "Suggest Alternative Device",
+    description: "Suggest alternative PURCHASABLE devices from the GroWrk master catalog for a destination country, ranked by manufacturer/spec/price proximity. Use when a desired device is unavailable and a purchase is being considered (vs get_device_options, which lists existing warehouse stock for redeployment). Requires mcp:inventory:read scope.",
+    inputSchema: suggestAlternativeInput,
+    scope: "mcp:inventory:read",
+    permission: { group: "inventory", page: "inventoryManagementPage", value: 1 }
+    // VIEW
+  },
+  list_teams: {
+    name: "list_teams",
+    group: "teams",
+    title: "List Teams",
+    description: "List the company's teams. Managers see only the teams their role scopes them to. Requires mcp:teams:read scope.",
+    inputSchema: listTeamsInput,
+    scope: "mcp:teams:read",
+    permission: { group: "teams", page: "teamsPage", value: 1 }
+    // VIEW
+  },
+  get_team: {
+    name: "get_team",
+    group: "teams",
+    title: "Get Team",
+    description: "Get a single team by ID, including its employee count. Requires mcp:teams:read scope.",
+    inputSchema: getTeamInput,
+    scope: "mcp:teams:read",
+    permission: { group: "teams", page: "teamsPage", value: 1 }
+    // VIEW
+  },
+  create_team: {
+    name: "create_team",
+    group: "teams",
+    title: "Create Team",
+    description: "Create a new team in the company. The name must be unique within the company, because the employee tools resolve teams by name. Requires mcp:teams:write scope.",
+    inputSchema: createTeamInput,
+    scope: "mcp:teams:write",
+    permission: { group: "teams", page: "teams", value: 2 },
+    // CREATE
+    write: true
+  },
+  update_team: {
+    name: "update_team",
+    group: "teams",
+    title: "Update Team",
+    description: "Rename an existing team. The new name must be unique within the company. Requires mcp:teams:write scope.",
+    inputSchema: updateTeamInput,
+    scope: "mcp:teams:write",
+    permission: { group: "teams", page: "teams", value: 4 },
+    // EDIT
+    write: true
+  },
+  get_product: {
+    name: "get_product",
+    group: "products",
+    title: "Get Product",
+    description: "Get a single inventory product (device) by ID, including its assignment, condition, location and serial number. Employees may only read their own devices. Requires mcp:inventory:read scope.",
+    inputSchema: getProductInput,
+    scope: "mcp:inventory:read",
+    permission: { group: "inventory", page: "inventoryManagementPage", value: 1 }
+    // VIEW
+  },
+  add_product_pin_code: {
+    name: "add_product_pin_code",
+    group: "products",
+    title: "Add Product PIN Code",
+    description: "Store the unlock PIN code for a device, identified by productId or serialNumber. Only available for device types that support a PIN (Desktops, Laptops, Mobile, Tablet). Requires mcp:inventory:write scope.",
+    inputSchema: addProductPinCodeInput,
+    scope: "mcp:inventory:write",
+    // ModalDevicePin.vue gates the PIN action on `orders.orders` EDIT.
+    permission: { group: "orders", page: "orders", value: 4 },
+    // EDIT
+    write: true
+  },
+  list_company_addresses: {
+    name: "list_company_addresses",
+    group: "company",
+    title: "List Company Addresses",
+    description: "List the company's saved office / warehouse addresses \u2014 the locations devices can be shipped to or collected from. Requires mcp:company:read scope.",
+    inputSchema: listCompanyAddressesInput,
+    scope: "mcp:company:read",
+    permission: { group: "offices", page: "officesPage", value: 1 }
+    // VIEW
+  },
+  create_company_address: {
+    name: "create_company_address",
+    group: "company",
+    title: "Create Company Address",
+    description: "Save a new office / warehouse address for the company. The country must exist in the GroWrk regional catalog. Requires mcp:company:write scope.",
+    inputSchema: createCompanyAddressInput,
+    scope: "mcp:company:write",
+    // `offices` exposes only `officesPage`, so the CREATE bit on that key is the closest faithful expression of "may add an office".
+    permission: { group: "offices", page: "officesPage", value: 2 },
+    // CREATE
+    write: true
+  },
+  list_available_countries: {
+    name: "list_available_countries",
+    group: "employees",
+    title: "List Available Countries",
+    description: "List the countries the company already has employees in, derived from stored employee delivery addresses. Returns each region as { value, label }. Requires mcp:employees:read scope.",
+    inputSchema: listAvailableCountriesInput,
+    scope: "mcp:employees:read",
+    permission: { group: "teams", page: "employees", value: 1 }
+    // VIEW
+  },
+  create_purchase_order: {
+    name: "create_purchase_order",
+    group: "orders",
+    title: "Create Purchase Order",
+    description: "Purchase devices from the GroWrk catalog, either for an employee (shipped to their stored delivery address) or into the company inventory pool. Items are priced from their selected regional quote; configure/build-to-order devices cannot be purchased this way. Requires mcp:orders:write scope and explicit approval.",
+    inputSchema: createPurchaseOrderInput,
+    scope: "mcp:orders:write",
+    // buying from the catalog is the `inventory.purchaseProduct` CREATE gate (HomeInventoryPool.vue).
+    permission: { group: "inventory", page: "purchaseProduct", value: 2 },
+    // CREATE
+    write: true
+  }
+};
+var allToolDescriptors = Object.assign(/* @__PURE__ */ Object.create(null), descriptors);
+var toolInputJsonSchemas = Object.fromEntries(
+  Object.values(allToolDescriptors).map((d) => [d.name, z2.toJSONSchema(z2.object(d.inputSchema), { io: "input" })])
+);
+
+// src/tools/render.ts
+var camelToKebab = (s) => s.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
+function parseJsonObjectArg(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    throw new Error("must be a JSON object");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("must be a JSON object");
+  }
+  return parsed;
+}
+function classify(prop) {
+  if (prop.enum) return "enum";
+  const t = Array.isArray(prop.type) ? prop.type.find((x) => x !== "null") : prop.type;
+  if (t === "string") return "string";
+  if (t === "number" || t === "integer") return "number";
+  if (t === "boolean") return "boolean";
+  if (t === "array") {
+    const item = prop.items?.type;
+    if (item === "number" || item === "integer") return "number-array";
+    if (item === "string") return "array";
+    return "json";
+  }
+  return "json";
+}
+function toolFlags(schema) {
+  const props = schema.properties ?? {};
+  const flags = [];
+  const jsonOnly = [];
+  for (const [name, prop] of Object.entries(props)) {
+    const kind = classify(prop);
+    if (kind === "json") {
+      jsonOnly.push(name);
+      continue;
+    }
+    const kebab = camelToKebab(name);
+    const flag = kind === "boolean" ? `--${kebab}` : kind === "array" || kind === "number-array" ? `--${kebab} <comma,separated>` : `--${kebab} <value>`;
+    flags.push({ name, flag, description: prop.description ?? "", kind });
+  }
+  return { flags, jsonOnly };
+}
+function buildArgs(schema, options) {
+  const { flags } = toolFlags(schema);
+  const args = {};
+  for (const f of flags) {
+    const raw = options[f.name];
+    if (raw === void 0 || raw === null) continue;
+    if (f.kind === "number") args[f.name] = Number(raw);
+    else if (f.kind === "boolean") args[f.name] = Boolean(raw);
+    else if (f.kind === "array") args[f.name] = String(raw).split(",").map((s) => s.trim()).filter(Boolean);
+    else if (f.kind === "number-array") args[f.name] = String(raw).split(",").map((s) => s.trim()).filter(Boolean).map(Number);
+    else if (f.kind === "string" || f.kind === "enum") args[f.name] = String(raw);
+    else args[f.name] = raw;
+  }
+  if (typeof options.json === "string" && options.json.trim()) {
+    Object.assign(args, parseJsonObjectArg(options.json));
+  }
+  return args;
+}
+
+// src/v4/manifest.ts
+var MANIFEST = {
+  orders: [
+    { tool: "list_orders", action: "list", method: "GET", path: "/orders" },
+    { tool: "get_order", action: "get", method: "GET", path: "/orders/:id", pathParam: "orderId" },
+    { tool: "create_order", action: "create", method: "POST", path: "/orders" },
+    { tool: "get_order_history", action: "history", method: "GET", path: "/orders/:id/history", pathParam: "orderId" },
+    { tool: "get_tracking", action: "tracking", method: "GET", path: "/orders/:id/tracking", pathParam: "orderId" },
+    { tool: "validate_order_constraints", action: "validate", method: "POST", path: "/orders/validate" },
+    { tool: "add_power_accessory", action: "add-accessory", method: "POST", path: "/orders/:id/accessories", pathParam: "orderId" },
+    { tool: "get_order_sla", action: "sla", method: "GET", path: "/orders/:id/sla", pathParam: "orderId" },
+    { tool: "create_purchase_order", action: "purchase", method: "POST", path: "/orders/purchase" }
+  ],
+  employees: [
+    { tool: "list_employees", action: "list", method: "GET", path: "/employees" },
+    { tool: "get_employee", action: "get", method: "GET", path: "/employees/:id", pathParam: "employeeId" },
+    { tool: "create_employee", action: "create", method: "POST", path: "/employees" },
+    { tool: "update_employee", action: "update", method: "PATCH", path: "/employees/:id", pathParam: "employeeId" },
+    { tool: "get_assigned_devices", action: "devices", method: "GET", path: "/employees/:id/devices", pathParam: "employeeId" },
+    { tool: "list_available_countries", action: "countries", method: "GET", path: "/employees/countries" }
+  ],
+  teams: [
+    { tool: "list_teams", action: "list", method: "GET", path: "/teams" },
+    { tool: "get_team", action: "get", method: "GET", path: "/teams/:id", pathParam: "teamId" },
+    { tool: "create_team", action: "create", method: "POST", path: "/teams" },
+    { tool: "update_team", action: "update", method: "PATCH", path: "/teams/:id", pathParam: "teamId" }
+  ],
+  products: [
+    { tool: "get_product", action: "get", method: "GET", path: "/products/:id", pathParam: "productId" },
+    { tool: "add_product_pin_code", action: "add-pin", method: "POST", path: "/products/pin-code" }
+  ],
+  company: [
+    { tool: "list_company_addresses", action: "addresses", method: "GET", path: "/company/addresses" },
+    { tool: "create_company_address", action: "add-address", method: "POST", path: "/company/addresses" }
+  ],
+  inventory: [
+    { tool: "search_inventory", action: "search", method: "GET", path: "/inventory" }
+  ],
+  devices: [
+    { tool: "get_device_options", action: "options", method: "GET", path: "/devices/options" },
+    { tool: "suggest_alternative_device", action: "suggestions", method: "GET", path: "/devices/suggestions" }
+  ]
+};
+
+// src/v4/resources.ts
+var COMMON_OPTIONS = [
+  ["--json <json>", "Extra arguments as a JSON object (merged over flags; for complex fields)"],
+  ["--format <format>", "Output format (json | table | text)"],
+  ["--api-key <key>", "API key (overrides config)"],
+  ["--api-url <url>", "API URL (overrides config)"],
+  ["--environment <env>", "Target environment (prod, next, danielgdev, local)"],
+  ["--allow-localhost", "Allow local environment (http://localhost)"]
+];
+var nowMeta = () => ({ correlationId: "", timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: "v4" });
+var schemaFor = (tool) => toolInputJsonSchemas[tool] ?? {};
+async function callResource(entry, args, options) {
+  let ctx;
+  try {
+    ctx = resolveContext(options);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    printResponse({ ok: false, error: { code: "CONFIG_ERROR", message }, meta: nowMeta() }, "text");
+    return;
+  }
+  const input = buildArgs(schemaFor(entry.tool), options);
+  let path = entry.path;
+  if (entry.pathParam) {
+    const id = args[0];
+    if (!id) {
+      printResponse({ ok: false, error: { code: "VALIDATION_ERROR", message: `Missing required <id> for "${entry.action}"` }, meta: nowMeta() }, ctx.format);
+      return;
+    }
+    path = path.replace(":id", encodeURIComponent(id));
+    Reflect.deleteProperty(input, entry.pathParam);
+  }
+  const client = createV4Client(ctx);
+  const resp = entry.method === "GET" ? await client.get(path, input) : entry.method === "PATCH" ? await client.patch(path, input) : await client.post(path, input);
+  printResponse(resp, ctx.format);
+}
+function registerResourceCommands(cli2) {
+  for (const [resource, entries] of Object.entries(MANIFEST)) {
+    const actions = entries.map((e) => e.action).join(" | ");
+    const cmd = cli2.command(`${resource} <action> [...args]`, `Manage ${resource} (${actions})`).allowUnknownOptions();
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of entries) {
+      for (const f of toolFlags(schemaFor(entry.tool)).flags) {
+        if (f.name === entry.pathParam || seen.has(f.name)) continue;
+        seen.add(f.name);
+        cmd.option(f.flag, f.description);
+      }
+    }
+    for (const [flag, desc] of COMMON_OPTIONS) cmd.option(flag, desc);
+    cmd.action(async (action, args, options) => {
+      const entry = entries.find((e) => e.action === action);
+      if (!entry) {
+        console.error(`Unknown ${resource} action: ${action}. Available: ${actions}`);
+        process.exitCode = 1;
+        return;
+      }
+      await callResource(entry, args, options);
+    });
+  }
+  const me = cli2.command("me", "Show your identity + access (whoami)").allowUnknownOptions();
+  for (const [flag, desc] of COMMON_OPTIONS) me.option(flag, desc);
+  me.action(async (options) => {
+    let ctx;
+    try {
+      ctx = resolveContext(options);
+    } catch (e) {
+      printResponse({ ok: false, error: { code: "CONFIG_ERROR", message: e instanceof Error ? e.message : String(e) }, meta: nowMeta() }, "text");
+      return;
+    }
+    printResponse(await createV4Client(ctx).get("/me"), ctx.format);
+  });
+}
+
+// src/http.ts
+import { ofetch as ofetch3 } from "ofetch";
+import { randomUUID as randomUUID2 } from "crypto";
+function createClient(ctx, base = "/cli") {
+  const baseURL = `${ctx.apiUrl}${base}`;
+  const request = async (path, options = {}) => {
+    const correlationId = randomUUID2();
+    try {
+      return await ofetch3(path, {
+        baseURL,
+        method: options.method,
+        query: options.query,
+        body: options.body,
+        headers: {
+          "X-API-KEY": ctx.apiKey,
+          "X-Correlation-Id": correlationId
+        }
+      });
+    } catch (e) {
+      const err = e;
+      if (err.data && typeof err.data === "object" && "ok" in err.data) {
+        return err.data;
+      }
+      if (err.data && typeof err.data === "object" && (err.data.statusCode || err.data.error === true)) {
+        const status = err.response?.status ?? err.data.statusCode;
+        return {
+          ok: false,
+          error: {
+            code: status === 401 ? "UNAUTHORIZED" : status === 403 ? "FORBIDDEN" : "API_ERROR",
+            message: err.data.message || err.data.statusMessage || "API error"
+          },
+          meta: { correlationId, timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: "v1" }
+        };
+      }
+      const message = e instanceof Error ? e.message : "Failed to connect to GroWrk API";
+      return {
+        ok: false,
+        error: {
+          code: "NETWORK_ERROR",
+          message
+        },
+        meta: { correlationId, timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: "v1" }
+      };
+    }
+  };
+  return {
+    get: (path, query) => request(path, { method: "GET", query }),
+    patch: (path, body) => request(path, { method: "PATCH", body }),
+    post: (path, body) => request(path, { method: "POST", body })
+  };
+}
+function resolveOrFail(options) {
+  try {
+    return resolveContext(options);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    printResponse({ ok: false, error: { code: "CONFIG_ERROR", message }, meta: { correlationId: "", timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: "v1" } }, "text");
+    return null;
+  }
+}
+async function executeGet(options, path, query) {
+  const ctx = resolveOrFail(options);
+  if (!ctx) return;
+  const client = createClient(ctx);
+  const resp = await client.get(path, query);
+  printResponse(resp, ctx.format);
+}
+async function executePatch(options, path, body) {
+  const ctx = resolveOrFail(options);
+  if (!ctx) return;
+  const client = createClient(ctx);
+  const resp = await client.patch(path, body);
+  printResponse(resp, ctx.format);
+}
+
+// src/commands/orders.ts
+async function runStaffOrders(subcommand, args, options) {
+  switch (subcommand) {
+    case "get": {
+      const id = args[0];
+      if (!id) {
+        console.error("Usage: growrk staff orders get <id>");
+        process.exitCode = 1;
+        return;
+      }
+      const query = {};
+      if (options.include) query.include = options.include;
+      if (options.companyId) query.companyId = options.companyId;
+      await executeGet(options, `/orders/${id}`, query);
+      break;
+    }
+    case "search": {
+      const query = {};
+      if (options.status) query.status = options.status.split(",").map((s) => s.trim());
+      if (options.type) query.type = options.type.split(",").map((s) => s.trim());
+      if (options.region) query.region = options.region;
+      if (options.search) query.q = options.search;
+      if (options.sort) query.sort = options.sort;
+      if (options.sortDirection) query.sortDirection = options.sortDirection;
+      if (options.include) query.include = options.include;
+      if (options.companyId) query.companyId = options.companyId;
+      if (options.logStatus) query.logStatus = options.logStatus;
+      if (options.logLimit) query.logLimit = Number(options.logLimit);
+      if (options.logCommentsOnly) query.logCommentsOnly = true;
+      if (options.logAuthorRole) query.logAuthorRole = options.logAuthorRole;
+      query.page = options.page || 0;
+      query.pageSize = options.pageSize || 25;
+      await executeGet(options, "/orders", query);
+      break;
+    }
+    case "by-employee": {
+      const query = {};
+      if (options.search) query.q = options.search;
+      if (options.name) query.name = options.name;
+      if (options.email) query.email = options.email;
+      if (options.include) query.include = options.include;
+      if (options.companyId) query.companyId = options.companyId;
+      query.page = options.page || 0;
+      query.pageSize = options.pageSize || 50;
+      await executeGet(options, "/orders/by-employee", query);
+      break;
+    }
+    case "history": {
+      const id = args[0];
+      if (!id) {
+        console.error("Usage: growrk staff orders history <id>");
+        process.exitCode = 1;
+        return;
+      }
+      await executeGet(options, `/orders/${id}/history`);
+      break;
+    }
+    case "dri-edit": {
+      const id = args[0];
+      if (!id) {
+        console.error("Usage: growrk staff orders dri-edit <id> --dri-email <email>");
+        process.exitCode = 1;
+        return;
+      }
+      if (!options.driEmail) {
+        console.error("--dri-email is required. Usage: growrk staff orders dri-edit <id> --dri-email user@growrk.com");
+        process.exitCode = 1;
+        return;
+      }
+      await executePatch(options, `/orders/${id}/dri`, { email: options.driEmail });
+      break;
+    }
+    default:
+      console.error(`Unknown "staff orders" subcommand: ${subcommand}`);
+      console.error("Available: get, search, by-employee, history, dri-edit");
+      process.exitCode = 1;
+  }
+}
+
+// src/commands/tracking.ts
+async function runStaffTracking(subcommand, args, options) {
+  switch (subcommand) {
+    case "get": {
+      const orderId = args[0];
+      if (!orderId) {
+        console.error("Usage: growrk staff tracking get <orderId>");
+        process.exitCode = 1;
+        return;
+      }
+      await executeGet(options, `/tracking/${orderId}`);
+      break;
+    }
+    case "live": {
+      const trackingNumber = args[0];
+      if (!trackingNumber) {
+        console.error("Usage: growrk staff tracking live <trackingNumber>");
+        process.exitCode = 1;
+        return;
+      }
+      await executeGet(options, `/tracking/live/${trackingNumber}`);
+      break;
+    }
+    default:
+      console.error(`Unknown "staff tracking" subcommand: ${subcommand}`);
+      console.error("Available: get, live");
+      process.exitCode = 1;
+  }
+}
+
+// src/commands/sla.ts
+async function runStaffSla(subcommand, args, options) {
+  switch (subcommand) {
+    case "delay": {
+      const orderId = args[0];
+      if (!orderId) {
+        console.error("Usage: growrk staff sla delay <orderId>");
+        process.exitCode = 1;
+        return;
+      }
+      await executeGet(options, `/sla/${orderId}/delay`);
+      break;
+    }
+    case "global":
+      if (!options.type) {
+        console.error("Usage: growrk staff sla global --type <orderType>");
+        process.exitCode = 1;
+        return;
+      }
+      await executeGet(options, "/sla/global", { type: options.type });
+      break;
+    default:
+      console.error(`Unknown "staff sla" subcommand: ${subcommand}`);
+      console.error("Available: delay, global");
+      process.exitCode = 1;
+  }
+}
+
+// src/commands/dri.ts
+async function runStaffDri(subcommand, _args, options) {
+  switch (subcommand) {
+    case "list":
+      await executeGet(options, "/dri");
+      break;
+    default:
+      console.error(`Unknown "staff dri" subcommand: ${subcommand}`);
+      console.error("Available: list");
+      process.exitCode = 1;
+  }
+}
+
+// src/commands/staff-tasks.ts
+import { readFile } from "fs/promises";
+function makeErrorResponse(code, message) {
+  return {
+    ok: false,
+    error: { code, message },
+    meta: { correlationId: "", timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: "v1" }
+  };
+}
+async function runStaffTasks(subcommand, options) {
+  switch (subcommand) {
+    case "create-dri-reviews":
+      await createDriReviews(options);
+      break;
+    case "create-supplier-reviews":
+      await createSupplierReviews(options);
+      break;
+    case "create-rfd-reviews":
+      await createRfdReviews(options);
+      break;
+    case "create-address-reviews":
+      await createAddressReviews(options);
+      break;
+    default:
+      console.error(`Unknown "staff tasks" subcommand: ${subcommand}`);
+      console.error("Available: create-dri-reviews, create-supplier-reviews, create-rfd-reviews, create-address-reviews");
+      process.exitCode = 1;
+  }
+}
+async function createDriReviews(options) {
+  let ctx;
+  try {
+    ctx = resolveContext(options);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    printResponse(makeErrorResponse("CONFIG_ERROR", message), "text");
+    return;
+  }
+  let results = [];
+  if (options.file) {
+    let raw;
+    try {
+      raw = await readFile(options.file, "utf-8");
+    } catch (e) {
+      const message = e instanceof Error ? e.message : `Cannot read file: ${options.file}`;
+      printResponse(makeErrorResponse("CONFIG_ERROR", message), ctx.format);
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", `Invalid JSON in file: ${options.file}`), ctx.format);
+      return;
+    }
+  } else if (options.data) {
+    try {
+      const parsed = JSON.parse(options.data);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", "Invalid JSON in --data option"), ctx.format);
+      return;
+    }
+  } else {
+    printResponse(
+      makeErrorResponse("VALIDATION_ERROR", "Provide results via --file <path> or --data <json>"),
+      ctx.format
+    );
+    return;
+  }
+  const client = createClient(ctx);
+  const resp = await client.post("/staff-tasks/dri-reviews", {
+    results,
+    dryRun: options.dryRun ?? false
+  });
+  printResponse(resp, ctx.format);
+}
+async function createSupplierReviews(options) {
+  let ctx;
+  try {
+    ctx = resolveContext(options);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    printResponse(makeErrorResponse("CONFIG_ERROR", message), "text");
+    return;
+  }
+  let results = [];
+  if (options.file) {
+    let raw;
+    try {
+      raw = await readFile(options.file, "utf-8");
+    } catch (e) {
+      const message = e instanceof Error ? e.message : `Cannot read file: ${options.file}`;
+      printResponse(makeErrorResponse("CONFIG_ERROR", message), ctx.format);
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", `Invalid JSON in file: ${options.file}`), ctx.format);
+      return;
+    }
+  } else if (options.data) {
+    try {
+      const parsed = JSON.parse(options.data);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", "Invalid JSON in --data option"), ctx.format);
+      return;
+    }
+  } else {
+    printResponse(
+      makeErrorResponse("VALIDATION_ERROR", "Provide results via --file <path> or --data <json>"),
+      ctx.format
+    );
+    return;
+  }
+  const client = createClient(ctx);
+  const resp = await client.post("/staff-tasks/supplier-reviews", {
+    results,
+    dryRun: options.dryRun ?? false
+  });
+  printResponse(resp, ctx.format);
+}
+async function createRfdReviews(options) {
+  let ctx;
+  try {
+    ctx = resolveContext(options);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    printResponse(makeErrorResponse("CONFIG_ERROR", message), "text");
+    return;
+  }
+  let results = [];
+  if (options.file) {
+    let raw;
+    try {
+      raw = await readFile(options.file, "utf-8");
+    } catch (e) {
+      const message = e instanceof Error ? e.message : `Cannot read file: ${options.file}`;
+      printResponse(makeErrorResponse("CONFIG_ERROR", message), ctx.format);
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", `Invalid JSON in file: ${options.file}`), ctx.format);
+      return;
+    }
+  } else if (options.data) {
+    try {
+      const parsed = JSON.parse(options.data);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", "Invalid JSON in --data option"), ctx.format);
+      return;
+    }
+  } else {
+    printResponse(
+      makeErrorResponse("VALIDATION_ERROR", "Provide results via --file <path> or --data <json>"),
+      ctx.format
+    );
+    return;
+  }
+  const client = createClient(ctx);
+  const resp = await client.post("/staff-tasks/rfd-reviews", {
+    results,
+    dryRun: options.dryRun ?? false
+  });
+  printResponse(resp, ctx.format);
+}
+async function createAddressReviews(options) {
+  let ctx;
+  try {
+    ctx = resolveContext(options);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    printResponse(makeErrorResponse("CONFIG_ERROR", message), "text");
+    return;
+  }
+  let results = [];
+  if (options.file) {
+    let raw;
+    try {
+      raw = await readFile(options.file, "utf-8");
+    } catch (e) {
+      const message = e instanceof Error ? e.message : `Cannot read file: ${options.file}`;
+      printResponse(makeErrorResponse("CONFIG_ERROR", message), ctx.format);
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", `Invalid JSON in file: ${options.file}`), ctx.format);
+      return;
+    }
+  } else if (options.data) {
+    try {
+      const parsed = JSON.parse(options.data);
+      results = Array.isArray(parsed) ? parsed : parsed?.results ?? [];
+    } catch {
+      printResponse(makeErrorResponse("VALIDATION_ERROR", "Invalid JSON in --data option"), ctx.format);
+      return;
+    }
+  } else {
+    printResponse(
+      makeErrorResponse("VALIDATION_ERROR", "Provide results via --file <path> or --data <json>"),
+      ctx.format
+    );
+    return;
+  }
+  const client = createClient(ctx);
+  const resp = await client.post("/staff-tasks/address-reviews", {
+    results,
+    dryRun: options.dryRun ?? false
+  });
+  printResponse(resp, ctx.format);
+}
+
+// src/commands/staff.ts
+function registerStaffCommands(cli2) {
+  cli2.command("staff <group> <subcommand> [...args]", "[internal] Staff monitoring tools").allowUnknownOptions().option("--status <status>", "Filter by status").option("--type <type>", 'Order type (orders filter; required for "sla global")').option("--region <region>", "Filter by region").option("--search <query>", "Full-text search").option("--sort <field>", "Sort by field (default: createdAt)").option("--sort-direction <direction>", "Sort direction: asc or desc (default: desc)").option("--page <page>", "Page number").option("--page-size <size>", "Results per page").option("--name <name>", "Employee name").option("--email <email>", "Employee email").option("--dri-email <email>", 'DRI email (for "orders dri-edit")').option("--include <fields>", "Include additional data (comma-separated): addresses, deviceStatuses, logs, ctEvidence").option("--log-status <status>", "Filter logs by status (comma-separated)").option("--log-limit <limit>", "Maximum logs per order (default: 10, max: 50)").option("--log-comments-only", "Only include comment-type logs").option("--log-author-role <role>", "Filter logs by author role: staff, client, supplier").option("--company-id <id>", "Scope to a specific company (internal keys only; omit to search all)").option("--file <path>", 'Path to JSON file with task results (for "tasks")').option("--data <json>", 'Inline JSON string with task results (for "tasks")').option("--dry-run", 'Preview without creating tasks (for "tasks")').option("--format <format>", "Output format (json | table | text)").option("--api-key <key>", "API key (overrides config)").option("--api-url <url>", "API URL (overrides config)").option("--environment <env>", "Target environment (prod, next, danielgdev, local)").option("--allow-localhost", "Allow local environment (http://localhost)").action(async (group, subcommand, args, options) => {
+    switch (group) {
+      case "orders":
+        return runStaffOrders(subcommand, args, options);
+      case "tracking":
+        return runStaffTracking(subcommand, args, options);
+      case "sla":
+        return runStaffSla(subcommand, args, options);
+      case "dri":
+        return runStaffDri(subcommand, args, options);
+      case "tasks":
+        return runStaffTasks(subcommand, options);
+      default:
+        console.error(`Unknown staff group: ${group}. Available: orders, tracking, sla, dri, tasks`);
+        process.exitCode = 1;
+    }
+  });
+}
+
+// src/cli.ts
+config({ quiet: true });
+var version = true ? "4.9.0" : "0.0.0-dev";
+var cli = cac("growrk");
+registerAuthCommands(cli);
+registerResourceCommands(cli);
+registerStaffCommands(cli);
+cli.command("help [command]", "Display help for a command").action((command) => {
+  if (command) {
+    cli.parse(["", "", command, "--help"], { run: false });
+  } else {
+    cli.outputHelp();
+  }
+});
+cli.help((sections) => {
+  for (const section of sections) {
+    if (typeof section.body === "string") {
+      section.body = section.body.split("\n").filter((line) => !/^\s+staff\b/.test(line) && !/\bgrowrk staff\b/.test(line)).join("\n");
+    }
+  }
+  return sections;
+});
+cli.version(version);
+async function main() {
+  const parsed = cli.parse(process.argv, { run: false });
+  if (parsed.options.help || parsed.options.version) {
+    return;
+  }
+  if (!cli.matchedCommand) {
+    if (parsed.args.length > 0) {
+      console.error(`Unknown command: ${parsed.args.join(" ")}`);
+      console.error('Run "growrk help" for available commands.');
+    } else {
+      cli.outputHelp();
+    }
+    process.exitCode = 1;
+    return;
+  }
+  await cli.runMatchedCommand();
+}
+main().catch((err) => {
+  console.error(err.message || err);
+  process.exitCode = 1;
+});