@hasna/platform-todos-cli 0.1.0

package/bin/platform-todos.js

@@ -0,0 +1,2613 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/cli/src/index.ts
+import { execFileSync } from "child_process";
+import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
+import { createInterface } from "readline/promises";
+import { stderr as errorOutput, stdin as input, stdout as output } from "process";
+
+// packages/cli/src/auth-store.ts
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var DEFAULT_API_URL = "https://todos.md";
+var AUTH_FILE = join(homedir(), ".platform-todos", "auth.json");
+var PROFILE_DIR = join(homedir(), ".platform-todos", "profiles");
+function normalizeApiUrl(value) {
+  if (!value?.trim())
+    return DEFAULT_API_URL;
+  const url = new URL(value.trim());
+  const pathname = url.pathname.replace(/\/+$/, "");
+  if (pathname === "/api" || pathname === "/api/v1") {
+    url.pathname = "/";
+  } else if (pathname.endsWith("/api/v1")) {
+    url.pathname = pathname.slice(0, -"/api/v1".length) || "/";
+  } else if (pathname.endsWith("/api")) {
+    url.pathname = pathname.slice(0, -"/api".length) || "/";
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+function readAuthConfig(path = AUTH_FILE) {
+  if (!existsSync(path))
+    return null;
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  if (!parsed || typeof parsed !== "object")
+    return null;
+  return {
+    apiUrl: normalizeApiUrl(parsed.apiUrl),
+    ...typeof parsed.apiKey === "string" && parsed.apiKey ? { apiKey: parsed.apiKey } : {},
+    ...typeof parsed.email === "string" && parsed.email ? { email: parsed.email } : {},
+    ...typeof parsed.organizationId === "string" && parsed.organizationId ? { organizationId: parsed.organizationId } : {},
+    ...typeof parsed.organizationSlug === "string" && parsed.organizationSlug ? { organizationSlug: parsed.organizationSlug } : {},
+    ...typeof parsed.userId === "string" && parsed.userId ? { userId: parsed.userId } : {}
+  };
+}
+function writeAuthConfig(config, path = AUTH_FILE) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify({ ...config, apiUrl: normalizeApiUrl(config.apiUrl) }, null, 2)}
+`, {
+    mode: 384
+  });
+}
+function clearAuthConfig(path = AUTH_FILE) {
+  try {
+    unlinkSync(path);
+  } catch {}
+}
+function resolveAuthContext(input = {}) {
+  const authFile = input.authFile ?? authFileForProfile(input.profile ?? process.env.PLATFORM_TODOS_PROFILE ?? process.env.TODOS_PROFILE);
+  if (input.apiKey) {
+    return {
+      apiUrl: normalizeApiUrl(input.apiUrl ?? process.env.PLATFORM_TODOS_API_URL ?? process.env.TODOS_API_URL),
+      apiKey: input.apiKey,
+      source: "flag"
+    };
+  }
+  const envKey = process.env.PLATFORM_TODOS_API_KEY ?? process.env.TODOS_API_KEY;
+  if (envKey) {
+    return {
+      apiUrl: normalizeApiUrl(input.apiUrl ?? process.env.PLATFORM_TODOS_API_URL ?? process.env.TODOS_API_URL),
+      apiKey: envKey,
+      source: "env"
+    };
+  }
+  const stored = readAuthConfig(authFile);
+  if (stored?.apiKey) {
+    return {
+      apiUrl: normalizeApiUrl(input.apiUrl ?? stored.apiUrl),
+      apiKey: stored.apiKey,
+      source: "stored",
+      stored
+    };
+  }
+  return {
+    apiUrl: normalizeApiUrl(input.apiUrl ?? process.env.PLATFORM_TODOS_API_URL ?? process.env.TODOS_API_URL),
+    source: "default",
+    ...stored ? { stored } : {}
+  };
+}
+function redactSecret(value) {
+  if (!value)
+    return null;
+  if (value.length <= 10)
+    return "***";
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function authFileForProfile(profile) {
+  const normalized = normalizeProfile(profile);
+  if (!normalized)
+    return AUTH_FILE;
+  return join(PROFILE_DIR, `${normalized}.json`);
+}
+function normalizeProfile(profile) {
+  const value = profile?.trim().toLowerCase();
+  if (!value || value === "default")
+    return null;
+  const normalized = value.replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || null;
+}
+
+// packages/cli/src/version.ts
+var CLI_VERSION = "0.1.0";
+var CLI_API_VERSION = "2026-05-10";
+var CLI_USER_AGENT = `platform-todos/${CLI_VERSION}`;
+
+// packages/cli/src/client.ts
+class PlatformTodosApiError extends Error {
+  status;
+  body;
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "PlatformTodosApiError";
+  }
+}
+
+class PlatformTodosClient {
+  auth;
+  constructor(options = {}) {
+    this.auth = resolveAuthContext(options);
+  }
+  get apiUrl() {
+    return this.auth.apiUrl;
+  }
+  hasApiKey() {
+    return Boolean(this.auth.apiKey);
+  }
+  async login(email) {
+    return this.request("/api/auth/login", {
+      method: "POST",
+      body: { email },
+      requireAuth: false
+    });
+  }
+  async verify(email, code) {
+    return this.request("/api/auth/verify", {
+      method: "POST",
+      body: { email, code },
+      requireAuth: false
+    });
+  }
+  async createApiKey(sessionToken, name = "platform-todos-cli", tenant) {
+    return this.request("/api/auth/keys", {
+      method: "POST",
+      body: { name },
+      headers: {
+        ...tenant?.organizationId ? { "x-organization-id": tenant.organizationId } : {},
+        ...tenant?.email ? { "x-user-email": tenant.email } : {}
+      },
+      token: sessionToken,
+      requireAuth: true
+    });
+  }
+  async listApiKeys() {
+    return this.request("/api/auth/keys");
+  }
+  async createManagedApiKey(input) {
+    const serviceAccountId = typeof input.serviceAccountId === "string" && input.serviceAccountId ? input.serviceAccountId : null;
+    return this.request(serviceAccountId ? `/api/v1/service-accounts/${encodeURIComponent(serviceAccountId)}/keys` : "/api/auth/keys", {
+      method: "POST",
+      body: input
+    });
+  }
+  async revokeApiKey(id) {
+    return this.request(`/api/auth/keys/${encodeURIComponent(id)}/revoke`, { method: "POST" });
+  }
+  async rotateApiKey(id, name) {
+    return this.request(`/api/auth/keys/${encodeURIComponent(id)}/rotate`, {
+      method: "POST",
+      body: name ? { name } : {}
+    });
+  }
+  async listServiceAccounts() {
+    return this.request("/api/v1/service-accounts");
+  }
+  async createServiceAccount(input) {
+    return this.request("/api/v1/service-accounts", { method: "POST", body: input });
+  }
+  async whoami() {
+    return this.request("/api/auth/whoami");
+  }
+  async billingStatus() {
+    return this.request("/api/v1/billing/status");
+  }
+  async billingUsage() {
+    return this.request("/api/v1/billing/usage");
+  }
+  async billingCheckout(plan) {
+    const query = plan ? `?plan=${encodeURIComponent(plan)}` : "";
+    return this.request(`/api/v1/billing/checkout${query}`, { method: "POST" });
+  }
+  async billingPortal() {
+    return this.request("/api/v1/billing/portal", { method: "POST" });
+  }
+  async organizationSummary() {
+    return this.request("/api/v1/organization");
+  }
+  async updateOrganization(input) {
+    return this.request("/api/v1/organization", { method: "PATCH", body: input });
+  }
+  async createOrganizationInvitation(input) {
+    return this.request("/api/v1/organization/invitations", { method: "POST", body: input });
+  }
+  async acceptOrganizationInvitation(input) {
+    return this.request("/api/v1/organization/invitations/accept", { method: "POST", body: input });
+  }
+  async revokeOrganizationInvitation(invitationId) {
+    return this.request(`/api/v1/organization/invitations/${encodeURIComponent(invitationId)}/revoke`, { method: "POST" });
+  }
+  async changeOrganizationMemberRole(userId, role) {
+    return this.request(`/api/v1/organization/members/${encodeURIComponent(userId)}/role`, {
+      method: "PATCH",
+      body: { role }
+    });
+  }
+  async removeOrganizationMember(userId) {
+    return this.request(`/api/v1/organization/members/${encodeURIComponent(userId)}`, { method: "DELETE" });
+  }
+  async createAuditEvidenceExport(input, idempotencyKey) {
+    return this.request("/api/v1/audit/exports", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async createPrivacyExport(input, idempotencyKey) {
+    return this.request("/api/v1/privacy/exports", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async executePrivacyDeletion(input, idempotencyKey) {
+    return this.request("/api/v1/privacy/deletions", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async enforcePrivacyRetention(input, idempotencyKey) {
+    return this.request("/api/v1/privacy/retention", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async listTasks(query = "") {
+    return this.request(`/api/tasks${query}`);
+  }
+  async getTask(id) {
+    return this.request(`/api/tasks/${encodeURIComponent(id)}`);
+  }
+  async createTask(input) {
+    return this.request("/api/tasks", { method: "POST", body: input });
+  }
+  async startTask(id) {
+    return this.request(`/api/tasks/${encodeURIComponent(id)}/start`, { method: "POST" });
+  }
+  async completeTask(id) {
+    return this.request(`/api/tasks/${encodeURIComponent(id)}/complete`, { method: "POST" });
+  }
+  async batchTasks(input, idempotencyKey) {
+    return this.request("/api/v1/tasks/batch", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async search(input) {
+    return this.request("/api/v1/search", {
+      method: "POST",
+      body: input
+    });
+  }
+  async getRunControls() {
+    return this.request("/api/v1/runs/controls");
+  }
+  async updateRunControls(input, idempotencyKey) {
+    return this.request("/api/v1/runs/controls", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async pauseRuns(input, idempotencyKey) {
+    return this.request("/api/v1/runs/controls/pause", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async resumeRuns(idempotencyKey) {
+    return this.request("/api/v1/runs/controls/resume", {
+      method: "POST",
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async emergencyStopRuns(input, idempotencyKey) {
+    return this.request("/api/v1/runs/emergency-stop", {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async recordRunUsage(runId, input, idempotencyKey) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(runId)}/usage`, {
+      method: "POST",
+      body: input,
+      headers: idempotencyKey ? { "idempotency-key": idempotencyKey } : undefined
+    });
+  }
+  async listRuns() {
+    return this.request("/api/v1/runs");
+  }
+  async createRun(slug, input) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(slug)}`, { method: "POST", body: input });
+  }
+  async getRun(id) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(id)}`);
+  }
+  async cancelRun(id) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
+  }
+  async listRunLogs(id) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(id)}/logs`);
+  }
+  async listRunArtifacts(id) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(id)}/artifacts`);
+  }
+  async listTaskDependencies(taskId) {
+    const query = taskId ? `?taskId=${encodeURIComponent(taskId)}` : "";
+    return this.request(`/api/v1/tasks/dependencies${query}`);
+  }
+  async createTaskDependency(input) {
+    return this.request("/api/v1/tasks/dependencies", { method: "POST", body: input });
+  }
+  async clearTaskDependency(id) {
+    return this.request(`/api/v1/tasks/dependencies/${encodeURIComponent(id)}`, { method: "DELETE" });
+  }
+  async readyTasks(input) {
+    const query = new URLSearchParams({ taskIds: input.taskIds.join(",") });
+    if (input.completedTaskIds?.length)
+      query.set("completedTaskIds", input.completedTaskIds.join(","));
+    if (input.claimedTaskIds?.length)
+      query.set("claimedTaskIds", input.claimedTaskIds.join(","));
+    return this.request(`/api/v1/tasks/ready?${query.toString()}`);
+  }
+  async nextReadyTask(input) {
+    return this.request("/api/v1/tasks/next", { method: "POST", body: input });
+  }
+  async claimTask(input = {}) {
+    return this.request("/api/tasks/claim", { method: "POST", body: input });
+  }
+  async listActivity(query = "") {
+    return this.request(`/api/v1/activity${query}`);
+  }
+  async recordActivityEvent(input) {
+    return this.request("/api/v1/activity/events", { method: "POST", body: input });
+  }
+  async listComments(query = "") {
+    return this.request(`/api/v1/comments${query}`);
+  }
+  async createComment(input) {
+    return this.request("/api/v1/comments", { method: "POST", body: input });
+  }
+  async listViews(query = "") {
+    return this.request(`/api/v1/views${query}`);
+  }
+  async createView(input) {
+    return this.request("/api/v1/views", { method: "POST", body: input });
+  }
+  async listViewItems(id, query = "") {
+    return this.request(`/api/v1/views/${encodeURIComponent(id)}/items${query}`);
+  }
+  async generateReport(kind, query = "") {
+    return this.request(`/api/v1/reports/${encodeURIComponent(kind)}${query}`);
+  }
+  async listPlanTemplates(organizationId) {
+    return this.request("/api/v1/plan-templates", {
+      headers: organizationId ? { "x-organization-id": organizationId } : {}
+    });
+  }
+  async createPlanFromTemplate(input, organizationId) {
+    return this.request("/api/v1/plans/from-template", {
+      method: "POST",
+      body: input,
+      headers: organizationId ? { "x-organization-id": organizationId } : {}
+    });
+  }
+  async importLocalSqliteManifest(input) {
+    return this.request("/api/imports/local-sqlite", {
+      method: "POST",
+      body: {
+        mode: "copy-only",
+        conflictStrategy: input.conflictStrategy ?? "skip",
+        dryRun: input.dryRun ?? false,
+        manifest: input.manifest
+      },
+      headers: {
+        "x-organization-id": input.organizationId,
+        "idempotency-key": input.idempotencyKey
+      }
+    });
+  }
+  async importLocalPlanMarkdown(input) {
+    return this.request("/api/imports/local-plan-markdown", {
+      method: "POST",
+      body: {
+        kind: "hasna.todos.local-plan-markdown.import",
+        schemaVersion: 1,
+        dryRun: input.dryRun ?? false,
+        artifacts: input.artifacts
+      },
+      headers: {
+        "x-organization-id": input.organizationId,
+        "idempotency-key": input.idempotencyKey
+      }
+    });
+  }
+  async importExternalIssues(input) {
+    return this.request("/api/imports/issues", {
+      method: "POST",
+      body: input.body,
+      headers: {
+        "x-organization-id": input.organizationId
+      }
+    });
+  }
+  async listApprovals(query = "") {
+    return this.request(`/api/v1/approvals${query}`);
+  }
+  async requestApproval(input) {
+    return this.request("/api/v1/approvals", { method: "POST", body: input });
+  }
+  async approveApproval(id, reason) {
+    return this.request(`/api/v1/approvals/${encodeURIComponent(id)}/approve`, {
+      method: "POST",
+      body: reason ? { reason } : {}
+    });
+  }
+  async rejectApproval(id, reason) {
+    return this.request(`/api/v1/approvals/${encodeURIComponent(id)}/reject`, {
+      method: "POST",
+      body: reason ? { reason } : {}
+    });
+  }
+  async expireApproval(id) {
+    return this.request(`/api/v1/approvals/${encodeURIComponent(id)}/expire`, { method: "POST" });
+  }
+  async listNotificationSubscriptions() {
+    return this.request("/api/v1/notifications/subscriptions");
+  }
+  async generatePlan(input) {
+    return this.request("/api/v1/plans/generate", {
+      method: "POST",
+      body: input.body,
+      headers: {
+        "x-organization-id": input.organizationId
+      }
+    });
+  }
+  async listPlans(organizationId, query = "") {
+    return this.request(`/api/v1/plans${query}`, {
+      headers: { "x-organization-id": organizationId }
+    });
+  }
+  async getPlan(organizationId, id) {
+    return this.request(`/api/v1/plans/${encodeURIComponent(id)}`, {
+      headers: { "x-organization-id": organizationId }
+    });
+  }
+  async updatePlan(organizationId, id, body) {
+    return this.request(`/api/v1/plans/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body,
+      headers: { "x-organization-id": organizationId }
+    });
+  }
+  async archivePlan(organizationId, id) {
+    return this.request(`/api/v1/plans/${encodeURIComponent(id)}/archive`, {
+      method: "POST",
+      headers: { "x-organization-id": organizationId }
+    });
+  }
+  async listSandboxPolicies() {
+    return this.request("/api/v1/sandbox/policies");
+  }
+  async setSandboxPolicy(input) {
+    return this.request("/api/v1/sandbox/policies", { method: "PUT", body: input });
+  }
+  async deleteSandboxPolicy(input) {
+    return this.request("/api/v1/sandbox/policies", { method: "DELETE", body: input });
+  }
+  async createNotificationSubscription(input) {
+    return this.request("/api/v1/notifications/subscriptions", { method: "POST", body: input });
+  }
+  async disableNotificationSubscription(id) {
+    return this.request(`/api/v1/notifications/subscriptions/${encodeURIComponent(id)}`, { method: "DELETE" });
+  }
+  async listNotificationDeliveries() {
+    return this.request("/api/v1/notifications/deliveries");
+  }
+  async docsCatalog(surface, exposureProfile) {
+    const suffix = surface ? `/${encodeURIComponent(surface)}` : "";
+    const query = exposureProfile ? `?profile=${encodeURIComponent(exposureProfile)}` : "";
+    return this.request(`/api/v1/docs/catalog${suffix}${query}`, { requireAuth: false });
+  }
+  async request(path, options = {}) {
+    const requireAuth = options.requireAuth ?? true;
+    const token = options.token ?? this.auth.apiKey;
+    if (requireAuth && !token) {
+      throw new PlatformTodosApiError("Not signed in. Run: platform-todos auth login", 401, {
+        error: "auth_required"
+      });
+    }
+    let response;
+    try {
+      response = await fetch(`${this.apiUrl}${path}`, {
+        method: options.method ?? (options.body === undefined ? "GET" : "POST"),
+        headers: {
+          accept: "application/json",
+          "user-agent": CLI_USER_AGENT,
+          "x-platform-todos-api-version": CLI_API_VERSION,
+          "x-platform-todos-cli-version": CLI_VERSION,
+          ...options.body === undefined ? {} : { "content-type": "application/json" },
+          ...token ? { authorization: `Bearer ${token}` } : {},
+          ...defaultTenantHeaders(this.auth),
+          ...options.headers
+        },
+        ...options.body === undefined ? {} : { body: JSON.stringify(options.body) }
+      });
+    } catch (error) {
+      throw new PlatformTodosApiError(`API unavailable at ${this.apiUrl}`, 503, {
+        error: "api_unavailable",
+        cause: error instanceof Error ? error.message : String(error)
+      });
+    }
+    const body = await readBody(response);
+    if (!response.ok) {
+      throw new PlatformTodosApiError(readErrorMessage(body, response.statusText), response.status, body);
+    }
+    return body;
+  }
+}
+function defaultTenantHeaders(auth) {
+  const organizationId = auth.stored?.organizationId ?? process.env.PLATFORM_TODOS_ORGANIZATION_ID ?? process.env.TODOS_ORGANIZATION_ID;
+  const email = auth.stored?.email ?? process.env.PLATFORM_TODOS_EMAIL ?? process.env.TODOS_EMAIL;
+  return {
+    ...organizationId ? { "x-organization-id": organizationId } : {},
+    ...email ? { "x-user-email": email } : {}
+  };
+}
+async function readBody(response) {
+  const text = await response.text();
+  if (!text)
+    return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function readErrorMessage(body, fallback) {
+  if (body && typeof body === "object") {
+    const code = "error" in body ? String(body.error) : "";
+    const message = "message" in body ? String(body.message) : "";
+    if (code === "cli_version_unsupported" && message)
+      return message;
+    if (code === "unsupported_api_version" && message)
+      return message;
+  }
+  if (body && typeof body === "object" && "error" in body) {
+    return String(body.error);
+  }
+  if (typeof body === "string" && body.trim())
+    return body;
+  return fallback || "Request failed";
+}
+
+// packages/cli/src/offline-queue.ts
+import { createHash, randomUUID } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+function offlineQueueFileForProfile(profile) {
+  const normalized = normalizeProfile(profile);
+  if (!normalized)
+    return join2(homedir2(), ".platform-todos", "offline-queue.json");
+  return join2(homedir2(), ".platform-todos", "profiles", `${normalized}.offline-queue.json`);
+}
+function readOfflineQueue(path) {
+  if (!existsSync2(path))
+    return [];
+  const parsed = JSON.parse(readFileSync2(path, "utf8"));
+  if (!Array.isArray(parsed))
+    return [];
+  return parsed.filter(isOfflineQueueItem);
+}
+function writeOfflineQueue(path, items) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(items, null, 2)}
+`, { mode: 384 });
+}
+function clearOfflineQueue(path) {
+  writeOfflineQueue(path, []);
+}
+function enqueueOfflineRequest(input) {
+  const queuePath = offlineQueueFileForProfile(input.profile);
+  const now = input.now ?? new Date;
+  const id = randomUUID();
+  const item = {
+    id,
+    operation: input.operation,
+    method: "POST",
+    path: input.path,
+    ...input.body === undefined ? {} : { body: input.body },
+    idempotencyKey: input.idempotencyKey ?? stableIdempotencyKey(input.operation, input.path, input.body, id),
+    createdAt: now.toISOString(),
+    attempts: 0,
+    nextAttemptAt: now.toISOString(),
+    status: "pending"
+  };
+  writeOfflineQueue(queuePath, [...readOfflineQueue(queuePath), item]);
+  return item;
+}
+async function syncOfflineQueue(input) {
+  const queuePath = offlineQueueFileForProfile(input.profile);
+  const now = input.now ?? new Date;
+  const items = readOfflineQueue(queuePath);
+  const synced = [];
+  const retained = [];
+  const skipped = [];
+  for (const item of items) {
+    if (item.status !== "pending" || Date.parse(item.nextAttemptAt) > now.getTime()) {
+      skipped.push(item);
+      retained.push(item);
+      continue;
+    }
+    try {
+      const response = await input.client.request(item.path, {
+        method: item.method,
+        body: item.body,
+        headers: { "Idempotency-Key": item.idempotencyKey }
+      });
+      synced.push({ id: item.id, operation: item.operation, response });
+    } catch (error) {
+      const retainedItem = withRetryState(item, error, now);
+      retained.push(retainedItem);
+      if (retainedItem.status !== "pending")
+        skipped.push(retainedItem);
+    }
+  }
+  writeOfflineQueue(queuePath, retained);
+  return { synced, retained, skipped };
+}
+function withRetryState(item, error, now) {
+  const attempts = item.attempts + 1;
+  const status = error instanceof PlatformTodosApiError && error.status === 409 ? "conflict" : "pending";
+  const backoffSeconds = Math.min(3600, 2 ** Math.min(attempts, 10));
+  return {
+    ...item,
+    attempts,
+    status,
+    lastError: error instanceof Error ? error.message : String(error),
+    nextAttemptAt: new Date(now.getTime() + backoffSeconds * 1000).toISOString()
+  };
+}
+function stableIdempotencyKey(operation, path, body, id) {
+  const fingerprint = createHash("sha256").update(JSON.stringify({ operation, path, body, id })).digest("hex").slice(0, 24);
+  return `cli-offline-${fingerprint}`;
+}
+function isOfflineQueueItem(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const item = value;
+  return typeof item.id === "string" && typeof item.operation === "string" && item.method === "POST" && typeof item.path === "string" && typeof item.idempotencyKey === "string" && typeof item.createdAt === "string" && typeof item.nextAttemptAt === "string" && typeof item.attempts === "number" && (item.status === "pending" || item.status === "conflict");
+}
+
+// packages/cli/src/help.ts
+var GLOBAL_OPTIONS = [
+  "--json",
+  "--api-url",
+  "--api-key",
+  "--profile",
+  "--non-interactive",
+  "--help",
+  "--version"
+];
+var PAID_CLI_COMMANDS = [
+  {
+    name: "auth",
+    usage: "auth login --email <email> [--code <code>] | auth logout | auth whoami | auth status",
+    summary: "Sign in, verify hosted credentials, inspect auth status, or remove stored credentials.",
+    auth: "optional",
+    examples: [
+      "platform-todos auth login --email you@example.com",
+      "platform-todos --json auth status",
+      "platform-todos --json auth whoami"
+    ]
+  },
+  {
+    name: "billing",
+    usage: "billing status | billing usage | billing checkout [--plan pro|team|storage] [--open] | billing portal [--open]",
+    summary: "Read hosted plan limits, usage meters, and create Checkout or Customer Portal sessions.",
+    auth: "required",
+    examples: [
+      "platform-todos --json billing status",
+      "platform-todos --json billing usage",
+      "platform-todos billing checkout --plan pro --open"
+    ]
+  },
+  {
+    name: "api-keys",
+    usage: "api-keys list|create|select|revoke|rotate [--select] [--scopes <csv>]",
+    summary: "List key metadata, create or rotate scoped keys, select a key for the active profile, or revoke old keys.",
+    auth: "required",
+    examples: [
+      "platform-todos api-keys list",
+      "platform-todos api-keys create --name ci --scopes tasks:read,tasks:create --select",
+      "platform-todos api-keys select --key ak_example",
+      "platform-todos api-keys rotate <key-id> --select"
+    ]
+  },
+  {
+    name: "organization",
+    usage: "organization show|members|invitations|audit|update|invite|accept-invite|revoke-invite|role|remove",
+    summary: "Manage hosted organization settings, members, invitations, roles, and audit entries.",
+    auth: "required",
+    examples: [
+      "platform-todos organization members",
+      "platform-todos organization invite teammate@example.com --role member",
+      "platform-todos organization audit --json"
+    ]
+  },
+  {
+    name: "audit",
+    usage: "audit export --body <json>|--file <path> [--idempotency-key <key>]",
+    summary: "Create a redacted org-scoped audit and evidence export bundle.",
+    auth: "required",
+    examples: [
+      "platform-todos audit export --file evidence-request.json --idempotency-key audit-export-1"
+    ]
+  },
+  {
+    name: "privacy",
+    usage: "privacy <export|delete|retention> --body <json>|--file <path> [--idempotency-key <key>]",
+    summary: "Run admin-safe org privacy export, deletion, and retention controls.",
+    auth: "required",
+    examples: [
+      "platform-todos privacy export --body '{}' --idempotency-key privacy-export-1",
+      `platform-todos privacy delete --body '{"subjectEmail":"owner@example.com"}' --idempotency-key privacy-delete-1`,
+      "platform-todos privacy retention --body '{}' --idempotency-key privacy-retention-1"
+    ]
+  },
+  {
+    name: "tasks",
+    usage: "tasks list|show|add|start|done|batch [--offline|--queue-offline|--dry-run]",
+    summary: "Use the hosted task API, queue task writes for later sync, or submit idempotent batch mutations.",
+    auth: "required",
+    examples: [
+      "platform-todos tasks list --status pending",
+      'platform-todos tasks add "Review launch" --idempotency-key launch-1',
+      "platform-todos tasks done task_123 --queue-offline",
+      `platform-todos tasks batch --body '{"operations":[{"type":"start_task","id":"task_123"}]}' --idempotency-key batch-1`
+    ]
+  },
+  {
+    name: "activity",
+    usage: "activity list|event [--target-type <type>] [--target-id <id>]",
+    summary: "List tenant activity or record events on tasks, projects, plans, and runs.",
+    auth: "required",
+    examples: [
+      "platform-todos activity list --target-type task --target-id task_123",
+      "platform-todos activity event task.started --target-type task --target-id task_123"
+    ]
+  },
+  {
+    name: "comments",
+    usage: "comments list|add [--target-type <type>] [--target-id <id>]",
+    summary: "List or add comments on tenant-scoped tasks, projects, plans, and runs.",
+    auth: "required",
+    examples: [
+      "platform-todos comments list --target-type task --target-id task_123",
+      'platform-todos comments add --target-type task --target-id task_123 --body "Reviewed"'
+    ]
+  },
+  {
+    name: "views",
+    usage: "views list|create|items [options]",
+    summary: "Manage saved task, project, plan, and run views for agent workflows.",
+    auth: "required",
+    examples: [
+      "platform-todos views list --limit 20",
+      `platform-todos views create "Ready launches" --filter '{"types":["task"],"ready":true}'`,
+      "platform-todos views items ready --limit 10"
+    ]
+  },
+  {
+    name: "reports",
+    usage: "reports summary|standup|sprint [--format json|markdown]",
+    summary: "Generate machine-readable or Markdown reports from saved views and filters.",
+    auth: "required",
+    examples: [
+      "platform-todos reports standup --format markdown",
+      "platform-todos reports summary --view ready --types task,run"
+    ]
+  },
+  {
+    name: "search",
+    usage: "search [query] [--type <types>] [--status <status>] [--limit <n>] [--body <json>|--file <path>]",
+    summary: "Search org-scoped hosted tasks, plans, runs, comments, imports, and audit artifacts.",
+    auth: "required",
+    examples: [
+      "platform-todos search deploy --type tasks,plans,runs --json",
+      `platform-todos search --body '{"query":"blocked","tasks":[{"id":"task-1","title":"Blocked deploy"}]}'`
+    ]
+  },
+  {
+    name: "runs",
+    usage: "runs controls|pause|resume|emergency-stop|usage",
+    summary: "Manage hosted run budgets, sandbox policies, queue pause/resume, emergency stops, and usage evidence.",
+    auth: "required",
+    examples: [
+      "platform-todos runs controls --budget-cents 5000 --max-run-cost-cents 500",
+      "platform-todos runs controls --agent-id codex --allow-tools shell,git --deny-tools aws --network-policy restricted",
+      "platform-todos runs pause --reason deploy-freeze",
+      "platform-todos runs emergency-stop --reason incident",
+      "platform-todos runs usage <run-id> --cost-cents 120 --tool-calls 8"
+    ]
+  },
+  {
+    name: "approvals",
+    usage: "approvals list|request|approve|reject|expire",
+    summary: "Manage manual approval gates for hosted agent runs.",
+    auth: "required",
+    examples: [
+      "platform-todos approvals list --status pending",
+      'platform-todos approvals request "before deploy" --run <run-id> --reviewer owner',
+      'platform-todos approvals approve <approval-id> --reason "reviewed"'
+    ]
+  },
+  {
+    name: "sandbox",
+    usage: "sandbox policies|set|delete [--agent <id>]",
+    summary: "Manage organization and agent-specific execution policies for hosted runs.",
+    auth: "required",
+    examples: [
+      "platform-todos sandbox policies",
+      "platform-todos sandbox set --agent codex --allow-tools todos.add,todos.done --deny-tools shell.exec",
+      "platform-todos sandbox delete --agent codex"
+    ]
+  },
+  {
+    name: "queue",
+    usage: "queue list|sync|clear",
+    summary: "Inspect, replay, or clear the local hosted-write offline queue.",
+    auth: "optional",
+    examples: [
+      "platform-todos queue list --json",
+      "platform-todos queue sync"
+    ]
+  },
+  {
+    name: "import",
+    usage: "import local-sqlite|plan-markdown|issues [options]",
+    summary: "Copy explicit OSS local exports, import local plan Markdown artifacts, or preview/apply external issue imports.",
+    auth: "required",
+    examples: [
+      "platform-todos import local-sqlite --manifest .todos/export.json --org org_123 --idempotency-key import-1",
+      "platform-todos import plan-markdown --path .hasna/todos/plans/project_123 --org org_123 --idempotency-key plans-1",
+      "platform-todos import issues --source github --file issues.json --org org_123",
+      'platform-todos import issues --source markdown --raw "- [ ] Ship docs" --apply --org org_123'
+    ]
+  },
+  {
+    name: "plans",
+    usage: "plans templates|list|show|update|archive|create|generate|refine [options]",
+    summary: "List reusable templates, inspect cloud plans, create plan drafts, or generate/update/refine agent-native plans.",
+    auth: "required",
+    examples: [
+      "platform-todos plans templates --org org_123",
+      "platform-todos plans list --org org_123",
+      "platform-todos plans show plan_123 --org org_123",
+      'platform-todos plans update plan_123 --feedback "Add owner review" --org org_123',
+      'platform-todos plans create --template release --title "Production release" --org org_123',
+      'platform-todos plans generate --objective "Create project. Add todos. Run agent." --org org_123',
+      'platform-todos plans refine --plan plan_123 --objective "Create project. Add todos. Run agent." --feedback "Add owner review" --org org_123'
+    ]
+  },
+  {
+    name: "docs",
+    usage: "docs catalog [--surface <api|cli|mcp|sdk>] [--exposure-profile <profile>]",
+    summary: "Fetch machine-readable API, CLI, MCP, and SDK documentation from the hosted service.",
+    auth: "none",
+    examples: [
+      "platform-todos docs catalog --surface cli --json",
+      "platform-todos docs catalog --surface api --exposure-profile read-only"
+    ]
+  },
+  {
+    name: "api",
+    usage: "api get|post <path> [--body <json>]",
+    summary: "Call a hosted API endpoint directly when a wrapper command does not exist yet.",
+    auth: "required",
+    examples: [
+      "platform-todos api get /api/v1/capabilities --json",
+      `platform-todos api post /api/tasks --body '{"title":"Review"}'`
+    ]
+  },
+  {
+    name: "config",
+    usage: "config show | config set [--api-url <url>] [--api-key <key>]",
+    summary: "Inspect or update local paid CLI API settings.",
+    auth: "none",
+    examples: [
+      "platform-todos config show --json",
+      "platform-todos --profile staging config set --api-url https://preview.todos.md --api-key ak_example"
+    ]
+  },
+  {
+    name: "completion",
+    usage: "completion <bash|zsh|fish>",
+    summary: "Generate shell completion scripts for the paid hosted CLI.",
+    auth: "none",
+    examples: [
+      "platform-todos completion bash > ~/.local/share/bash-completion/completions/platform-todos",
+      "platform-todos completion zsh > ~/.zfunc/_platform-todos",
+      "platform-todos completion fish > ~/.config/fish/completions/platform-todos.fish"
+    ]
+  },
+  {
+    name: "manpage",
+    usage: "manpage",
+    summary: "Print a manpage-grade reference for the paid hosted CLI.",
+    auth: "none",
+    examples: [
+      "platform-todos manpage"
+    ]
+  },
+  {
+    name: "help",
+    usage: "help [command]",
+    summary: "Print full help or help for one command group.",
+    auth: "none",
+    examples: [
+      "platform-todos help",
+      "platform-todos help tasks"
+    ]
+  },
+  {
+    name: "version",
+    usage: "version",
+    summary: "Print the paid CLI version.",
+    auth: "none",
+    examples: [
+      "platform-todos version"
+    ]
+  }
+];
+function paidCliCommandNames() {
+  return PAID_CLI_COMMANDS.map((command) => command.name);
+}
+function renderHelp(topic) {
+  const command = topic ? findCommand(topic) : undefined;
+  if (topic && !command) {
+    return `Unknown help topic: ${topic}
+
+${renderHelp()}`;
+  }
+  if (command) {
+    return [
+      `platform-todos ${command.usage}`,
+      "",
+      command.summary,
+      "",
+      `Auth: ${authDescription(command.auth)}`,
+      "",
+      "Examples:",
+      ...command.examples.map((example) => `  ${example}`),
+      "",
+      jsonAndExitContract()
+    ].join(`
+`);
+  }
+  const commandRows = PAID_CLI_COMMANDS.filter((doc) => doc.name !== "version").map((doc) => `  ${doc.usage.padEnd(74)} ${doc.summary}`);
+  return [
+    `platform-todos ${CLI_VERSION}`,
+    "",
+    "Remote-only paid CLI for todos.md.",
+    "",
+    "Usage:",
+    "  platform-todos [--json] [--api-url <url>] [--api-key <key>] [--profile <name>] <command>",
+    "",
+    "Global options:",
+    "  --json                 Print machine-readable JSON output.",
+    "  --api-url <url>        Hosted API root. Defaults to https://todos.md.",
+    "  --api-key <key>        Non-interactive hosted API key.",
+    "  --profile <name>       Isolate stored credentials and offline queue.",
+    "  --non-interactive      Never prompt for login input.",
+    "  --help, -h             Print help.",
+    "  --version, -V          Print version.",
+    "",
+    "Commands:",
+    ...commandRows,
+    "",
+    "Install and update:",
+    "  bun install -g @hasna/platform-todos-cli",
+    "  bun update -g @hasna/platform-todos-cli",
+    "",
+    "Shell completions:",
+    "  platform-todos completion bash",
+    "  platform-todos completion zsh",
+    "  platform-todos completion fish",
+    "",
+    "Hosted boundary:",
+    "  This paid CLI talks to the hosted API only. It does not initialize, import, or run the public local task runtime unless you explicitly submit an export manifest.",
+    "",
+    jsonAndExitContract(),
+    "",
+    `Defaults: API URL ${DEFAULT_API_URL}; API key env PLATFORM_TODOS_API_KEY; profile env PLATFORM_TODOS_PROFILE.`
+  ].join(`
+`);
+}
+function renderManpage() {
+  const sections = PAID_CLI_COMMANDS.map((command) => [
+    `### ${command.name}`,
+    "",
+    `Usage: platform-todos ${command.usage}`,
+    "",
+    command.summary,
+    "",
+    `Auth: ${authDescription(command.auth)}`,
+    "",
+    "Examples:",
+    ...command.examples.map((example) => `- \`${example}\``)
+  ].join(`
+`));
+  return [
+    "# platform-todos(1)",
+    "",
+    "Remote-only paid CLI for the todos.md hosted platform.",
+    "",
+    "## Synopsis",
+    "",
+    "`platform-todos [--json] [--api-url <url>] [--api-key <key>] [--profile <name>] <command>`",
+    "",
+    "## Description",
+    "",
+    "platform-todos controls the hosted todos.md API from terminals, CI, and agents. It is separate from the public local-first task CLI and does not read local task data except when you explicitly submit an export manifest with `import local-sqlite`.",
+    "",
+    "## Global Options",
+    "",
+    ...GLOBAL_OPTIONS.map((option) => `- \`${option}\``),
+    "",
+    "## Commands",
+    "",
+    ...sections,
+    "",
+    "## JSON Contract",
+    "",
+    "Use `--json` for stable machine-readable stdout. Errors are written to stderr as `{ error, status, body? }`.",
+    "",
+    "## Exit Codes",
+    "",
+    "- `0`: command succeeded.",
+    "- `1`: usage, authentication, quota, conflict, or HTTP error.",
+    "- Other non-zero values are reserved for future fatal local failures.",
+    "",
+    "## Install And Update",
+    "",
+    "- `bun install -g @hasna/platform-todos-cli`",
+    "- `bun update -g @hasna/platform-todos-cli`",
+    ""
+  ].join(`
+`);
+}
+function renderCompletion(shell) {
+  if (shell === "bash")
+    return renderBashCompletion();
+  if (shell === "zsh")
+    return renderZshCompletion();
+  return renderFishCompletion();
+}
+function isCompletionShell(value) {
+  return value === "bash" || value === "zsh" || value === "fish";
+}
+function renderBashCompletion() {
+  const commands = completionWords();
+  return `# bash completion for platform-todos
+_platform_todos_completion() {
+  local current
+  current="\${COMP_WORDS[COMP_CWORD]}"
+  COMPREPLY=( $(compgen -W "${commands}" -- "$current") )
+}
+complete -F _platform_todos_completion platform-todos todosmd
+`;
+}
+function renderZshCompletion() {
+  return `#compdef platform-todos todosmd
+_platform_todos() {
+  local -a commands
+  commands=(
+${PAID_CLI_COMMANDS.map((command) => `    '${command.name}:${escapeZsh(command.summary)}'`).join(`
+`)}
+  )
+  _describe 'platform-todos command' commands
+}
+_platform_todos "$@"
+`;
+}
+function renderFishCompletion() {
+  const commandLines = PAID_CLI_COMMANDS.map((command) => `complete -c platform-todos -f -a '${command.name}' -d '${escapeSingle(command.summary)}'`).join(`
+`);
+  const optionLines = GLOBAL_OPTIONS.map((option) => `complete -c platform-todos -l ${option.replace(/^--/, "")}`).join(`
+`);
+  return `# fish completion for platform-todos
+${commandLines}
+${optionLines}
+complete -c todosmd -w platform-todos
+`;
+}
+function findCommand(topic) {
+  const normalized = topic === "org" || topic === "team" ? "organization" : topic === "completions" ? "completion" : topic;
+  return PAID_CLI_COMMANDS.find((command) => command.name === normalized);
+}
+function completionWords() {
+  return [...paidCliCommandNames(), ...GLOBAL_OPTIONS].join(" ");
+}
+function authDescription(auth) {
+  if (auth === "required")
+    return "requires a hosted API key or signed-in profile";
+  if (auth === "optional")
+    return "some subcommands require hosted auth";
+  return "does not require hosted auth";
+}
+function jsonAndExitContract() {
+  return [
+    "JSON and exit codes:",
+    "  --json writes stable machine-readable stdout.",
+    "  Errors write JSON to stderr as { error, status, body? } when --json is set.",
+    "  Exit 0 means success; exit 1 means usage, auth, quota, conflict, or HTTP failure."
+  ].join(`
+`);
+}
+function escapeZsh(value) {
+  return value.replace(/'/g, "'\\''");
+}
+function escapeSingle(value) {
+  return value.replace(/'/g, "\\'");
+}
+
+// packages/cli/src/index.ts
+var VERSION = CLI_VERSION;
+async function main(argv = process.argv.slice(2)) {
+  const parsed = parseArgs(argv);
+  const [group, subcommand, ...rest] = parsed.command;
+  try {
+    if (!group || group === "--help" || group === "-h") {
+      printOutput(renderHelp(), parsed.globals);
+      return 0;
+    }
+    if (group === "help") {
+      printOutput(renderHelp(subcommand), parsed.globals);
+      return 0;
+    }
+    if (group === "--version" || group === "-V" || group === "version") {
+      printOutput(VERSION, parsed.globals);
+      return 0;
+    }
+    if (group === "auth")
+      return await handleAuth(subcommand, rest, parsed.globals);
+    if (group === "api-keys" || group === "api-key")
+      return await handleApiKeys(subcommand, rest, parsed.globals);
+    if (group === "service-accounts" || group === "service-account")
+      return await handleServiceAccounts(subcommand, rest, parsed.globals);
+    if (group === "billing")
+      return await handleBilling(subcommand, rest, parsed.globals);
+    if (group === "organization" || group === "org" || group === "team")
+      return await handleOrganization(subcommand, rest, parsed.globals);
+    if (group === "audit")
+      return await handleAudit(subcommand, rest, parsed.globals);
+    if (group === "privacy")
+      return await handlePrivacy(subcommand, rest, parsed.globals);
+    if (group === "search" || group === "find")
+      return await handleSearch(subcommand, rest, parsed.globals);
+    if (group === "runs")
+      return await handleRuns(subcommand, rest, parsed.globals);
+    if (group === "tasks")
+      return await handleTasks(subcommand, rest, parsed.globals);
+    if (group === "notifications" || group === "webhooks")
+      return await handleNotifications(subcommand, rest, parsed.globals);
+    if (group === "approvals" || group === "approval")
+      return await handleApprovals(subcommand, rest, parsed.globals);
+    if (group === "activity")
+      return await handleActivity(subcommand, rest, parsed.globals);
+    if (group === "comments")
+      return await handleComments(subcommand, rest, parsed.globals);
+    if (group === "views")
+      return await handleViews(subcommand, rest, parsed.globals);
+    if (group === "reports")
+      return await handleReports(subcommand, rest, parsed.globals);
+    if (group === "import")
+      return await handleImport(subcommand, rest, parsed.globals);
+    if (group === "sandbox")
+      return await handleSandbox(subcommand, rest, parsed.globals);
+    if (group === "plans")
+      return await handlePlans(subcommand, rest, parsed.globals);
+    if (group === "docs")
+      return await handleDocs(subcommand, rest, parsed.globals);
+    if (group === "queue" || group === "sync")
+      return await handleQueue(group === "sync" ? "sync" : subcommand, rest, parsed.globals);
+    if (group === "completion" || group === "completions")
+      return handleCompletion(subcommand);
+    if (group === "manpage" || group === "manual") {
+      printOutput(renderManpage(), parsed.globals);
+      return 0;
+    }
+    if (group === "config")
+      return await handleConfig(subcommand, rest, parsed.globals);
+    if (group === "api")
+      return await handleApi(subcommand, rest, parsed.globals);
+    throw new UsageError(`Unknown command: ${group}`);
+  } catch (error) {
+    return handleError(error, parsed.globals);
+  }
+}
+async function handleApiKeys(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || !subcommand) {
+    printOutput(await client.listApiKeys(), globals);
+    return 0;
+  }
+  if (subcommand === "create") {
+    const created = await client.createManagedApiKey({
+      name: options.name ?? firstPositional(args) ?? "platform-todos-cli",
+      ...options.scopes ? { scopes: splitList(options.scopes) } : {},
+      ...options.serviceAccount ? { serviceAccountId: options.serviceAccount } : {},
+      ...options.serviceAccountId ? { serviceAccountId: options.serviceAccountId } : {}
+    });
+    printOutput(selectApiKeyIfRequested(created, options, globals), globals);
+    return 0;
+  }
+  if (subcommand === "select" || subcommand === "use") {
+    const apiKey = options.key ?? options.apiKey ?? firstPositional(args) ?? globals.apiKey;
+    if (!apiKey) {
+      throw new UsageError("API key is required. Use: platform-todos api-keys select --key <api-key>");
+    }
+    printOutput(selectApiKey(apiKey, options, globals), globals);
+    return 0;
+  }
+  if (subcommand === "revoke") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("API key ID is required.");
+    printOutput(await client.revokeApiKey(id), globals);
+    return 0;
+  }
+  if (subcommand === "rotate") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("API key ID is required.");
+    const rotated = await client.rotateApiKey(id, options.name);
+    printOutput(selectApiKeyIfRequested(rotated, options, globals), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos api-keys <list|create|select|revoke|rotate>");
+}
+async function handleServiceAccounts(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || !subcommand) {
+    printOutput(await client.listServiceAccounts(), globals);
+    return 0;
+  }
+  if (subcommand === "create") {
+    const name = options.name ?? firstPositional(args);
+    if (!name)
+      throw new UsageError("Service account name is required.");
+    printOutput(await client.createServiceAccount({
+      name,
+      ...options.description ? { description: options.description } : {},
+      ...options.scopes ? { scopes: splitList(options.scopes) } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "key") {
+    const serviceAccountId = options.id ?? options.serviceAccountId ?? firstPositional(args);
+    if (!serviceAccountId)
+      throw new UsageError("Service account ID is required.");
+    printOutput(await client.createManagedApiKey({
+      serviceAccountId,
+      name: options.name ?? "service-account-key",
+      ...options.scopes ? { scopes: splitList(options.scopes) } : {}
+    }), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos service-accounts <list|create|key>");
+}
+async function handleSandbox(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "policies" || subcommand === "list" || !subcommand) {
+    printOutput(await client.listSandboxPolicies(), globals);
+    return 0;
+  }
+  if (subcommand === "set") {
+    const metadata = options.metadata ? JSON.parse(options.metadata) : undefined;
+    printOutput(await client.setSandboxPolicy({
+      ...options.agent ? { agentId: options.agent } : {},
+      ...options.allowTools ? { allowedTools: splitCsv(options.allowTools) } : {},
+      ...options.denyTools ? { deniedTools: splitCsv(options.denyTools) } : {},
+      ...options.network ? { network: options.network } : {},
+      ...options.filesystem ? { filesystem: options.filesystem } : {},
+      ...options.redactEnv ? { envRedactionPatterns: splitCsv(options.redactEnv) } : {},
+      ...metadata ? { metadata } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "delete") {
+    printOutput(await client.deleteSandboxPolicy({
+      ...options.agent ? { agentId: options.agent } : {}
+    }), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos sandbox <policies|set|delete>");
+}
+async function handleAuth(subcommand, args, globals) {
+  if (subcommand === "login" || subcommand === "signup") {
+    const options = parseOptions(args);
+    const apiUrl = options.apiUrl ?? globals.apiUrl ?? DEFAULT_API_URL;
+    const apiKey = options.apiKey ?? globals.apiKey;
+    const authFile = authFileForProfile(globals.profile);
+    if (apiKey) {
+      writeAuthConfig({ apiUrl, apiKey }, authFile);
+      printOutput({ status: "authenticated", apiUrl, apiKey: redactSecret(apiKey), source: "api-key" }, globals);
+      return 0;
+    }
+    let email = options.email;
+    if (!email && !globals.nonInteractive && isTTY()) {
+      email = await prompt("Email: ");
+    }
+    if (!email || !email.includes("@")) {
+      throw new UsageError("Email required. Use: platform-todos auth login --email you@example.com");
+    }
+    const client = new PlatformTodosClient({ apiUrl });
+    let code = options.code;
+    if (!code) {
+      const login = await client.login(email);
+      if (globals.nonInteractive || !isTTY()) {
+        printOutput({
+          status: "code_required",
+          email: normalizeEmail(email),
+          message: `${login.message ?? "Enter the verification code."} Run: platform-todos auth login --email ${normalizeEmail(email)} --code <code>`
+        }, globals);
+        return 0;
+      }
+      code = await promptSecret("Code: ");
+    }
+    if (!code)
+      throw new UsageError("Verification code is required.");
+    const verified = await client.verify(email, code);
+    const key = verified.apiKey ?? await createApiKeyFromSession(client, verified.token, {
+      organizationId: verified.organization?.id,
+      email: verified.user?.email ?? normalizeEmail(email)
+    });
+    writeAuthConfig({
+      apiUrl,
+      apiKey: key,
+      email: verified.user?.email ?? normalizeEmail(email),
+      organizationId: verified.organization?.id,
+      organizationSlug: verified.organization?.slug,
+      userId: verified.user?.id
+    }, authFile);
+    printOutput({
+      status: "authenticated",
+      email: verified.user?.email ?? normalizeEmail(email),
+      organization: verified.organization?.slug ?? null,
+      apiUrl
+    }, globals);
+    return 0;
+  }
+  if (subcommand === "logout") {
+    clearAuthConfig(authFileForProfile(globals.profile));
+    printOutput({ status: "signed_out" }, globals);
+    return 0;
+  }
+  if (subcommand === "whoami") {
+    printOutput(await new PlatformTodosClient(globals).whoami(), globals);
+    return 0;
+  }
+  if (subcommand === "status") {
+    const auth = resolveAuthContext(globals);
+    printOutput({
+      signedIn: Boolean(auth.apiKey),
+      profile: normalizeProfile(globals.profile ?? process.env.PLATFORM_TODOS_PROFILE ?? process.env.TODOS_PROFILE) ?? "default",
+      apiUrl: auth.apiUrl,
+      apiKey: redactSecret(auth.apiKey),
+      source: auth.source,
+      email: auth.stored?.email ?? null,
+      organization: auth.stored?.organizationSlug ?? null
+    }, globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos auth <login|signup|logout|whoami|status>");
+}
+async function handleBilling(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "status" || !subcommand) {
+    printOutput(await client.billingStatus(), globals);
+    return 0;
+  }
+  if (subcommand === "usage") {
+    printOutput(await client.billingUsage(), globals);
+    return 0;
+  }
+  if (subcommand === "checkout") {
+    printOutput(openBillingSessionIfRequested(await client.billingCheckout(options.plan), options), globals);
+    return 0;
+  }
+  if (subcommand === "portal") {
+    printOutput(openBillingSessionIfRequested(await client.billingPortal(), options), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos billing <status|usage|checkout|portal> [--plan pro|team|storage] [--open]");
+}
+async function handleOrganization(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "show" || subcommand === "status" || !subcommand) {
+    printOutput(await client.organizationSummary(), globals);
+    return 0;
+  }
+  if (subcommand === "members") {
+    const summary = await client.organizationSummary();
+    printOutput(summary.members ?? [], globals);
+    return 0;
+  }
+  if (subcommand === "invitations") {
+    const summary = await client.organizationSummary();
+    printOutput(summary.invitations ?? [], globals);
+    return 0;
+  }
+  if (subcommand === "audit") {
+    const summary = await client.organizationSummary();
+    printOutput(summary.auditEvents ?? [], globals);
+    return 0;
+  }
+  if (subcommand === "update") {
+    const settings = options.settings ? JSON.parse(options.settings) : undefined;
+    printOutput(await client.updateOrganization({
+      ...options.name ? { name: options.name } : {},
+      ...settings ? { settings } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "invite") {
+    const email = options.email ?? firstPositional(args);
+    if (!email)
+      throw new UsageError("Invite email is required.");
+    printOutput(await client.createOrganizationInvitation({
+      email,
+      role: options.role ?? "member",
+      ...options.expiresInDays ? { expiresInDays: Number(options.expiresInDays) } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "accept-invite") {
+    const token = options.token ?? firstPositional(args);
+    if (!token)
+      throw new UsageError("Invitation token is required.");
+    printOutput(await client.acceptOrganizationInvitation({
+      token,
+      ...options.invitationId ? { invitationId: options.invitationId } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "revoke-invite") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("Invitation ID is required.");
+    printOutput(await client.revokeOrganizationInvitation(id), globals);
+    return 0;
+  }
+  if (subcommand === "role") {
+    const userId = options.userId ?? firstPositional(args);
+    const role = options.role ?? secondPositional(args);
+    if (!userId)
+      throw new UsageError("Member user ID is required.");
+    if (!role)
+      throw new UsageError("Role is required.");
+    printOutput(await client.changeOrganizationMemberRole(userId, role), globals);
+    return 0;
+  }
+  if (subcommand === "remove") {
+    const userId = options.userId ?? firstPositional(args);
+    if (!userId)
+      throw new UsageError("Member user ID is required.");
+    printOutput(await client.removeOrganizationMember(userId), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos organization <show|members|invitations|audit|update|invite|accept-invite|revoke-invite|role|remove>");
+}
+async function handleAudit(subcommand, args, globals) {
+  if (subcommand !== "export" && subcommand !== "evidence") {
+    throw new UsageError("Usage: platform-todos audit export --body <json>|--file <path> [--idempotency-key <key>]");
+  }
+  const options = parseOptions(args);
+  const rawBody = options.body ?? (options.file ? readFileSync3(options.file, "utf8") : undefined);
+  if (!rawBody)
+    throw new UsageError("Audit export body is required. Use --body <json> or --file <path>.");
+  printOutput(await new PlatformTodosClient(globals).createAuditEvidenceExport(JSON.parse(rawBody), options.idempotencyKey ?? options.idempotency), globals);
+  return 0;
+}
+async function handlePrivacy(subcommand, args, globals) {
+  if (subcommand !== "export" && subcommand !== "delete" && subcommand !== "deletion" && subcommand !== "retention") {
+    throw new UsageError("Usage: platform-todos privacy <export|delete|retention> --body <json>|--file <path> [--idempotency-key <key>]");
+  }
+  const options = parseOptions(args);
+  const rawBody = options.body ?? (options.file ? readFileSync3(options.file, "utf8") : "{}");
+  const body = JSON.parse(rawBody);
+  const idempotencyKey = options.idempotencyKey ?? options.idempotency;
+  const client = new PlatformTodosClient(globals);
+  if (subcommand === "export") {
+    printOutput(await client.createPrivacyExport(body, idempotencyKey), globals);
+    return 0;
+  }
+  if (subcommand === "retention") {
+    printOutput(await client.enforcePrivacyRetention(body, idempotencyKey), globals);
+    return 0;
+  }
+  printOutput(await client.executePrivacyDeletion(body, idempotencyKey), globals);
+  return 0;
+}
+async function handleSearch(subcommand, args, globals) {
+  const searchArgs = subcommand && subcommand !== "query" && subcommand !== "workspace" ? [subcommand, ...args] : args;
+  const options = parseOptions(searchArgs);
+  const positionalQuery = firstPositional(searchArgs);
+  const rawBody = options.body ?? (options.file ? readFileSync3(options.file, "utf8") : "{}");
+  const body = JSON.parse(rawBody);
+  const query = options.query ?? options.q ?? positionalQuery;
+  printOutput(await new PlatformTodosClient(globals).search({
+    ...body,
+    ...query ? { query } : {},
+    ...options.type ? { types: options.type.split(",").map((type) => type.trim()).filter(Boolean) } : {},
+    ...options.types ? { types: options.types.split(",").map((type) => type.trim()).filter(Boolean) } : {},
+    ...options.status ? { status: options.status } : {},
+    ...options.limit ? { limit: readNumericOption(options.limit) } : {},
+    ...options.cursor ? { cursor: options.cursor } : {}
+  }), globals);
+  return 0;
+}
+async function handleRuns(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  const idempotencyKey = options.idempotencyKey ?? options.idempotency;
+  if (subcommand === "list" || !subcommand) {
+    printOutput(await client.listRuns(), globals);
+    return 0;
+  }
+  if (subcommand === "create" || subcommand === "run") {
+    const slug = firstPositional(args);
+    if (!slug)
+      throw new UsageError("Run slug is required.");
+    const body = options.body ? JSON.parse(options.body) : {};
+    printOutput(await client.createRun(slug, {
+      ...body,
+      ...options.maxAttempts ? { maxAttempts: Number(options.maxAttempts) } : {},
+      ...options.timeoutMs ? { timeoutMs: Number(options.timeoutMs) } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "show") {
+    const id = firstPositional(args);
+    if (!id)
+      throw new UsageError("Run ID is required.");
+    printOutput(await client.getRun(id), globals);
+    return 0;
+  }
+  if (subcommand === "cancel") {
+    const id = firstPositional(args);
+    if (!id)
+      throw new UsageError("Run ID is required.");
+    printOutput(await client.cancelRun(id), globals);
+    return 0;
+  }
+  if (subcommand === "logs") {
+    const id = firstPositional(args);
+    if (!id)
+      throw new UsageError("Run ID is required.");
+    printOutput(await client.listRunLogs(id), globals);
+    return 0;
+  }
+  if (subcommand === "artifacts") {
+    const id = firstPositional(args);
+    if (!id)
+      throw new UsageError("Run ID is required.");
+    printOutput(await client.listRunArtifacts(id), globals);
+    return 0;
+  }
+  if (subcommand === "controls" || subcommand === "budgets") {
+    if (!args.some((arg) => arg.startsWith("--"))) {
+      printOutput(await client.getRunControls(), globals);
+      return 0;
+    }
+    printOutput(await client.updateRunControls(readRunControlOptions(options), idempotencyKey), globals);
+    return 0;
+  }
+  if (subcommand === "pause") {
+    printOutput(await client.pauseRuns({ reason: options.reason }, idempotencyKey), globals);
+    return 0;
+  }
+  if (subcommand === "resume") {
+    printOutput(await client.resumeRuns(idempotencyKey), globals);
+    return 0;
+  }
+  if (subcommand === "emergency-stop" || subcommand === "stop") {
+    printOutput(await client.emergencyStopRuns({ reason: options.reason }, idempotencyKey), globals);
+    return 0;
+  }
+  if (subcommand === "usage") {
+    const runId = firstPositional(args);
+    if (!runId)
+      throw new UsageError("Run ID is required.");
+    printOutput(await client.recordRunUsage(runId, {
+      costCents: readNumericOption(options.costCents),
+      toolCalls: readNumericOption(options.toolCalls),
+      durationMs: readNumericOption(options.durationMs)
+    }, idempotencyKey), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos runs <list|create|show|cancel|logs|artifacts|controls|pause|resume|emergency-stop|usage>");
+}
+async function handleTasks(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const offline = hasBooleanOption(args, "offline");
+  const queueOffline = hasBooleanOption(args, "queue-offline");
+  const dryRun = hasBooleanOption(args, "dry-run");
+  const cleanedArgs = withoutBooleanOptions(args, ["offline", "queue-offline", "dry-run"]);
+  const options = parseOptions(cleanedArgs);
+  if (subcommand === "list" || !subcommand) {
+    const query = buildQuery({
+      status: options.status,
+      project_id: options.project,
+      plan_id: options.plan,
+      assigned_to: options.assigned,
+      overdue: options.overdue,
+      ready: options.ready,
+      due_before: options.dueBefore,
+      limit: options.limit
+    });
+    printOutput(await client.listTasks(query), globals);
+    return 0;
+  }
+  if (subcommand === "show") {
+    const id = firstPositional(args);
+    if (!id)
+      throw new UsageError("Task ID is required.");
+    printOutput(await client.getTask(id), globals);
+    return 0;
+  }
+  if (subcommand === "add") {
+    const title = firstPositional(cleanedArgs);
+    if (!title)
+      throw new UsageError("Task title is required.");
+    const input2 = {
+      title,
+      description: options.description,
+      priority: options.priority,
+      project_id: options.project,
+      plan_id: options.plan,
+      assigned_to: options.assigned,
+      due_at: options.due,
+      start_after: options.startAfter,
+      recurrence_rule: options.recurrence,
+      sla_minutes: options.slaMinutes ? Number(options.slaMinutes) : undefined,
+      tags: options.tags ? options.tags.split(",").map((tag) => tag.trim()).filter(Boolean) : undefined
+    };
+    if (offline) {
+      printOutput(queuedOutput(enqueueOfflineRequest({
+        operation: "tasks.add",
+        path: "/api/tasks",
+        body: input2,
+        profile: globals.profile,
+        idempotencyKey: options.idempotencyKey ?? options.idempotency
+      })), globals);
+      return 0;
+    }
+    printOutput(await requestOrQueue({
+      client,
+      globals,
+      queueOffline,
+      operation: "tasks.add",
+      path: "/api/tasks",
+      body: input2,
+      idempotencyKey: options.idempotencyKey ?? options.idempotency,
+      execute: () => client.request("/api/tasks", {
+        method: "POST",
+        body: input2,
+        headers: idempotencyHeaders(options)
+      })
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "claim") {
+    printOutput(await client.claimTask({
+      worker: options.worker
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "start" || subcommand === "done") {
+    const id = firstPositional(cleanedArgs);
+    if (!id)
+      throw new UsageError("Task ID is required.");
+    const operation = subcommand === "start" ? "tasks.start" : "tasks.done";
+    const path = `/api/tasks/${encodeURIComponent(id)}/${subcommand === "start" ? "start" : "complete"}`;
+    if (offline) {
+      printOutput(queuedOutput(enqueueOfflineRequest({
+        operation,
+        path,
+        profile: globals.profile,
+        idempotencyKey: options.idempotencyKey ?? options.idempotency
+      })), globals);
+      return 0;
+    }
+    printOutput(await requestOrQueue({
+      client,
+      globals,
+      queueOffline,
+      operation,
+      path,
+      idempotencyKey: options.idempotencyKey ?? options.idempotency,
+      execute: () => client.request(path, {
+        method: "POST",
+        headers: idempotencyHeaders(options)
+      })
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "dependencies" || subcommand === "deps") {
+    printOutput(await client.listTaskDependencies(options.task ?? options.taskId), globals);
+    return 0;
+  }
+  if (subcommand === "depends") {
+    const taskId = options.taskId ?? firstPositional(args);
+    const dependsOnTaskId = options.dependsOnTaskId ?? secondPositional(args);
+    if (!taskId || !dependsOnTaskId)
+      throw new UsageError("Usage: platform-todos tasks depends <task-id> <depends-on-task-id> [--reason <text>]");
+    printOutput(await client.createTaskDependency({
+      taskId,
+      dependsOnTaskId,
+      reason: options.reason
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "unblock" || subcommand === "dependency-clear") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("Dependency ID is required.");
+    printOutput(await client.clearTaskDependency(id), globals);
+    return 0;
+  }
+  if (subcommand === "ready" || subcommand === "next") {
+    const taskIds = readCsvOption(options.taskIds ?? options.tasks);
+    if (taskIds.length === 0)
+      throw new UsageError("--task-ids is required.");
+    const input2 = {
+      taskIds,
+      completedTaskIds: readCsvOption(options.completedTaskIds ?? options.completed),
+      claimedTaskIds: readCsvOption(options.claimedTaskIds ?? options.claimed)
+    };
+    printOutput(subcommand === "ready" ? await client.readyTasks(input2) : await client.nextReadyTask(input2), globals);
+    return 0;
+  }
+  if (subcommand === "batch") {
+    const rawBody = options.body ?? (options.file ? readFileSync3(options.file, "utf8") : undefined);
+    if (!rawBody)
+      throw new UsageError("Batch body is required. Use --body <json> or --file <path>.");
+    const body = JSON.parse(rawBody);
+    if (!Array.isArray(body.operations))
+      throw new UsageError("Batch body must include an operations array.");
+    if (dryRun)
+      body.dryRun = true;
+    printOutput(await client.batchTasks(body, options.idempotencyKey ?? options.idempotency), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos tasks <list|show|add|claim|start|done|batch|dependencies|depends|unblock|ready|next> [--offline|--queue-offline]");
+}
+function readRunControlOptions(options) {
+  return {
+    budgetCents: readNumericOption(options.budgetCents),
+    maxRunCostCents: readNumericOption(options.maxRunCostCents),
+    maxRunDurationMs: readNumericOption(options.maxRunDurationMs),
+    maxRunToolCalls: readNumericOption(options.maxRunToolCalls),
+    ...options.paused ? { paused: options.paused === "true" } : {},
+    ...options.reason ? { pauseReason: options.reason } : {},
+    ...options.agentId ? { agentId: options.agentId } : {},
+    ...options.allowedTools ? { allowedTools: readCsvOption(options.allowedTools) } : {},
+    ...options.allowTools ? { allowedTools: readCsvOption(options.allowTools) } : {},
+    ...options.deniedTools ? { deniedTools: readCsvOption(options.deniedTools) } : {},
+    ...options.denyTools ? { deniedTools: readCsvOption(options.denyTools) } : {},
+    ...options.networkPolicy ? { networkPolicy: options.networkPolicy } : {},
+    ...options.allowedHosts ? { allowedHosts: readCsvOption(options.allowedHosts) } : {},
+    ...options.allowHosts ? { allowedHosts: readCsvOption(options.allowHosts) } : {},
+    ...options.filesystemPolicy ? { filesystemPolicy: options.filesystemPolicy } : {},
+    ...options.writablePaths ? { writablePaths: readCsvOption(options.writablePaths) } : {},
+    ...options.redactEnv ? { redactEnv: readCsvOption(options.redactEnv) } : {}
+  };
+}
+function readCsvOption(value) {
+  return value?.split(",").map((item) => item.trim()).filter(Boolean) ?? [];
+}
+function readNumericOption(value) {
+  if (!value)
+    return;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed))
+    throw new UsageError(`Expected numeric value, received: ${value}`);
+  return Math.max(0, Math.floor(parsed));
+}
+async function handleQueue(subcommand, _args, globals) {
+  const queuePath = offlineQueueFileForProfile(globals.profile);
+  if (!subcommand || subcommand === "list" || subcommand === "status") {
+    const items = readOfflineQueue(queuePath);
+    printOutput({
+      status: "ok",
+      profile: normalizeProfile(globals.profile ?? process.env.PLATFORM_TODOS_PROFILE ?? process.env.TODOS_PROFILE) ?? "default",
+      pending: items.filter((item) => item.status === "pending").length,
+      conflicts: items.filter((item) => item.status === "conflict").length,
+      items: items.map(queueItemSummary)
+    }, globals);
+    return 0;
+  }
+  if (subcommand === "sync") {
+    const result = await syncOfflineQueue({
+      client: new PlatformTodosClient(globals),
+      profile: globals.profile
+    });
+    printOutput({
+      status: result.retained.length === 0 ? "synced" : "partial",
+      synced: result.synced.length,
+      retained: result.retained.length,
+      conflicts: result.retained.filter((item) => item.status === "conflict").length,
+      items: result.retained.map(queueItemSummary)
+    }, globals);
+    return result.retained.some((item) => item.status === "conflict") ? 1 : 0;
+  }
+  if (subcommand === "clear") {
+    clearOfflineQueue(queuePath);
+    printOutput({ status: "cleared" }, globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos queue <list|sync|clear>");
+}
+async function handleNotifications(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || subcommand === "subscriptions" || !subcommand) {
+    printOutput(await client.listNotificationSubscriptions(), globals);
+    return 0;
+  }
+  if (subcommand === "create") {
+    const targetUrl = options.url ?? options.targetUrl ?? firstPositional(args);
+    if (!targetUrl)
+      throw new UsageError("Webhook target URL is required.");
+    const events = (options.events ?? "task.assigned,task.blocked,task.done,task.failed,run.completed").split(",").map((event) => event.trim()).filter(Boolean);
+    printOutput(await client.createNotificationSubscription({
+      targetUrl,
+      events,
+      ...options.secret ? { secret: options.secret } : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "disable" || subcommand === "delete") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("Notification subscription ID is required.");
+    printOutput(await client.disableNotificationSubscription(id), globals);
+    return 0;
+  }
+  if (subcommand === "deliveries" || subcommand === "dead-letters") {
+    printOutput(await client.listNotificationDeliveries(), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos notifications <list|create|disable|deliveries>");
+}
+async function handleApprovals(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || !subcommand) {
+    const query = buildQuery({
+      status: options.status,
+      runId: options.runId ?? options.run
+    });
+    printOutput(await client.listApprovals(query), globals);
+    return 0;
+  }
+  if (subcommand === "request") {
+    const reason = options.reason ?? firstPositional(args);
+    if (!reason)
+      throw new UsageError("Approval reason is required.");
+    printOutput(await client.requestApproval({
+      reason,
+      runId: options.runId ?? options.run,
+      reviewerId: options.reviewerId ?? options.reviewer,
+      checkpoint: options.checkpoint,
+      escalationTarget: options.escalationTarget ?? options.escalateTo,
+      expiresInSeconds: options.expiresInSeconds ?? options.timeoutSeconds ? Number(options.expiresInSeconds ?? options.timeoutSeconds) : undefined,
+      metadata: options.metadata ? JSON.parse(options.metadata) : undefined
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "approve" || subcommand === "reject") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("Approval ID is required.");
+    const reason = options.reason ?? secondPositional(args);
+    printOutput(subcommand === "approve" ? await client.approveApproval(id, reason) : await client.rejectApproval(id, reason), globals);
+    return 0;
+  }
+  if (subcommand === "expire") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("Approval ID is required.");
+    printOutput(await client.expireApproval(id), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos approvals <list|request|approve|reject|expire>");
+}
+async function handleActivity(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || !subcommand) {
+    printOutput(await client.listActivity(activityQuery(options)), globals);
+    return 0;
+  }
+  if (subcommand === "event" || subcommand === "record") {
+    const eventType = options.eventType ?? firstPositional(args);
+    if (!eventType)
+      throw new UsageError("Event type is required. Use: platform-todos activity event <event-type> --target-type task --target-id <id>");
+    printOutput(await client.recordActivityEvent({
+      target_type: requireOption(options, "targetType", "--target-type"),
+      target_id: requireOption(options, "targetId", "--target-id"),
+      event_type: eventType,
+      ...options.metadata ? { metadata: parseJsonObject(options.metadata, "--metadata") } : {}
+    }), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos activity <list|event>");
+}
+async function handleComments(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || !subcommand) {
+    printOutput(await client.listComments(activityQuery(options)), globals);
+    return 0;
+  }
+  if (subcommand === "add") {
+    const body = options.body ?? firstPositional(args);
+    if (!body)
+      throw new UsageError("Comment body is required. Use: platform-todos comments add --target-type task --target-id <id> --body <text>");
+    printOutput(await client.createComment({
+      target_type: requireOption(options, "targetType", "--target-type"),
+      target_id: requireOption(options, "targetId", "--target-id"),
+      body,
+      ...options.metadata ? { metadata: parseJsonObject(options.metadata, "--metadata") } : {}
+    }), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos comments <list|add>");
+}
+async function handleViews(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "list" || !subcommand) {
+    printOutput(await client.listViews(buildQuery({
+      limit: options.limit,
+      cursor: options.cursor
+    })), globals);
+    return 0;
+  }
+  if (subcommand === "create") {
+    const name = options.name ?? firstPositional(args);
+    if (!name)
+      throw new UsageError("View name is required.");
+    printOutput(await client.createView({
+      name,
+      description: options.description,
+      filter: options.filter ? parseJsonObject(options.filter, "--filter") : {}
+    }), globals);
+    return 0;
+  }
+  if (subcommand === "items") {
+    const id = options.id ?? firstPositional(args);
+    if (!id)
+      throw new UsageError("View ID is required.");
+    printOutput(await client.listViewItems(id, buildQuery({
+      limit: options.limit,
+      cursor: options.cursor
+    })), globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos views <list|create|items>");
+}
+async function handleReports(subcommand, args, globals) {
+  const kind = subcommand ?? "summary";
+  if (kind !== "summary" && kind !== "standup" && kind !== "sprint") {
+    throw new UsageError("Usage: platform-todos reports <summary|standup|sprint> [--format json|markdown]");
+  }
+  const options = parseOptions(args);
+  const result = await new PlatformTodosClient(globals).generateReport(kind, buildQuery({
+    format: options.format,
+    view_id: options.view ?? options.viewId,
+    limit: options.limit,
+    cursor: options.cursor,
+    types: options.types,
+    statuses: options.statuses,
+    labels: options.labels,
+    project_id: options.project,
+    assigned_to: options.assigned,
+    priority: options.priority,
+    ready: options.ready,
+    blocked: options.blocked,
+    overdue: options.overdue
+  }));
+  if (!globals.json && result && typeof result === "object" && result.format === "markdown") {
+    const content = result.content;
+    if (typeof content === "string") {
+      printOutput(content, globals);
+      return 0;
+    }
+  }
+  printOutput(result, globals);
+  return 0;
+}
+async function handleImport(subcommand, args, globals) {
+  const options = parseOptions(args);
+  if (subcommand === "issues") {
+    const source = options.source ?? options.provider;
+    if (!source)
+      throw new UsageError("Issue import source is required. Use --source <github|linear|jira|csv|markdown>.");
+    const organizationId2 = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+    if (!organizationId2)
+      throw new UsageError("Organization ID is required. Use --org <id>.");
+    const raw = options.file ? readFileSync3(options.file, "utf8") : options.raw;
+    const body = {
+      source,
+      dryRun: options.dryRun === "false" ? false : options.apply ? false : true,
+      conflictStrategy: options.conflictStrategy,
+      updatedSince: options.updatedSince ?? options.since,
+      ...options.origin ? { origin: parseJsonObject(options.origin, "--origin") } : {}
+    };
+    if (source === "csv" || source === "markdown") {
+      if (!raw)
+        throw new UsageError(`${source} issue imports require --file <path> or --raw <content>.`);
+      body.raw = raw;
+    } else {
+      if (!raw)
+        throw new UsageError(`${source} issue imports require --file <json> or --raw <json>.`);
+      const parsed = JSON.parse(raw);
+      body.items = Array.isArray(parsed) ? parsed : parsed.items ?? parsed.issues ?? parsed.records;
+      if (!Array.isArray(body.items))
+        throw new UsageError(`${source} issue import JSON must be an array or contain items/issues/records.`);
+    }
+    printOutput(await new PlatformTodosClient(globals).importExternalIssues({ organizationId: organizationId2, body }), globals);
+    return 0;
+  }
+  if (subcommand === "plan-markdown" || subcommand === "local-plan-markdown") {
+    const artifactPath = options.path ?? options.file ?? firstPositional(args);
+    if (!artifactPath)
+      throw new UsageError("Plan Markdown path is required. Use --path <file-or-directory>.");
+    const organizationId2 = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+    if (!organizationId2)
+      throw new UsageError("Organization ID is required. Use --org <id>.");
+    const idempotencyKey2 = options.idempotencyKey ?? options.idempotency ?? crypto.randomUUID();
+    const dryRun2 = options.dryRun === "true" || options.preview === "true";
+    const artifacts = readPlanMarkdownArtifacts(artifactPath);
+    printOutput(await new PlatformTodosClient(globals).importLocalPlanMarkdown({
+      artifacts,
+      organizationId: organizationId2,
+      idempotencyKey: idempotencyKey2,
+      dryRun: dryRun2
+    }), globals);
+    return 0;
+  }
+  if (subcommand !== "local-sqlite") {
+    throw new UsageError("Usage: platform-todos import <local-sqlite|plan-markdown|issues>");
+  }
+  const manifestPath = options.manifest ?? firstPositional(args);
+  if (!manifestPath)
+    throw new UsageError("Manifest path is required.");
+  const organizationId = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+  if (!organizationId)
+    throw new UsageError("Organization ID is required. Use --org <id>.");
+  const idempotencyKey = options.idempotencyKey ?? options.idempotency ?? crypto.randomUUID();
+  const conflictStrategy = options.conflictStrategy ?? "skip";
+  const dryRun = options.dryRun === "true" || options.preview === "true";
+  const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+  const result = await new PlatformTodosClient(globals).importLocalSqliteManifest({
+    manifest,
+    organizationId,
+    idempotencyKey,
+    conflictStrategy,
+    dryRun
+  });
+  printOutput(result, globals);
+  return 0;
+}
+function readPlanMarkdownArtifacts(inputPath) {
+  const stat = statSync(inputPath);
+  const paths = stat.isDirectory() ? readdirSync(inputPath).filter((entry) => entry.endsWith(".md")).sort().map((entry) => `${inputPath.replace(/\/$/, "")}/${entry}`) : [inputPath];
+  if (paths.length === 0)
+    throw new UsageError("No .md plan artifacts found.");
+  return paths.map((path) => ({
+    path,
+    markdown: readFileSync3(path, "utf8")
+  }));
+}
+async function handlePlans(subcommand, args, globals) {
+  const client = new PlatformTodosClient(globals);
+  const options = parseOptions(args);
+  if (subcommand === "templates" || subcommand === "list-templates" || !subcommand) {
+    const organizationId2 = options.org ?? options.organizationId;
+    printOutput(await client.listPlanTemplates(organizationId2), globals);
+    return 0;
+  }
+  if (subcommand === "list") {
+    const organizationId2 = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+    if (!organizationId2)
+      throw new UsageError("Organization ID is required. Use --org <id>.");
+    const query = options.includeArchived === "true" ? "?includeArchived=true" : "";
+    printOutput(await client.listPlans(organizationId2, query), globals);
+    return 0;
+  }
+  if (subcommand === "show") {
+    const organizationId2 = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+    if (!organizationId2)
+      throw new UsageError("Organization ID is required. Use --org <id>.");
+    const planId = options.plan ?? options.planId ?? firstPositional(args);
+    if (!planId)
+      throw new UsageError("Plan ID is required. Use: platform-todos plans show <id> --org <id>");
+    printOutput(await client.getPlan(organizationId2, planId), globals);
+    return 0;
+  }
+  if (subcommand === "update") {
+    const organizationId2 = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+    if (!organizationId2)
+      throw new UsageError("Organization ID is required. Use --org <id>.");
+    const planId = options.plan ?? options.planId ?? firstPositional(args);
+    if (!planId)
+      throw new UsageError("Plan ID is required. Use: platform-todos plans update <id> --org <id>");
+    const objective2 = options.objective ?? secondPositional(args);
+    const feedback = options.feedback ?? options.refinement;
+    if (!objective2 && !feedback) {
+      throw new UsageError("Plan update requires --objective, --feedback, or a positional objective.");
+    }
+    printOutput(await client.updatePlan(organizationId2, planId, stripUndefined({
+      objective: objective2,
+      feedback,
+      provider: options.provider,
+      model: options.model,
+      projectName: options.projectName,
+      dryRun: parseOptionalBoolean(options.dryRun),
+      approvalBeforeCreate: parseOptionalBoolean(options.approvalBeforeCreate)
+    })), globals);
+    return 0;
+  }
+  if (subcommand === "archive") {
+    const organizationId2 = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+    if (!organizationId2)
+      throw new UsageError("Organization ID is required. Use --org <id>.");
+    const planId = options.plan ?? options.planId ?? firstPositional(args);
+    if (!planId)
+      throw new UsageError("Plan ID is required. Use: platform-todos plans archive <id> --org <id>");
+    printOutput(await client.archivePlan(organizationId2, planId), globals);
+    return 0;
+  }
+  if (subcommand === "create") {
+    const templateId = options.template ?? options.templateId;
+    if (!templateId)
+      throw new UsageError("Template ID is required. Use: platform-todos plans create --template <id>");
+    const organizationId2 = options.org ?? options.organizationId;
+    printOutput(await client.createPlanFromTemplate(stripUndefined({
+      templateId,
+      title: options.title,
+      variables: options.variables ? parseJsonObject(options.variables, "--variables") : undefined
+    }), organizationId2), globals);
+    return 0;
+  }
+  if (subcommand !== "generate" && subcommand !== "refine") {
+    throw new UsageError("Usage: platform-todos plans <templates|list|show|update|archive|create|generate|refine>");
+  }
+  const organizationId = options.org ?? options.organizationId ?? resolveAuthContext(globals).stored?.organizationId;
+  if (!organizationId)
+    throw new UsageError("Organization ID is required. Use --org <id>.");
+  const objective = options.objective ?? firstPositional(args);
+  if (!objective)
+    throw new UsageError("Plan objective is required. Use --objective <text>.");
+  if (subcommand === "refine" && !(options.plan ?? options.planId ?? options.revisionOf)) {
+    throw new UsageError("Plan ID is required. Use --plan <id>.");
+  }
+  const body = stripUndefined({
+    objective,
+    provider: options.provider,
+    model: options.model,
+    projectName: options.projectName,
+    dryRun: parseOptionalBoolean(options.dryRun),
+    approvalBeforeCreate: parseOptionalBoolean(options.approvalBeforeCreate),
+    revisionOf: options.plan ?? options.planId ?? options.revisionOf,
+    refinement: options.feedback ?? options.refinement
+  });
+  printOutput(await client.generatePlan({ organizationId, body }), globals);
+  return 0;
+}
+async function handleDocs(subcommand, args, globals) {
+  if (subcommand !== "catalog" && subcommand !== "schema") {
+    throw new UsageError("Usage: platform-todos docs catalog [--surface <api|cli|mcp|sdk>] [--exposure-profile <profile>]");
+  }
+  const options = parseOptions(args);
+  printOutput(await new PlatformTodosClient(globals).docsCatalog(readDocsSurface(options.surface), options.exposureProfile), globals);
+  return 0;
+}
+function readDocsSurface(value) {
+  if (!value)
+    return;
+  if (value === "api" || value === "cli" || value === "mcp" || value === "sdk")
+    return value;
+  throw new UsageError("Docs surface must be one of: api, cli, mcp, sdk.");
+}
+function handleCompletion(shell) {
+  if (!isCompletionShell(shell)) {
+    throw new UsageError("Usage: platform-todos completion <bash|zsh|fish>");
+  }
+  console.log(renderCompletion(shell));
+  return 0;
+}
+async function handleConfig(subcommand, args, globals) {
+  if (!subcommand || subcommand === "show") {
+    const auth = resolveAuthContext(globals);
+    printOutput({
+      profile: normalizeProfile(globals.profile ?? process.env.PLATFORM_TODOS_PROFILE ?? process.env.TODOS_PROFILE) ?? "default",
+      apiUrl: auth.apiUrl,
+      apiKey: redactSecret(auth.apiKey),
+      source: auth.source,
+      authFile: auth.source === "stored" ? "configured" : "not configured"
+    }, globals);
+    return 0;
+  }
+  if (subcommand === "set") {
+    const options = parseOptions(args);
+    const authFile = authFileForProfile(globals.profile);
+    const existing = resolveAuthContext(globals).stored;
+    writeAuthConfig({
+      apiUrl: options.apiUrl ?? existing?.apiUrl ?? globals.apiUrl ?? DEFAULT_API_URL,
+      apiKey: options.apiKey ?? globals.apiKey ?? existing?.apiKey,
+      email: existing?.email,
+      organizationId: existing?.organizationId,
+      organizationSlug: existing?.organizationSlug,
+      userId: existing?.userId
+    }, authFile);
+    printOutput({ status: "configured", profile: normalizeProfile(globals.profile) ?? "default" }, globals);
+    return 0;
+  }
+  throw new UsageError("Usage: platform-todos config <show|set>");
+}
+async function handleApi(subcommand, args, globals) {
+  if (subcommand !== "get" && subcommand !== "post") {
+    throw new UsageError("Usage: platform-todos api <get|post> <path> [--body <json>]");
+  }
+  const options = parseOptions(args);
+  const path = firstPositional(args);
+  if (!path?.startsWith("/"))
+    throw new UsageError("API path must start with /.");
+  const body = options.body ? JSON.parse(options.body) : undefined;
+  printOutput(await new PlatformTodosClient(globals).request(path, {
+    method: subcommand.toUpperCase(),
+    body
+  }), globals);
+  return 0;
+}
+async function requestOrQueue(input2) {
+  try {
+    return await input2.execute();
+  } catch (error) {
+    if (input2.queueOffline && error instanceof PlatformTodosApiError && error.status === 503) {
+      return queuedOutput(enqueueOfflineRequest({
+        operation: input2.operation,
+        path: input2.path,
+        body: input2.body,
+        profile: input2.globals.profile,
+        idempotencyKey: input2.idempotencyKey
+      }));
+    }
+    throw error;
+  }
+}
+function queuedOutput(item) {
+  return {
+    status: "queued",
+    id: item.id,
+    operation: item.operation,
+    path: item.path,
+    idempotencyKey: item.idempotencyKey,
+    nextAttemptAt: item.nextAttemptAt
+  };
+}
+function queueItemSummary(item) {
+  return {
+    id: item.id,
+    operation: item.operation,
+    path: item.path,
+    status: item.status,
+    attempts: item.attempts,
+    nextAttemptAt: item.nextAttemptAt,
+    lastError: item.lastError ?? null
+  };
+}
+function idempotencyHeaders(options) {
+  const key = options.idempotencyKey ?? options.idempotency;
+  return key ? { "Idempotency-Key": key } : {};
+}
+async function createApiKeyFromSession(client, token, tenant) {
+  if (!token)
+    throw new PlatformTodosApiError("Auth verification did not return a session token", 502, null);
+  const created = await client.createApiKey(token, "platform-todos-cli", tenant);
+  if (!created.key)
+    throw new PlatformTodosApiError("API key creation did not return a key", 502, created);
+  return created.key;
+}
+function selectApiKeyIfRequested(response, options, globals) {
+  if (!readBooleanFlag(options.select) && !readBooleanFlag(options.use))
+    return response;
+  const key = readStringField(response, "key");
+  if (!key) {
+    throw new PlatformTodosApiError("API key creation did not return a key to select", 502, response);
+  }
+  const selected = selectApiKey(key, options, globals);
+  return redactApiKeyResponse(response, selected);
+}
+function selectApiKey(apiKey, options, globals) {
+  const authFile = authFileForProfile(globals.profile);
+  const stored = readAuthConfig(authFile);
+  const resolved = resolveAuthContext({ apiUrl: options.apiUrl ?? globals.apiUrl, profile: globals.profile });
+  const apiUrl = options.apiUrl ?? globals.apiUrl ?? stored?.apiUrl ?? resolved.apiUrl;
+  writeAuthConfig({
+    apiUrl,
+    apiKey,
+    email: options.email ?? stored?.email,
+    organizationId: options.organizationId ?? options.org ?? stored?.organizationId,
+    organizationSlug: options.organizationSlug ?? stored?.organizationSlug,
+    userId: options.userId ?? stored?.userId
+  }, authFile);
+  return {
+    status: "selected",
+    profile: selectedProfile(globals),
+    apiUrl,
+    apiKey: redactSecret(apiKey),
+    email: options.email ?? stored?.email ?? null,
+    organizationId: options.organizationId ?? options.org ?? stored?.organizationId ?? null,
+    organization: options.organizationSlug ?? stored?.organizationSlug ?? null
+  };
+}
+function redactApiKeyResponse(response, selected) {
+  if (!response || typeof response !== "object" || Array.isArray(response))
+    return selected;
+  const output2 = { ...response, selected };
+  const key = readStringField(response, "key");
+  if (key)
+    output2.key = redactSecret(key);
+  return output2;
+}
+function selectedProfile(globals) {
+  return normalizeProfile(globals.profile ?? process.env.PLATFORM_TODOS_PROFILE ?? process.env.TODOS_PROFILE) ?? "default";
+}
+function openBillingSessionIfRequested(response, options) {
+  if (!readBooleanFlag(options.open))
+    return response;
+  const url = readStringField(response, "url");
+  if (!url)
+    throw new PlatformTodosApiError("Billing session response did not include a URL to open", 502, response);
+  openExternalUrl(url);
+  return response && typeof response === "object" && !Array.isArray(response) ? { ...response, opened: true } : { url, opened: true };
+}
+function openExternalUrl(url) {
+  const configuredCommand = process.env.PLATFORM_TODOS_OPEN_COMMAND;
+  if (configuredCommand) {
+    execFileSync(configuredCommand, [url], { stdio: "ignore" });
+    return;
+  }
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  execFileSync(command, args, { stdio: "ignore" });
+}
+function parseArgs(argv) {
+  const globals = { json: false, nonInteractive: false };
+  const command = [];
+  for (let i = 0;i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--json" || arg === "-j")
+      globals.json = true;
+    else if (arg === "--non-interactive")
+      globals.nonInteractive = true;
+    else if (arg === "--api-url")
+      globals.apiUrl = requireValue(argv, ++i, arg);
+    else if (arg === "--api-key")
+      globals.apiKey = requireValue(argv, ++i, arg);
+    else if (arg === "--profile")
+      globals.profile = requireValue(argv, ++i, arg);
+    else
+      command.push(arg);
+  }
+  return { globals, command };
+}
+function parseOptions(args) {
+  const parsed = {};
+  for (let i = 0;i < args.length; i += 1) {
+    const arg = args[i];
+    if (!arg.startsWith("--"))
+      continue;
+    const key = camelCase(arg.slice(2));
+    if (!args[i + 1] || args[i + 1].startsWith("--")) {
+      parsed[key] = "true";
+    } else {
+      parsed[key] = requireValue(args, ++i, arg);
+    }
+  }
+  return parsed;
+}
+function firstPositional(args) {
+  for (let i = 0;i < args.length; i += 1) {
+    if (!args[i].startsWith("--"))
+      return args[i];
+    i += 1;
+  }
+  return;
+}
+function splitCsv(value) {
+  return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function secondPositional(args) {
+  let seen = 0;
+  for (let i = 0;i < args.length; i += 1) {
+    if (args[i].startsWith("--")) {
+      i += 1;
+      continue;
+    }
+    seen += 1;
+    if (seen === 2)
+      return args[i];
+  }
+  return;
+}
+function requireValue(args, index, flag) {
+  const value = args[index];
+  if (!value || value.startsWith("--"))
+    throw new UsageError(`${flag} requires a value.`);
+  return value;
+}
+function buildQuery(params) {
+  const query = new URLSearchParams;
+  for (const [key, value] of Object.entries(params)) {
+    if (value)
+      query.set(key, value);
+  }
+  const serialized = query.toString();
+  return serialized ? `?${serialized}` : "";
+}
+function splitList(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function parseOptionalBoolean(value) {
+  if (value === undefined)
+    return;
+  if (value === "true" || value === "1" || value === "yes")
+    return true;
+  if (value === "false" || value === "0" || value === "no")
+    return false;
+  throw new UsageError(`Boolean option must be true or false, received: ${value}`);
+}
+function readBooleanFlag(value) {
+  return value === "true" || value === "1" || value === "yes";
+}
+function stripUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, field]) => field !== undefined));
+}
+function activityQuery(options) {
+  return buildQuery({
+    target_type: options.targetType,
+    target_id: options.targetId,
+    kind: options.kind,
+    limit: options.limit,
+    cursor: options.cursor
+  });
+}
+function requireOption(options, key, flag) {
+  const value = options[key];
+  if (!value)
+    throw new UsageError(`${flag} is required.`);
+  return value;
+}
+function parseJsonObject(value, flag) {
+  const parsed = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new UsageError(`${flag} must be a JSON object.`);
+  }
+  return parsed;
+}
+function printOutput(data, globals) {
+  if (globals.json || typeof data !== "string") {
+    console.log(JSON.stringify(data, null, 2));
+  } else {
+    console.log(data);
+  }
+}
+function hasBooleanOption(args, name) {
+  return args.includes(`--${name}`);
+}
+function withoutBooleanOptions(args, names) {
+  const flags = new Set(names.map((name) => `--${name}`));
+  return args.filter((arg) => !flags.has(arg));
+}
+function handleError(error, globals) {
+  const status = error instanceof PlatformTodosApiError ? error.status : 1;
+  const message = error instanceof Error ? error.message : String(error);
+  if (globals.json) {
+    errorOutput.write(`${JSON.stringify({
+      error: message,
+      status,
+      ...error instanceof PlatformTodosApiError ? { body: error.body } : {}
+    }, null, 2)}
+`);
+  } else {
+    console.error(message);
+    const upgradeCommand = error instanceof PlatformTodosApiError ? readStringField(error.body, "upgradeCommand") : null;
+    const upgradeUrl = error instanceof PlatformTodosApiError ? readStringField(error.body, "upgradeUrl") : null;
+    const checkoutUrl = error instanceof PlatformTodosApiError ? readStringField(error.body, "checkoutUrl") : null;
+    if (upgradeCommand || upgradeUrl || checkoutUrl) {
+      console.error(`Upgrade: ${upgradeCommand ?? checkoutUrl ?? upgradeUrl}`);
+    }
+  }
+  return status >= 400 && status < 600 ? 1 : status;
+}
+function readStringField(value, field) {
+  if (!value || typeof value !== "object" || !(field in value))
+    return null;
+  const fieldValue = value[field];
+  return typeof fieldValue === "string" && fieldValue.trim() ? fieldValue : null;
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function camelCase(value) {
+  return value.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+function isTTY() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function prompt(question) {
+  const rl = createInterface({ input, output });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+async function promptSecret(question) {
+  output.write(question);
+  const echoDisabled = setTerminalEcho(false);
+  const rl = createInterface({ input });
+  try {
+    return (await rl.question("")).trim();
+  } finally {
+    rl.close();
+    if (echoDisabled) {
+      setTerminalEcho(true);
+    }
+    output.write(`
+`);
+  }
+}
+function setTerminalEcho(enabled) {
+  if (!isTTY())
+    return false;
+  try {
+    execFileSync("stty", [enabled ? "echo" : "-echo"], {
+      stdio: ["inherit", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+class UsageError extends Error {
+}
+if (import.meta.main) {
+  process.exitCode = await main();
+}
+export {
+  main
+};