@hexclave/cli 1.0.67 → 1.0.69

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { n as CliError, r as errorMessage$1, t as AuthError } from "./errors-CyPbl0LV.js";
 import * as Sentry from "@sentry/node";
 import "@hexclave/shared/dist/utils/env";
 import { StatusError, captureError, registerErrorSink, throwErr } from "@hexclave/shared/dist/utils/errors";
@@ -19,6 +18,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { createUrlIfValid } from "@hexclave/shared/dist/utils/urls";
 import { createTar } from "@hexclave/shared/dist/utils/tar";
+import * as zlib from "node:zlib";
 import { gzipSync } from "node:zlib";
 import { hexclaveDevEnvStatePath } from "@hexclave/shared/dist/utils/dev-env-state-path";
 import { createHash, randomBytes } from "crypto";
@@ -33,8 +33,10 @@ import { createInitPrompt } from "@hexclave/shared/dist/helpers/init-prompt";
 import { execFileSync, spawn } from "child_process";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
+import * as tar from "tar";
 import extractZip from "extract-zip";
 import { randomBytes as randomBytes$1 } from "node:crypto";
+import { KnownErrors } from "@hexclave/shared";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -129,6 +131,23 @@ function initSentry() {
 	});
 }
 //#endregion
+//#region src/lib/errors.ts
+var CliError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "CliError";
+	}
+};
+var AuthError = class extends CliError {
+	constructor(message) {
+		super(message);
+		this.name = "AuthError";
+	}
+};
+function errorMessage$1(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
 //#region src/lib/config.ts
 const ENV_CONFIG_PATH = process.env.STACK_CLI_CONFIG_PATH;
 const HEXCLAVE_CONFIG_PATH = path$1.join(os.homedir(), ".config", "hexclave", "credentials.json");
@@ -867,7 +886,7 @@ async function dashboardRequest(path, options, secret, port) {
 		throw new CliError(`Failed to reach local Hexclave dashboard at ${url}: ${errorMessage(error)}`);
 	}
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function responseErrorMessage(response) {
@@ -875,10 +894,10 @@ async function responseErrorMessage(response) {
 	if (text.length === 0) return "empty response body";
 	try {
 		const parsed = JSON.parse(text);
-		if (isRecord$1(parsed)) {
+		if (isRecord$2(parsed)) {
 			const error = parsed.error;
 			if (typeof error === "string") return error;
-			if (isRecord$1(error) && typeof error.message === "string") return error.message;
+			if (isRecord$2(error) && typeof error.message === "string") return error.message;
 		}
 	} catch {}
 	return text;
@@ -1388,6 +1407,39 @@ function isNonInteractiveEnv() {
 	return !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.NONINTERACTIVE || !process.stdin.isTTY);
 }
 //#endregion
+//#region src/lib/resolve-team.ts
+async function resolveTeam(teams, options = {}) {
+	const teamId = options.teamId?.trim();
+	if (teamId) {
+		const team = teams.find((candidate) => candidate.id === teamId);
+		if (team == null) throw new CliError(`Team '${teamId}' was not found on your account.`);
+		return team;
+	}
+	if (teams.length === 0) {
+		if (options.createTeam != null) {
+			if (isNonInteractiveEnv()) throw new CliError("No teams found. Run `hexclave team create` first, or pass --team-id.");
+			const displayName = (await input({
+				message: "Team display name:",
+				validate: (value) => value.trim().length > 0 || "Display name cannot be empty."
+			})).trim();
+			return await options.createTeam(displayName);
+		}
+		throw new CliError("No teams found. Run `hexclave team create` first.");
+	}
+	if (teams.length === 1) return teams[0];
+	if (isNonInteractiveEnv()) throw new CliError("--team-id is required in non-interactive environments (CI).");
+	const selectedTeamId = await select({
+		message: "Choose a team:",
+		choices: teams.map((team) => ({
+			name: `${team.displayName || "(unnamed)"} (${team.id})`,
+			value: team.id
+		}))
+	});
+	const selectedTeam = teams.find((team) => team.id === selectedTeamId);
+	if (selectedTeam == null) throw new CliError("The selected team was not found.");
+	return selectedTeam;
+}
+//#endregion
 //#region src/lib/create-project.ts
 var create_project_exports = /* @__PURE__ */ __exportAll({ createProjectInteractively: () => createProjectInteractively });
 async function createProjectInteractively(user, opts = {}) {
@@ -1400,14 +1452,14 @@ async function createProjectInteractively(user, opts = {}) {
 			validate: (v) => v.trim().length > 0 || "Display name cannot be empty."
 		})).trim();
 	}
-	return await withProgress("Creating project", async () => {
-		const teams = await user.listTeams();
-		if (teams.length === 0) throw new CliError(`No teams found on your account. Create a team at ${opts.dashboardUrl ?? "https://app.hexclave.com"} first.`);
-		return await user.createProject({
-			displayName,
-			teamId: teams[0].id
-		});
+	const team = await resolveTeam(await user.listTeams(), {
+		teamId: opts.teamId,
+		createTeam: async (teamDisplayName) => await user.createTeam({ displayName: teamDisplayName })
 	});
+	return await withProgress("Creating project", async () => await user.createProject({
+		displayName,
+		teamId: team.id
+	}));
 }
 //#endregion
 //#region src/commands/init.ts
@@ -1590,12 +1642,9 @@ async function writeProjectKeysToEnv(project, outputDir) {
 }
 async function handleCreateCloud(_flags, opts, outputDir) {
 	const sessionAuth = await ensureLoggedInSession();
-	const user = await withProgress("Loading account", async () => await getInternalUser(sessionAuth));
-	const { dashboardUrl } = resolveLoginConfig();
-	const newProject = await createProjectInteractively(user, {
+	const newProject = await createProjectInteractively(await withProgress("Loading account", async () => await getInternalUser(sessionAuth)), {
 		displayName: opts.displayName,
-		defaultDisplayName: path$1.basename(outputDir),
-		dashboardUrl
+		defaultDisplayName: path$1.basename(outputDir)
 	});
 	console.log(`\nCreated project: ${newProject.displayName} (${newProject.id})\n`);
 	await writeProjectKeysToEnv(newProject, outputDir);
@@ -1622,11 +1671,7 @@ async function handleLinkFromCloud(_flags, opts, outputDir) {
 			const { dashboardUrl } = resolveLoginConfig();
 			throw new CliError(`You don't own any projects. Create one at ${dashboardUrl} or re-run and choose to create one.`);
 		}
-		const { dashboardUrl } = resolveLoginConfig();
-		const newProject = await createProjectInteractively(user, {
-			defaultDisplayName: path$1.basename(outputDir),
-			dashboardUrl
-		});
+		const newProject = await createProjectInteractively(user, { defaultDisplayName: path$1.basename(outputDir) });
 		console.log(`\nCreated project: ${newProject.displayName} (${newProject.id})\n`);
 		projects = [newProject];
 		autoCreatedProjectId = newProject.id;
@@ -1741,19 +1786,17 @@ function registerProjectCommand(program) {
 		if (program.opts().json) console.log(JSON.stringify(results, null, 2));
 		else console.log(formatProjectList(results));
 	});
-	project.command("create").description("Create a new cloud project").option("--cloud", "Confirm that this creates a cloud project").option("--display-name <name>", "Project display name").action(async (opts) => {
+	project.command("create").description("Create a new cloud project").option("--cloud", "Confirm that this creates a cloud project").option("--display-name <name>", "Project display name").option("--team-id <id>", "Team that owns the project").action(async (opts) => {
 		if (!opts.cloud) throw new CliError("hexclave project create currently only creates cloud projects. Pass --cloud to confirm.");
-		const [{ getInternalUser }, { resolveLoginConfig, resolveSessionAuth }, { createProjectInteractively }] = await Promise.all([
+		const [{ getInternalUser }, { resolveSessionAuth }, { createProjectInteractively }] = await Promise.all([
 			Promise.resolve().then(() => app_exports),
 			Promise.resolve().then(() => auth_exports),
 			Promise.resolve().then(() => create_project_exports)
 		]);
 		const auth = resolveSessionAuth();
-		const user = await withProgress("Loading account", async () => await getInternalUser(auth));
-		const { dashboardUrl } = resolveLoginConfig();
-		const newProject = await createProjectInteractively(user, {
+		const newProject = await createProjectInteractively(await withProgress("Loading account", async () => await getInternalUser(auth)), {
 			displayName: opts.displayName,
-			dashboardUrl
+			teamId: opts.teamId
 		});
 		if (program.opts().json) console.log(JSON.stringify({
 			id: newProject.id,
@@ -1801,6 +1844,9 @@ const DASHBOARD_CACHE_DIR_NAME = "dashboards";
 const DASHBOARD_COMPLETE_MARKER = ".hexclave-complete";
 const LOG_PREFIX$1 = "[Hexclave] ";
 const SAFE_VERSION_REGEX = /^v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)*$/;
+function isRecord$1(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
 const MANIFEST_FETCH_TIMEOUT_MS = 1e4;
 const DASHBOARD_DOWNLOAD_TIMEOUT_MS = 5 * 6e4;
 function isAllowedDownloadUrl(url) {
@@ -1814,19 +1860,65 @@ function isAllowedDownloadUrl(url) {
 	if (parsed.protocol === "http:") return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]" || parsed.hostname === "::1";
 	return false;
 }
+const DASHBOARD_PLATFORM_KEYS = [
+	"darwin-arm64",
+	"darwin-x64",
+	"linux-arm64",
+	"linux-x64",
+	"win32-arm64",
+	"win32-x64"
+];
 function logDashboard(message) {
 	console.warn(`${LOG_PREFIX$1}${message}`);
 }
 function parseDashboardManifest(raw) {
-	if (raw == null || typeof raw !== "object") return null;
+	if (!isRecord$1(raw)) return null;
 	const manifest = raw;
 	if (typeof manifest.version !== "string" || !SAFE_VERSION_REGEX.test(manifest.version)) return null;
 	if (typeof manifest.sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(manifest.sha256)) return null;
 	if (typeof manifest.url !== "string" || !isAllowedDownloadUrl(manifest.url)) return null;
+	let platformArchives;
+	if (manifest.platformArchives != null) {
+		if (!isRecord$1(manifest.platformArchives)) return {
+			version: manifest.version,
+			sha256: manifest.sha256.toLowerCase(),
+			url: manifest.url
+		};
+		const validPlatformArchives = {};
+		for (const [platform, value] of Object.entries(manifest.platformArchives)) {
+			if (!DASHBOARD_PLATFORM_KEYS.some((supportedKey) => supportedKey === platform)) continue;
+			if (!isRecord$1(value)) continue;
+			const archive = value;
+			if (typeof archive.sha256 !== "string" || !/^[0-9a-f]{64}$/i.test(archive.sha256) || typeof archive.url !== "string" || !isAllowedDownloadUrl(archive.url)) continue;
+			validPlatformArchives[platform] = {
+				sha256: archive.sha256.toLowerCase(),
+				url: archive.url
+			};
+		}
+		if (Object.keys(validPlatformArchives).length > 0) platformArchives = validPlatformArchives;
+	}
 	return {
 		version: manifest.version,
 		sha256: manifest.sha256.toLowerCase(),
+		url: manifest.url,
+		...platformArchives == null ? {} : { platformArchives }
+	};
+}
+function dashboardPlatformKey(platform = process.platform, arch = process.arch) {
+	const key = `${platform}-${arch}`;
+	return DASHBOARD_PLATFORM_KEYS.find((supportedKey) => supportedKey === key);
+}
+function hasZstdSupport(zlibModule = zlib) {
+	return typeof zlibModule.createZstdCompress === "function" && typeof zlibModule.createZstdDecompress === "function";
+}
+function selectDashboardArchive(manifest, platformKey = dashboardPlatformKey(), zstdAvailable = hasZstdSupport()) {
+	const platformArchive = !zstdAvailable || platformKey == null ? void 0 : manifest.platformArchives?.[platformKey];
+	return platformArchive == null ? {
+		sha256: manifest.sha256,
 		url: manifest.url
+	} : {
+		...platformArchive,
+		cacheSuffix: platformKey
 	};
 }
 function dashboardDirOverride(env = process.env) {
@@ -1840,11 +1932,11 @@ function dashboardManifestUrl(env = process.env) {
 function dashboardCacheRoot() {
 	return join(dirname(devEnvStatePath()), DASHBOARD_CACHE_DIR_NAME);
 }
-function dashboardVersionDir(version) {
-	return join(dashboardCacheRoot(), version);
+function dashboardVersionDir(version, cacheSuffix) {
+	return join(dashboardCacheRoot(), cacheSuffix == null ? version : `${version}--${cacheSuffix}`);
 }
-function isDashboardCached(version) {
-	const dir = dashboardVersionDir(version);
+function isDashboardCached(version, cacheSuffix, cacheRoot = dashboardCacheRoot()) {
+	const dir = join(cacheRoot, cacheSuffix == null ? version : `${version}--${cacheSuffix}`);
 	return existsSync(join(dir, DASHBOARD_COMPLETE_MARKER)) && existsSync(join(dir, DASHBOARD_SERVER_RELATIVE_PATH));
 }
 function parseVersion(version) {
@@ -1876,10 +1968,19 @@ function isVersionNewer$1(candidate, current) {
 	if (candidate.hasPrerelease !== current.hasPrerelease) return !candidate.hasPrerelease;
 	return false;
 }
-function latestCachedDashboardVersion() {
-	const root = dashboardCacheRoot();
-	if (!existsSync(root)) return void 0;
-	return pickLatestVersion(readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isDashboardCached(entry.name)).map((entry) => entry.name));
+function latestCachedDashboard(platformKey, cacheRoot = dashboardCacheRoot()) {
+	if (!existsSync(cacheRoot)) return void 0;
+	const suffix = platformKey == null ? "" : `--${platformKey}`;
+	const cached = readdirSync(cacheRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && (platformKey == null ? !DASHBOARD_PLATFORM_KEYS.some((supportedKey) => entry.name.endsWith(`--${supportedKey}`)) : entry.name.endsWith(suffix))).map((entry) => {
+		const version = suffix.length === 0 ? entry.name : entry.name.slice(0, -suffix.length);
+		const root = join(cacheRoot, platformKey == null ? version : `${version}--${platformKey}`);
+		return isDashboardCached(version, platformKey, cacheRoot) ? {
+			version,
+			root
+		} : void 0;
+	}).filter((entry) => entry != null);
+	const version = pickLatestVersion(cached.map((entry) => entry.version));
+	return version == null ? void 0 : cached.find((entry) => entry.version === version);
 }
 async function fetchDashboardManifest(env = process.env) {
 	const url = dashboardManifestUrl(env);
@@ -1904,39 +2005,44 @@ async function sha256File(path) {
 	await pipeline(createReadStream(path), hash);
 	return hash.digest("hex");
 }
-async function downloadDashboardRelease(manifest, onProgress) {
+async function downloadDashboardRelease(manifest, archive, onProgress) {
 	const cacheRoot = dashboardCacheRoot();
 	mkdirSync(cacheRoot, { recursive: true });
 	const suffix = `${process.pid}-${randomBytes(8).toString("hex")}`;
-	const tmpZip = join(cacheRoot, `.download-${manifest.version}-${suffix}.zip`);
+	const tmpArchive = join(cacheRoot, `.download-${manifest.version}-${suffix}${archive.cacheSuffix == null ? ".zip" : ".tar.zst"}`);
 	const tmpDir = join(cacheRoot, `.extract-${manifest.version}-${suffix}`);
-	const targetDir = dashboardVersionDir(manifest.version);
+	const targetDir = dashboardVersionDir(manifest.version, archive.cacheSuffix);
 	try {
 		onProgress?.(`Downloading Hexclave dashboard ${manifest.version}`);
-		const response = await fetch(manifest.url, {
+		const response = await fetch(archive.url, {
 			redirect: "follow",
 			signal: AbortSignal.timeout(DASHBOARD_DOWNLOAD_TIMEOUT_MS)
 		});
 		if (!isAllowedDownloadUrl(response.url)) throw new CliError(`Dashboard ${manifest.version} download was redirected to a disallowed URL (${response.url}).`);
-		if (!response.ok || response.body == null) throw new CliError(`Failed to download dashboard ${manifest.version} (HTTP ${response.status}) from ${manifest.url}.`);
-		await pipeline(Readable.fromWeb(response.body), createWriteStream(tmpZip));
+		if (!response.ok || response.body == null) throw new CliError(`Failed to download dashboard ${manifest.version} (HTTP ${response.status}) from ${archive.url}.`);
+		await pipeline(Readable.fromWeb(response.body), createWriteStream(tmpArchive));
 		onProgress?.(`Verifying Hexclave dashboard ${manifest.version}`);
-		const digest = await sha256File(tmpZip);
-		if (digest !== manifest.sha256) throw new CliError(`Dashboard ${manifest.version} failed its integrity check (expected ${manifest.sha256}, got ${digest}).`);
+		const digest = await sha256File(tmpArchive);
+		if (digest !== archive.sha256) throw new CliError(`Dashboard ${manifest.version} failed its integrity check (expected ${archive.sha256}, got ${digest}).`);
 		rmSync(tmpDir, {
 			recursive: true,
 			force: true
 		});
 		mkdirSync(tmpDir, { recursive: true });
 		onProgress?.(`Extracting Hexclave dashboard ${manifest.version}`);
-		await extractZip(tmpZip, { dir: tmpDir });
+		if (archive.cacheSuffix == null) await extractZip(tmpArchive, { dir: tmpDir });
+		else await pipeline(createReadStream(tmpArchive), zlib.createZstdDecompress(), tar.x({
+			cwd: tmpDir,
+			strict: true,
+			preservePaths: false
+		}));
 		if (!existsSync(join(tmpDir, DASHBOARD_SERVER_RELATIVE_PATH))) throw new CliError(`Dashboard ${manifest.version} archive is missing its server entrypoint.`);
-		writeFileSync(join(tmpDir, DASHBOARD_COMPLETE_MARKER), `${manifest.sha256}\n`);
-		if (isDashboardCached(manifest.version)) return;
+		writeFileSync(join(tmpDir, DASHBOARD_COMPLETE_MARKER), `${archive.sha256}\n`);
+		if (isDashboardCached(manifest.version, archive.cacheSuffix)) return;
 		try {
 			renameSync(tmpDir, targetDir);
 		} catch {
-			if (isDashboardCached(manifest.version)) return;
+			if (isDashboardCached(manifest.version, archive.cacheSuffix)) return;
 			rmSync(targetDir, {
 				recursive: true,
 				force: true
@@ -1944,7 +2050,7 @@ async function downloadDashboardRelease(manifest, onProgress) {
 			renameSync(tmpDir, targetDir);
 		}
 	} finally {
-		rmSync(tmpZip, { force: true });
+		rmSync(tmpArchive, { force: true });
 		rmSync(tmpDir, {
 			recursive: true,
 			force: true
@@ -1962,35 +2068,30 @@ async function resolveDashboardRuntime(opts = {}) {
 	}
 	const manifest = opts.manifest !== void 0 ? opts.manifest : await fetchDashboardManifest();
 	if (manifest != null) {
-		if (isDashboardCached(manifest.version)) return {
-			root: dashboardVersionDir(manifest.version),
+		const archive = selectDashboardArchive(manifest);
+		if (isDashboardCached(manifest.version, archive.cacheSuffix)) return {
+			root: dashboardVersionDir(manifest.version, archive.cacheSuffix),
 			version: manifest.version
 		};
 		try {
-			await downloadDashboardRelease(manifest, opts.onProgress);
+			await downloadDashboardRelease(manifest, archive, opts.onProgress);
 			return {
-				root: dashboardVersionDir(manifest.version),
+				root: dashboardVersionDir(manifest.version, archive.cacheSuffix),
 				version: manifest.version
 			};
 		} catch (error) {
-			const cached = latestCachedDashboardVersion();
+			const cached = latestCachedDashboard(dashboardPlatformKey()) ?? latestCachedDashboard();
 			if (cached != null) {
-				logDashboard(`Failed to download dashboard ${manifest.version} (${errorMessage$1(error)}); using cached ${cached}.`);
-				return {
-					root: dashboardVersionDir(cached),
-					version: cached
-				};
+				logDashboard(`Failed to download dashboard ${manifest.version} (${errorMessage$1(error)}); using cached ${cached.version}.`);
+				return cached;
 			}
 			throw error;
 		}
 	}
-	const cached = latestCachedDashboardVersion();
+	const cached = latestCachedDashboard(dashboardPlatformKey()) ?? latestCachedDashboard();
 	if (cached != null) {
-		logDashboard(`Offline: using cached Hexclave dashboard ${cached}.`);
-		return {
-			root: dashboardVersionDir(cached),
-			version: cached
-		};
+		logDashboard(`Offline: using cached Hexclave dashboard ${cached.version}.`);
+		return cached;
 	}
 	throw new CliError(["Could not download the Hexclave development-environment dashboard and no cached copy is available.", `Check your network connection, or set ${DASHBOARD_DIR_OVERRIDE_ENV_VAR} to a local dashboard build.`].join(" "));
 }
@@ -3323,6 +3424,185 @@ function registerWhoamiCommand(program) {
 	});
 }
 //#endregion
+//#region src/commands/team.ts
+function isJson(program) {
+	return Boolean(program.opts().json);
+}
+function printResult(program, result, humanOutput) {
+	console.log(isJson(program) ? JSON.stringify(result, null, 2) : humanOutput);
+}
+async function withTeamPermissionError(operation, callback) {
+	try {
+		return await callback();
+	} catch (error) {
+		if (KnownErrors.TeamPermissionRequired.isInstance(error)) throw new CliError(`Cannot ${operation}. You do not have the required permission for this team.`);
+		throw error;
+	}
+}
+async function getTeam(user, options) {
+	return await resolveTeam(await user.listTeams(), options);
+}
+async function getUser() {
+	return await getInternalUser(resolveSessionAuth());
+}
+async function confirmDestructive(action, options) {
+	if (options.yes) return;
+	if (isNonInteractiveEnv()) throw new CliError(`--yes is required to ${action} in non-interactive environments (CI).`);
+	if (!await confirm({
+		message: `Are you sure you want to ${action}?`,
+		default: false
+	})) throw new CliError("Aborted.");
+}
+function printTeams(program, teams) {
+	const result = teams.map((team) => ({
+		id: team.id,
+		displayName: team.displayName
+	}));
+	printResult(program, result, formatTeamList(result));
+}
+function formatTeamList(teams) {
+	if (teams.length === 0) return "No teams found.";
+	return teams.map((team) => `${team.id}\t${team.displayName}`).join("\n");
+}
+function formatTeamMembers(members) {
+	if (members.length === 0) return "No team members found.";
+	return members.map((member) => `${member.id}\t${member.displayName ?? "(none)"}`).join("\n");
+}
+function printTeam(program, team, prefix) {
+	const result = {
+		id: team.id,
+		displayName: team.displayName
+	};
+	printResult(program, result, `${prefix}: ${result.id} (${result.displayName})`);
+}
+function registerTeamMembersCommand(team, program) {
+	const members = team.command("members").description("Manage team members");
+	members.command("list").description("List members of a team").option("--team-id <id>", "Team ID").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		const result = (await withTeamPermissionError("list team members", () => selectedTeam.listUsers())).map((member) => ({
+			id: member.id,
+			displayName: member.teamProfile.displayName
+		}));
+		printResult(program, result, formatTeamMembers(result));
+	});
+	members.command("remove").description("Remove a member from a team").option("--team-id <id>", "Team ID").requiredOption("--user-id <id>", "User ID to remove").option("-y, --yes", "Skip the confirmation prompt").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		await confirmDestructive(`remove user ${options.userId} from team ${selectedTeam.id}`, options);
+		await withTeamPermissionError("remove this team member", () => selectedTeam.removeUser(options.userId));
+		printResult(program, {
+			teamId: selectedTeam.id,
+			userId: options.userId
+		}, `Removed team member: ${options.userId}`);
+	});
+}
+function registerTeamInvitationsCommand(team, program) {
+	const invitations = team.command("invitations").description("Manage team invitations");
+	invitations.command("list").description("List invitations sent by a team").option("--team-id <id>", "Team ID").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		const result = (await withTeamPermissionError("list team invitations", () => selectedTeam.listInvitations())).map((invitation) => ({
+			id: invitation.id,
+			email: invitation.recipientEmail,
+			expiresAt: invitation.expiresAt.toISOString()
+		}));
+		printResult(program, result, result.length === 0 ? "No invitations found." : result.map((invitation) => `${invitation.id}\t${invitation.email ?? "(unknown)"}\t${invitation.expiresAt}`).join("\n"));
+	});
+	invitations.command("revoke").description("Revoke a team invitation").option("--team-id <id>", "Team ID").requiredOption("--invitation-id <id>", "Invitation ID").option("-y, --yes", "Skip the confirmation prompt").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		await confirmDestructive(`revoke invitation ${options.invitationId}`, options);
+		const invitation = (await withTeamPermissionError("list team invitations", () => selectedTeam.listInvitations())).find((candidate) => candidate.id === options.invitationId);
+		if (invitation == null) throw new CliError(`Invitation '${options.invitationId}' was not found for team '${selectedTeam.id}'.`);
+		await withTeamPermissionError("revoke this invitation", () => invitation.revoke());
+		printResult(program, {
+			teamId: selectedTeam.id,
+			invitationId: options.invitationId
+		}, `Invitation revoked: ${options.invitationId}`);
+	});
+	invitations.command("received").description("List invitations received by the current user").action(async () => {
+		const result = (await (await getUser()).listTeamInvitations()).map((invitation) => ({
+			id: invitation.id,
+			teamId: invitation.teamId,
+			teamDisplayName: invitation.teamDisplayName,
+			email: invitation.recipientEmail,
+			expiresAt: invitation.expiresAt.toISOString()
+		}));
+		printResult(program, result, result.length === 0 ? "No received invitations found." : result.map((invitation) => `${invitation.id}\t${invitation.teamId}\t${invitation.teamDisplayName}\t${invitation.expiresAt}`).join("\n"));
+	});
+	invitations.command("accept").description("Accept an invitation received by the current user").requiredOption("--invitation-id <id>", "Invitation ID").action(async (options) => {
+		const invitation = (await (await getUser()).listTeamInvitations()).find((candidate) => candidate.id === options.invitationId);
+		if (invitation == null) throw new CliError(`Received invitation '${options.invitationId}' was not found.`);
+		await invitation.accept();
+		printResult(program, {
+			invitationId: options.invitationId,
+			teamId: invitation.teamId
+		}, `Invitation accepted for team: ${invitation.teamId}`);
+	});
+}
+function registerTeamCommand(program) {
+	const team = program.command("team").description("Manage teams");
+	team.command("list").description("List your teams").action(async () => {
+		printTeams(program, await (await getUser()).listTeams());
+	});
+	team.command("create").description("Create a team").option("--display-name <name>", "Team display name").action(async (options) => {
+		let displayName = options.displayName?.trim();
+		if (!displayName) {
+			if (isNonInteractiveEnv()) throw new CliError("--display-name is required in non-interactive environments (CI).");
+			displayName = (await input({
+				message: "Team display name:",
+				validate: (value) => value.trim().length > 0 || "Display name cannot be empty."
+			})).trim();
+		}
+		printTeam(program, await (await getUser()).createTeam({ displayName }), "Team created");
+	});
+	registerTeamMembersCommand(team, program);
+	team.command("invite").description("Invite a user to a team").option("--team-id <id>", "Team ID").option("--email <email>", "Email address to invite").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		let email = options.email?.trim();
+		if (!email) {
+			if (isNonInteractiveEnv()) throw new CliError("--email is required in non-interactive environments (CI).");
+			email = (await input({
+				message: "Email address:",
+				validate: (value) => value.trim().length > 0 || "Email address cannot be empty."
+			})).trim();
+		}
+		await withTeamPermissionError("invite this user", () => selectedTeam.inviteUser({ email }));
+		printResult(program, {
+			teamId: selectedTeam.id,
+			email
+		}, `Invitation sent to ${email}.`);
+	});
+	registerTeamInvitationsCommand(team, program);
+	team.command("leave").description("Leave a team").option("--team-id <id>", "Team ID").option("-y, --yes", "Skip the confirmation prompt").action(async (options) => {
+		const user = await getUser();
+		const selectedTeam = await getTeam(user, options);
+		await confirmDestructive(`leave team ${selectedTeam.id}`, options);
+		await user.leaveTeam(selectedTeam);
+		printResult(program, { teamId: selectedTeam.id }, `Left team: ${selectedTeam.id}`);
+	});
+	team.command("update").description("Update a team").option("--team-id <id>", "Team ID").option("--display-name <name>", "New team display name").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		let displayName = options.displayName?.trim();
+		if (!displayName) {
+			if (isNonInteractiveEnv()) throw new CliError("--display-name is required in non-interactive environments (CI).");
+			displayName = (await input({
+				message: "New team display name:",
+				default: selectedTeam.displayName,
+				validate: (value) => value.trim().length > 0 || "Display name cannot be empty."
+			})).trim();
+		}
+		await withTeamPermissionError("update this team", () => selectedTeam.update({ displayName }));
+		printResult(program, {
+			id: selectedTeam.id,
+			displayName
+		}, `Team updated: ${selectedTeam.id} (${displayName})`);
+	});
+	team.command("delete").description("Delete a team").option("--team-id <id>", "Team ID").option("-y, --yes", "Skip the confirmation prompt").action(async (options) => {
+		const selectedTeam = await getTeam(await getUser(), options);
+		await confirmDestructive(`delete team ${selectedTeam.id}`, options);
+		await withTeamPermissionError("delete this team", () => selectedTeam.delete());
+		printResult(program, { teamId: selectedTeam.id }, `Team deleted: ${selectedTeam.id}`);
+	});
+}
+//#endregion
 //#region src/index.ts
 initSentry();
 const program = new Command();
@@ -3336,6 +3616,7 @@ registerInitCommand(program);
 registerProjectCommand(program);
 registerDevCommand(program);
 registerWhoamiCommand(program);
+registerTeamCommand(program);
 registerFixCommand(program);
 registerDoctorCommand(program);
 async function main() {