@instafy/cli 0.2.0 → 0.2.2

package/dist/cli.js

@@ -809,7 +809,7 @@ async function resolveOrg(controllerUrl, auth, options, retryCommand) {
   }
   const orgSlug = options.orgSlug?.trim() || null;
   const orgName = options.orgName?.trim() || null;
-  const studioUrl = resolveConfiguredStudioUrl({ profile: options.profile ?? null }) ?? "https://staging.instafy.dev";
+  const studioUrl = resolveConfiguredStudioUrl({ profile: options.profile ?? null }) ?? "https://instafy.dev";
   const studioOrgUrl = `${studioUrl.replace(/\/$/, "")}/studio?panel=settings`;
   const allowInteractive = Boolean(
     input2.isTTY && process.stdout.isTTY && options.json !== true && process.env.CI !== "true"
@@ -1276,7 +1276,7 @@ var org_exports = {};
 __export(org_exports, {
   listOrganizations: () => listOrganizations
 });
-import kleur15 from "kleur";
+import kleur17 from "kleur";
 function getTeamDisplayName2(name) {
   const trimmed = (name ?? "").trim();
   if (!trimmed || trimmed === "Personal organization" || trimmed === "Personal team" || trimmed === "Personal workspace") {
@@ -1314,11 +1314,11 @@ async function listOrganizations(params) {
     console.log(JSON.stringify(orgs, null, 2));
   } else {
     if (orgs.length === 0) {
-      console.log(kleur15.yellow("No teams found for this account."));
+      console.log(kleur17.yellow("No teams found for this account."));
     } else {
       for (const org of orgs) {
         const role = org.role ? ` [${org.role}]` : "";
-        console.log(`${kleur15.green(getTeamDisplayName2(org.name))} (${org.id}${role})`);
+        console.log(`${kleur17.green(getTeamDisplayName2(org.name))} (${org.id}${role})`);
       }
     }
   }
@@ -1348,9 +1348,9 @@ var init_hardwareProvider2 = __esm({
 });
 
 // ../instafy-sdk/src/hardwareNode.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import os5 from "node:os";
-import path13 from "node:path";
+import path14 from "node:path";
 function uniqueStrings(values) {
   const seen = /* @__PURE__ */ new Set();
   const result = [];
@@ -1389,14 +1389,14 @@ function classifySerialPort(fileName, fullPath) {
   return null;
 }
 function inspectPort(portPath) {
-  const resolvedPath = path13.resolve(portPath);
+  const resolvedPath = path14.resolve(portPath);
   let exists = false;
   let readable = false;
   let writable = false;
   let isCharacterDevice = false;
   let error = null;
   try {
-    const stat = fs12.statSync(resolvedPath);
+    const stat = fs13.statSync(resolvedPath);
     exists = true;
     isCharacterDevice = stat.isCharacterDevice();
   } catch (caught) {
@@ -1404,13 +1404,13 @@ function inspectPort(portPath) {
   }
   if (exists) {
     try {
-      fs12.accessSync(resolvedPath, fs12.constants.R_OK);
+      fs13.accessSync(resolvedPath, fs13.constants.R_OK);
       readable = true;
     } catch {
       readable = false;
     }
     try {
-      fs12.accessSync(resolvedPath, fs12.constants.W_OK);
+      fs13.accessSync(resolvedPath, fs13.constants.W_OK);
       writable = true;
     } catch {
       writable = false;
@@ -1432,12 +1432,12 @@ function listCandidates(scanDirs) {
   for (const scanDir of scanDirs) {
     let entries = [];
     try {
-      entries = fs12.readdirSync(scanDir);
+      entries = fs13.readdirSync(scanDir);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const fullPath = path13.join(scanDir, entry);
+      const fullPath = path14.join(scanDir, entry);
       const kind = classifySerialPort(entry, fullPath);
       if (!kind) {
         continue;
@@ -1445,7 +1445,7 @@ function listCandidates(scanDirs) {
       candidates.push({
         path: fullPath,
         kind,
-        displayName: path13.basename(fullPath)
+        displayName: path14.basename(fullPath)
       });
     }
   }
@@ -1611,37 +1611,37 @@ __export(hardware_exports, {
   hardwareSerialList: () => hardwareSerialList,
   hardwareSerialProbe: () => hardwareSerialProbe
 });
-import kleur16 from "kleur";
+import kleur18 from "kleur";
 function printSerialPorts(result) {
   if (result.ports.length === 0) {
-    console.log(kleur16.yellow("No local serial devices were discovered."));
+    console.log(kleur18.yellow("No local serial devices were discovered."));
     return;
   }
-  console.log(kleur16.cyan(`Local serial devices (${result.platform}):`));
+  console.log(kleur18.cyan(`Local serial devices (${result.platform}):`));
   for (const port of result.ports) {
-    const status = port.available ? kleur16.green("available") : kleur16.yellow("not ready");
+    const status = port.available ? kleur18.green("available") : kleur18.yellow("not ready");
     console.log(`- ${port.path} (${port.kind}, ${status})`);
   }
 }
 function printProbe(probe) {
-  console.log(kleur16.cyan(`Serial device: ${probe.path}`));
+  console.log(kleur18.cyan(`Serial device: ${probe.path}`));
   console.log(`Exists: ${probe.exists ? "yes" : "no"}`);
   console.log(`Readable: ${probe.readable ? "yes" : "no"}`);
   console.log(`Writable: ${probe.writable ? "yes" : "no"}`);
   console.log(`Character device: ${probe.isCharacterDevice ? "yes" : "no"}`);
-  console.log(`Available: ${probe.available ? kleur16.green("yes") : kleur16.yellow("no")}`);
+  console.log(`Available: ${probe.available ? kleur18.green("yes") : kleur18.yellow("no")}`);
   if (probe.error) {
     console.log(`Detail: ${probe.error}`);
   }
 }
 function printIoOpportunities(result) {
   if (result.opportunities.length === 0) {
-    console.log(kleur16.yellow("No local IO opportunities were discovered."));
+    console.log(kleur18.yellow("No local IO opportunities were discovered."));
     return;
   }
-  console.log(kleur16.cyan(`Local IO opportunities (${result.platform}):`));
+  console.log(kleur18.cyan(`Local IO opportunities (${result.platform}):`));
   for (const opportunity of result.opportunities) {
-    const status = opportunity.available ? kleur16.green("available") : kleur16.yellow("not ready");
+    const status = opportunity.available ? kleur18.green("available") : kleur18.yellow("not ready");
     console.log(`- ${opportunity.title} (${status})`);
     console.log(`  Resource: ${opportunity.resource.path}`);
     const available = opportunity.actions.filter((action) => action.status === "available").map((action) => action.id);
@@ -1655,8 +1655,8 @@ function printIoOpportunities(result) {
   }
 }
 function printIoActionResult(result) {
-  const status = result.ok ? kleur16.green("ok") : kleur16.red("failed");
-  console.log(kleur16.cyan(`Local IO action: ${result.actionId} (${status})`));
+  const status = result.ok ? kleur18.green("ok") : kleur18.red("failed");
+  console.log(kleur18.cyan(`Local IO action: ${result.actionId} (${status})`));
   console.log(result.message);
   if (result.serialProbe) {
     printProbe(result.serialProbe);
@@ -1665,11 +1665,11 @@ function printIoActionResult(result) {
     const exit = result.process.exitCode ?? result.process.signal ?? "unknown";
     console.log(`Process exit: ${exit}`);
     if (result.process.stdout.trim()) {
-      console.log(kleur16.dim("stdout:"));
+      console.log(kleur18.dim("stdout:"));
       console.log(result.process.stdout.trimEnd());
     }
     if (result.process.stderr.trim()) {
-      console.log(kleur16.dim("stderr:"));
+      console.log(kleur18.dim("stderr:"));
       console.log(result.process.stderr.trimEnd());
     }
   }
@@ -1732,7 +1732,7 @@ var init_hardware = __esm({
 import { Command, Option } from "commander";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { createRequire as createRequire3 } from "node:module";
-import kleur17 from "kleur";
+import kleur19 from "kleur";
 
 // src/runtime.ts
 import { spawn as spawn2, spawnSync } from "node:child_process";
@@ -3139,7 +3139,7 @@ async function isStudioHealthy(studioUrl, timeoutMs) {
   }
 }
 async function resolveDefaultStudioUrl(controllerUrl) {
-  const hosted = "https://staging.instafy.dev";
+  const hosted = "https://instafy.dev";
   if (isStagingCli2) {
     return hosted;
   }
@@ -3909,7 +3909,7 @@ function normalizeSecretRecord(input3) {
     }
     return out;
   };
-  const toMaybeString = (value) => {
+  const toMaybeString2 = (value) => {
     if (typeof value !== "string") {
       return null;
     }
@@ -3922,10 +3922,10 @@ function normalizeSecretRecord(input3) {
     description,
     agentIds: toStringArray(record["agentIds"]),
     agentHandles: toStringArray(record["agentHandles"]),
-    lastUsedAt: toMaybeString(record["lastUsedAt"]),
-    revokedAt: toMaybeString(record["revokedAt"]),
-    createdAt: toMaybeString(record["createdAt"]),
-    updatedAt: toMaybeString(record["updatedAt"])
+    lastUsedAt: toMaybeString2(record["lastUsedAt"]),
+    revokedAt: toMaybeString2(record["revokedAt"]),
+    createdAt: toMaybeString2(record["createdAt"]),
+    updatedAt: toMaybeString2(record["updatedAt"])
   };
 }
 function normalizeSecretList(payload) {
@@ -4160,6 +4160,8 @@ init_config();
 init_controller_fetch();
 init_errors();
 init_project_manifest();
+import fs6 from "node:fs";
+import path7 from "node:path";
 import kleur5 from "kleur";
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function normalizeUuidParam(raw) {
@@ -4253,24 +4255,25 @@ function normalizeAutomationRecord(input3) {
   if (!id || !name)
     return null;
   const toMaybeNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
-  const toMaybeString = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+  const toMaybeString2 = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
   return {
     id,
     name,
     scheduleKind: typeof record.scheduleKind === "string" ? record.scheduleKind : "",
-    runAt: toMaybeString(record.runAt),
+    runAt: toMaybeString2(record.runAt),
     intervalHours: toMaybeNumber(record.intervalHours),
     byDay: Array.isArray(record.byDay) ? record.byDay.filter((entry) => typeof entry === "string") : [],
     byHour: toMaybeNumber(record.byHour),
     byMinute: toMaybeNumber(record.byMinute),
     timezone: typeof record.timezone === "string" ? record.timezone : "UTC",
     runtimeMode: typeof record.runtimeMode === "string" ? record.runtimeMode : "auto",
-    runtimeProvider: toMaybeString(record.runtimeProvider),
+    runtimeProvider: toMaybeString2(record.runtimeProvider),
     silentWhenNothingToReport: record.silentWhenNothingToReport === true,
+    resultVisibility: record.resultVisibility === "team" ? "team" : "private",
     status: typeof record.status === "string" ? record.status : "active",
-    nextRunAt: toMaybeString(record.nextRunAt),
-    lastRunAt: toMaybeString(record.lastRunAt),
-    lastError: toMaybeString(record.lastError)
+    nextRunAt: toMaybeString2(record.nextRunAt),
+    lastRunAt: toMaybeString2(record.lastRunAt),
+    lastError: toMaybeString2(record.lastError)
   };
 }
 function listToRecords(payload) {
@@ -4369,9 +4372,10 @@ async function automationsList(options) {
     const status = record.status === "paused" ? kleur5.gray("paused") : kleur5.green("active");
     const next = record.nextRunAt ? kleur5.cyan(record.nextRunAt) : kleur5.gray("n/a");
     const delivery = record.silentWhenNothingToReport ? " \xB7 findings only" : "";
+    const sharing = record.resultVisibility === "team" ? ` \xB7 ${kleur5.cyan("team-visible")}` : "";
     console.log(`${kleur5.bold(record.name)}  ${kleur5.gray(record.id)}`);
     console.log(
-      `  ${schedule} \xB7 ${record.runtimeMode}${delivery} \xB7 ${status} \xB7 next ${next}`
+      `  ${schedule} \xB7 ${record.runtimeMode}${delivery}${sharing} \xB7 ${status} \xB7 next ${next}`
     );
     if (record.lastError) {
       console.log(`  ${kleur5.red(record.lastError)}`);
@@ -4399,6 +4403,7 @@ async function automationsCreate(options) {
     runtimeMode: options.runtimeMode ?? "auto",
     runtimeProvider: options.runtimeProvider?.trim() || void 0,
     silentWhenNothingToReport: options.silentWhenNothingToReport ?? false,
+    resultVisibility: options.resultVisibility ?? void 0,
     status: options.paused ? "paused" : "active"
   };
   if (scheduleKind === "once") {
@@ -4435,6 +4440,138 @@ async function automationsCreate(options) {
   }
   console.log(`${kleur5.green("Created")} ${kleur5.bold(record.name)} (${record.id})`);
 }
+var SCHEDULE_KINDS = /* @__PURE__ */ new Set(["weekly", "hourly", "once"]);
+var RUNTIME_MODES = /* @__PURE__ */ new Set(["auto", "hosted", "existing"]);
+var UPDATE_FIELD_FLAGS = "--name, --prompt, --prompt-file, --schedule-kind, --run-at, --interval-hours, --days, --time, --timezone, --runtime-mode, --runtime-provider, --silent-when-nothing-to-report, --no-silent-when-nothing-to-report, --share-results, --no-share-results, --result-visibility";
+function readUpdatePrompt(options, cwd) {
+  const hasPrompt = typeof options.prompt === "string";
+  const hasPromptFile = typeof options.promptFile === "string";
+  if (hasPrompt && hasPromptFile) {
+    throw new Error("Pass either --prompt or --prompt-file, not both");
+  }
+  if (hasPromptFile) {
+    const promptPath = path7.resolve(cwd, (options.promptFile ?? "").trim());
+    let raw;
+    try {
+      raw = fs6.readFileSync(promptPath, "utf8");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Unable to read --prompt-file ${promptPath}: ${message}`);
+    }
+    const promptText = raw.trim();
+    if (!promptText) {
+      throw new Error(`--prompt-file ${promptPath} is empty`);
+    }
+    return promptText;
+  }
+  if (hasPrompt) {
+    const promptText = (options.prompt ?? "").trim();
+    if (!promptText) {
+      throw new Error("--prompt must not be empty");
+    }
+    return promptText;
+  }
+  return void 0;
+}
+function buildAutomationUpdateBody(options, cwd) {
+  const body = {};
+  if (typeof options.name === "string") {
+    const name = options.name.trim();
+    if (!name) {
+      throw new Error("--name must not be empty");
+    }
+    body.name = name;
+  }
+  const promptText = readUpdatePrompt(options, cwd);
+  if (promptText !== void 0) {
+    body.promptText = promptText;
+  }
+  if (typeof options.scheduleKind === "string") {
+    const scheduleKind = options.scheduleKind.trim().toLowerCase();
+    if (!SCHEDULE_KINDS.has(scheduleKind)) {
+      throw new Error("--schedule-kind must be weekly, hourly, or once");
+    }
+    body.scheduleKind = scheduleKind;
+  }
+  if (typeof options.runAt === "string") {
+    const runAt = options.runAt.trim();
+    if (!runAt) {
+      throw new Error("--run-at must not be empty");
+    }
+    body.runAt = runAt;
+  }
+  if (options.intervalHours !== void 0) {
+    const interval = Number(options.intervalHours);
+    if (!Number.isFinite(interval) || interval < 1) {
+      throw new Error("--interval-hours must be >= 1");
+    }
+    body.intervalHours = interval;
+  }
+  if (typeof options.days === "string") {
+    body.byDay = normalizeDays(options.days);
+  }
+  if (typeof options.time === "string") {
+    const { hour, minute } = parseTime(options.time);
+    body.byHour = hour;
+    body.byMinute = minute;
+  }
+  if (typeof options.timezone === "string") {
+    const timezone = options.timezone.trim();
+    if (!timezone) {
+      throw new Error("--timezone must not be empty");
+    }
+    body.timezone = timezone;
+  }
+  if (typeof options.runtimeMode === "string") {
+    const runtimeMode = options.runtimeMode.trim().toLowerCase();
+    if (!RUNTIME_MODES.has(runtimeMode)) {
+      throw new Error("--runtime-mode must be auto, hosted, or existing");
+    }
+    body.runtimeMode = runtimeMode;
+  }
+  if (typeof options.runtimeProvider === "string") {
+    const runtimeProvider = options.runtimeProvider.trim();
+    if (!runtimeProvider) {
+      throw new Error("--runtime-provider must not be empty");
+    }
+    body.runtimeProvider = runtimeProvider;
+  }
+  if (typeof options.silentWhenNothingToReport === "boolean") {
+    body.silentWhenNothingToReport = options.silentWhenNothingToReport;
+  }
+  if (options.resultVisibility !== void 0) {
+    body.resultVisibility = options.resultVisibility;
+  }
+  return body;
+}
+async function automationsUpdate(options) {
+  const automationId = normalizeUuidParam(options.automationId);
+  if (!automationId) {
+    throw new Error("automationId must be a UUID");
+  }
+  const cwd = options.cwd ?? process.cwd();
+  const body = buildAutomationUpdateBody(options, cwd);
+  if (Object.keys(body).length === 0) {
+    throw new Error(`Nothing to update. Pass at least one of ${UPDATE_FIELD_FLAGS}.`);
+  }
+  const auth = resolveControllerAuth2(options, "instafy login");
+  const payload = await controllerJsonRequest2(auth, "instafy login", {
+    method: "PATCH",
+    path: `/automations/${automationId}`,
+    body
+  });
+  if (options.json) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  const record = normalizeAutomationRecord(payload);
+  if (!record) {
+    console.log(kleur5.green("Automation updated."));
+    return;
+  }
+  const sharing = record.resultVisibility === "team" ? " \xB7 results shared with the team" : record.resultVisibility === "private" ? " \xB7 results kept private" : "";
+  console.log(`${kleur5.green("Updated")} ${kleur5.bold(record.name)} (${record.id})${sharing}`);
+}
 async function automationsUpdateStatus(options) {
   const auth = resolveControllerAuth2(options, "instafy login");
   const automationId = normalizeUuidParam(options.automationId);
@@ -4485,13 +4622,375 @@ async function automationsDelete(options) {
   console.log(kleur5.green("Deleted."));
 }
 
+// src/credentials.ts
+init_config();
+init_controller_fetch();
+init_errors();
+import kleur6 from "kleur";
+var promptsModule2 = null;
+async function loadPrompts2() {
+  promptsModule2 ??= import("@clack/prompts");
+  return promptsModule2;
+}
+var RETRY_COMMAND = "instafy login";
+var SHORT_ID_LENGTH = 8;
+var TEST_OUTPUT_PREVIEW_CHARS = 300;
+var CREDENTIAL_TEST_TIMEOUT_MS = 9e4;
+function resolveControllerAuth3(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const controllerUrl = resolveControllerUrl({
+    controllerUrl: options.controllerUrl ?? null,
+    cwd
+  });
+  const resolved = resolveUserAccessTokenWithSource({
+    accessToken: options.accessToken ?? null,
+    cwd
+  });
+  if (!resolved.token) {
+    throw formatAuthRequiredError({
+      retryCommand: RETRY_COMMAND,
+      advancedHint: "pass --access-token, or set INSTAFY_ACCESS_TOKEN / SUPABASE_ACCESS_TOKEN"
+    });
+  }
+  return {
+    controllerUrl,
+    accessToken: resolved.token,
+    tokenSource: resolved.source,
+    profile: resolved.profile,
+    cwd
+  };
+}
+async function controllerJsonRequest3(auth, params) {
+  const url = `${auth.controllerUrl.replace(/\/$/, "")}${params.path}`;
+  const headers = new Headers();
+  headers.set("accept", "application/json");
+  const init = { method: params.method, headers };
+  if (params.timeoutMs !== void 0) {
+    init.signal = AbortSignal.timeout(params.timeoutMs);
+  }
+  const response = (await fetchWithControllerAuth({
+    url,
+    init,
+    accessToken: auth.accessToken,
+    tokenSource: auth.tokenSource,
+    profile: auth.profile,
+    cwd: auth.cwd
+  })).response;
+  const text = await response.text().catch(() => "");
+  if (response.status === 401 || response.status === 403) {
+    throw formatAuthRejectedError({
+      status: response.status,
+      responseBody: text,
+      retryCommand: RETRY_COMMAND,
+      advancedHint: "run `instafy login`, or pass --access-token"
+    });
+  }
+  if (!response.ok) {
+    throw new Error(`Request failed (${response.status} ${response.statusText}): ${text}`);
+  }
+  return text ? JSON.parse(text) : null;
+}
+function credentialTestTimeoutMs() {
+  const configured = Number(process.env["INSTAFY_HTTP_TIMEOUT_MS"]);
+  const base = Number.isFinite(configured) && configured > 0 ? configured : 0;
+  return Math.max(base, CREDENTIAL_TEST_TIMEOUT_MS);
+}
+function toMaybeString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function normalizeCredentialRecord(input3) {
+  if (!input3 || typeof input3 !== "object")
+    return null;
+  const record = input3;
+  const id = toMaybeString(record.id);
+  if (!id)
+    return null;
+  const metadata = record.metadata && typeof record.metadata === "object" ? record.metadata : {};
+  return {
+    id,
+    kind: toMaybeString(record.kind) ?? "unknown",
+    label: toMaybeString(record.label),
+    provider: toMaybeString(metadata.provider),
+    defaultModel: toMaybeString(metadata.default_model),
+    isDefault: record.isDefault === true,
+    lastUsedAt: toMaybeString(record.lastUsedAt),
+    revokedAt: toMaybeString(record.revokedAt),
+    createdAt: toMaybeString(record.createdAt),
+    updatedAt: toMaybeString(record.updatedAt)
+  };
+}
+function listToRecords2(payload) {
+  if (!Array.isArray(payload))
+    return [];
+  const out = [];
+  for (const item of payload) {
+    const normalized = normalizeCredentialRecord(item);
+    if (normalized)
+      out.push(normalized);
+  }
+  return out;
+}
+function normalizeTestResult(payload) {
+  const record = payload && typeof payload === "object" ? payload : {};
+  const elapsed = record.elapsedMs;
+  return {
+    ok: record.ok === true,
+    provider: toMaybeString(record.provider),
+    model: toMaybeString(record.model),
+    output: typeof record.output === "string" ? record.output : null,
+    upstreamEndpoint: toMaybeString(record.upstreamEndpoint),
+    elapsedMs: typeof elapsed === "number" && Number.isFinite(elapsed) ? elapsed : null
+  };
+}
+async function fetchCredentialRecords(auth) {
+  const payload = await controllerJsonRequest3(auth, {
+    method: "GET",
+    path: "/me/credentials"
+  });
+  return listToRecords2(payload);
+}
+function shortCredentialId(id) {
+  return id.slice(0, SHORT_ID_LENGTH);
+}
+function describeCredential(record) {
+  const parts = [shortCredentialId(record.id), record.kind];
+  if (record.provider)
+    parts.push(record.provider);
+  if (record.label)
+    parts.push(`"${record.label}"`);
+  if (record.revokedAt)
+    parts.push("revoked");
+  return parts.join(" \xB7 ");
+}
+function resolveCredentialRecord(records, idOrPrefix) {
+  const needle = idOrPrefix.trim().toLowerCase();
+  if (!needle) {
+    throw new Error("Credential id is required. Run `instafy credentials list` to see ids.");
+  }
+  const exact = records.find((record) => record.id.toLowerCase() === needle);
+  if (exact)
+    return exact;
+  const matches = records.filter((record) => record.id.toLowerCase().startsWith(needle));
+  const active = matches.filter((record) => !record.revokedAt);
+  if (active.length === 1) {
+    return active[0];
+  }
+  if (active.length > 1) {
+    const candidates = active.map((record) => `  ${describeCredential(record)}`).join("\n");
+    throw new Error(
+      `Credential id prefix "${idOrPrefix}" is ambiguous; it matches ${active.length} credentials:
+${candidates}
+
+Use a longer prefix or the full id.`
+    );
+  }
+  if (matches.length > 0) {
+    throw new Error(
+      `Credential "${idOrPrefix}" only matches revoked credentials. Run \`instafy credentials list --all\` to see them.`
+    );
+  }
+  throw new Error(
+    `No credential matches "${idOrPrefix}". Run \`instafy credentials list\` to see ids.`
+  );
+}
+async function resolveCredential(auth, idOrPrefix) {
+  const records = await fetchCredentialRecords(auth);
+  return resolveCredentialRecord(records, idOrPrefix);
+}
+async function resolveActiveCredential(auth, idOrPrefix, action) {
+  const record = await resolveCredential(auth, idOrPrefix);
+  if (record.revokedAt) {
+    throw new Error(
+      `Credential ${describeCredential(record)} is revoked and cannot be ${action}. Run \`instafy credentials list\` to see active ids.`
+    );
+  }
+  return record;
+}
+function formatTimestamp(value) {
+  if (!value)
+    return "never";
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime()))
+    return value;
+  return `${parsed.toISOString().slice(0, 16).replace("T", " ")}Z`;
+}
+function truncateOutput(output2, limit) {
+  const singleLine = output2.replace(/\s+/g, " ").trim();
+  if (singleLine.length <= limit)
+    return singleLine;
+  return `${singleLine.slice(0, limit)}\u2026`;
+}
+function renderTable(headers, rows) {
+  const widths = headers.map(
+    (header, index) => Math.max(header.length, ...rows.map((row) => row[index]?.length ?? 0))
+  );
+  const line = (cells) => cells.map((cell, index) => cell.padEnd(widths[index])).join("  ").trimEnd();
+  return [kleur6.bold(line(headers)), ...rows.map(line)].join("\n");
+}
+async function credentialsList(options) {
+  const auth = resolveControllerAuth3(options);
+  const records = await fetchCredentialRecords(auth);
+  const visible = options.all ? records : records.filter((record) => !record.revokedAt);
+  const hiddenRevoked = records.length - visible.length;
+  if (options.json) {
+    console.log(JSON.stringify(visible, null, 2));
+    return;
+  }
+  if (visible.length === 0) {
+    console.log(kleur6.gray(records.length === 0 ? "No credentials." : "No active credentials."));
+    if (hiddenRevoked > 0) {
+      console.log(kleur6.gray(`${hiddenRevoked} revoked hidden (use --all to show).`));
+    }
+    return;
+  }
+  const rows = visible.map((record) => [
+    shortCredentialId(record.id),
+    record.kind,
+    record.provider ?? "-",
+    record.defaultModel ?? "-",
+    record.label ?? "-",
+    record.isDefault ? "*" : "",
+    formatTimestamp(record.lastUsedAt),
+    record.revokedAt ? formatTimestamp(record.revokedAt) : ""
+  ]);
+  console.log(
+    renderTable(
+      ["ID", "KIND", "PROVIDER", "MODEL", "LABEL", "DEFAULT", "LAST USED", "REVOKED"],
+      rows
+    )
+  );
+  if (hiddenRevoked > 0) {
+    console.log(kleur6.gray(`${hiddenRevoked} revoked hidden (use --all to show).`));
+  }
+  if (!visible.some((record) => record.isDefault && !record.revokedAt)) {
+    console.log(
+      kleur6.yellow(
+        "No default credential. Jobs cannot pick one automatically; run `instafy credentials default <id>`."
+      )
+    );
+  }
+}
+async function credentialsTest(options) {
+  const auth = resolveControllerAuth3(options);
+  const record = await resolveActiveCredential(auth, options.idOrPrefix, "tested");
+  if (!options.json) {
+    console.log(
+      kleur6.gray(
+        `Testing ${describeCredential(record)} through the proxy (this calls the upstream provider and may take up to a minute)\u2026`
+      )
+    );
+  }
+  const payload = await controllerJsonRequest3(auth, {
+    method: "POST",
+    path: `/me/credentials/${encodeURIComponent(record.id)}/test`,
+    timeoutMs: credentialTestTimeoutMs()
+  });
+  const result = normalizeTestResult(payload);
+  if (options.json) {
+    console.log(JSON.stringify({ credentialId: record.id, ...result }, null, 2));
+    return result;
+  }
+  const status = result.ok ? kleur6.green("ok") : kleur6.red("failed");
+  console.log(`${status}  ${shortCredentialId(record.id)}`);
+  console.log(`  provider ${result.provider ?? "-"} \xB7 model ${result.model ?? "-"}`);
+  if (result.upstreamEndpoint) {
+    console.log(`  upstream ${result.upstreamEndpoint}`);
+  }
+  if (result.elapsedMs !== null) {
+    console.log(`  elapsed ${result.elapsedMs} ms`);
+  }
+  if (result.output) {
+    const preview = truncateOutput(result.output, TEST_OUTPUT_PREVIEW_CHARS);
+    console.log(`  output ${result.ok ? preview : kleur6.red(preview)}`);
+  }
+  return result;
+}
+async function credentialsSetDefault(options) {
+  const auth = resolveControllerAuth3(options);
+  const record = await resolveActiveCredential(auth, options.idOrPrefix, "made the default");
+  const payload = await controllerJsonRequest3(auth, {
+    method: "POST",
+    path: `/me/credentials/${encodeURIComponent(record.id)}/default`
+  });
+  const response = payload && typeof payload === "object" ? payload : {};
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          credentialId: toMaybeString(response.credentialId) ?? record.id,
+          kind: toMaybeString(response.kind) ?? record.kind,
+          isDefault: response.isDefault !== false
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`${kleur6.green("Default set:")} ${describeCredential(record)}`);
+}
+async function credentialsClearDefault(options) {
+  const auth = resolveControllerAuth3(options);
+  await controllerJsonRequest3(auth, {
+    method: "DELETE",
+    path: "/me/credentials/default"
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, hasDefaultCredential: false }, null, 2));
+    return;
+  }
+  console.log(kleur6.green("Default cleared."));
+  console.log(kleur6.gray("Jobs will not pick a credential automatically until you set a new default."));
+}
+async function confirmRevoke(record, json) {
+  const interactive = Boolean(
+    process.stdin.isTTY && process.stdout.isTTY && json !== true && process.env.CI !== "true"
+  );
+  if (!interactive) {
+    throw new Error(
+      `Refusing to revoke ${describeCredential(record)} without confirmation. Re-run with --yes.`
+    );
+  }
+  const { confirm, isCancel } = await loadPrompts2();
+  console.log(kleur6.yellow(`Revoke ${describeCredential(record)} (${record.id})?`));
+  console.log(kleur6.gray("Agents bound to this credential are disconnected and jobs stop using it."));
+  const answer = await confirm({ message: "Revoke this credential?", initialValue: false });
+  if (isCancel(answer) || !answer) {
+    throw new Error("Cancelled.");
+  }
+}
+async function credentialsRevoke(options) {
+  const auth = resolveControllerAuth3(options);
+  const record = await resolveActiveCredential(auth, options.idOrPrefix, "revoked again");
+  if (!options.yes) {
+    await confirmRevoke(record, options.json);
+  }
+  await controllerJsonRequest3(auth, {
+    method: "DELETE",
+    path: `/me/credentials/${encodeURIComponent(record.id)}`
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, credentialId: record.id }, null, 2));
+    return;
+  }
+  console.log(`${kleur6.green("Revoked:")} ${describeCredential(record)}`);
+  if (record.isDefault) {
+    console.log(
+      kleur6.yellow(
+        "This was the default credential. Set a new one with `instafy credentials default <id>`."
+      )
+    );
+  }
+}
+
 // src/tunnel.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 import os4 from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import kleur6 from "kleur";
+import kleur7 from "kleur";
 init_config();
 init_errors();
 init_controller_fetch();
@@ -4551,10 +5050,10 @@ function resolveRuntimeBoundControllerUrl(credential, selectedControllerUrl) {
 }
 
 // src/tunnel.ts
-var INSTAFY_DIR3 = path7.join(os4.homedir(), ".instafy");
-var TUNNEL_STATE_FILE = path7.join(INSTAFY_DIR3, "cli-tunnel-state.json");
-var TUNNEL_LOG_DIR = path7.join(INSTAFY_DIR3, "cli-tunnel-logs");
-var TUNNEL_WORKDIR_DIR = path7.join(INSTAFY_DIR3, "cli-tunnel-workdirs");
+var INSTAFY_DIR3 = path8.join(os4.homedir(), ".instafy");
+var TUNNEL_STATE_FILE = path8.join(INSTAFY_DIR3, "cli-tunnel-state.json");
+var TUNNEL_LOG_DIR = path8.join(INSTAFY_DIR3, "cli-tunnel-logs");
+var TUNNEL_WORKDIR_DIR = path8.join(INSTAFY_DIR3, "cli-tunnel-workdirs");
 var RATHOLE_ENVIRONMENT_KEYS = [
   "PATH",
   "HOME",
@@ -4636,7 +5135,7 @@ function resolveProject(opts) {
   );
 }
 function writeProjectManifest(manifestPath, manifest) {
-  fs6.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
+  fs7.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
 }
 function resolveTunnelAlias(opts, projectId) {
   const name = normalizeTunnelPurpose(opts.name?.trim() ?? "") ?? "web";
@@ -4678,7 +5177,7 @@ function persistTunnelAliasResult(config, hostname, url) {
   if (!config.manifestPath)
     return;
   try {
-    const raw = fs6.readFileSync(config.manifestPath, "utf8");
+    const raw = fs7.readFileSync(config.manifestPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed?.tunnels || typeof parsed.tunnels !== "object") {
       return;
@@ -4752,7 +5251,7 @@ function resolvePort(opts) {
   return opts.port ?? (Number.isFinite(parsedEnv) ? parsedEnv : 3e3);
 }
 function ensureDir(dir) {
-  fs6.mkdirSync(dir, { recursive: true });
+  fs7.mkdirSync(dir, { recursive: true });
 }
 function safePathSegment(value) {
   const trimmed = value.trim();
@@ -4762,15 +5261,15 @@ function safePathSegment(value) {
 }
 function writeStateFile(state) {
   ensureDir(INSTAFY_DIR3);
-  fs6.writeFileSync(TUNNEL_STATE_FILE, JSON.stringify(state, null, 2), "utf8");
+  fs7.writeFileSync(TUNNEL_STATE_FILE, JSON.stringify(state, null, 2), "utf8");
   try {
-    fs6.chmodSync(TUNNEL_STATE_FILE, 384);
+    fs7.chmodSync(TUNNEL_STATE_FILE, 384);
   } catch {
   }
 }
 function readStateFile() {
   try {
-    const raw = fs6.readFileSync(TUNNEL_STATE_FILE, "utf8");
+    const raw = fs7.readFileSync(TUNNEL_STATE_FILE, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object")
       return { version: 1, tunnels: [] };
@@ -4934,8 +5433,8 @@ async function startTunnelSession(opts) {
     env: process.env,
     version: process.env.RATHOLE_VERSION ?? null,
     cacheDir: process.env.RATHOLE_CACHE_DIR ?? null,
-    logger: (message) => console.log(kleur6.cyan(`[rathole] ${message}`)),
-    warn: (message) => console.warn(kleur6.yellow(message))
+    logger: (message) => console.log(kleur7.cyan(`[rathole] ${message}`)),
+    warn: (message) => console.warn(kleur7.yellow(message))
   });
   if (!rathole) {
     throw new Error(
@@ -4947,9 +5446,9 @@ async function startTunnelSession(opts) {
   persistTunnelAliasResult(alias, grant.hostname, grant.url ?? `https://${grant.hostname}`);
   const creds = grant.credentials && typeof grant.credentials === "object" ? grant.credentials : {};
   const configBody = buildRatholeConfig(creds, port);
-  const workdir = fs6.mkdtempSync(path7.join(os4.tmpdir(), "instafy-cli-tunnel-"));
-  const configPath2 = path7.join(workdir, "rathole.toml");
-  fs6.writeFileSync(configPath2, configBody, { encoding: "utf8", mode: 384 });
+  const workdir = fs7.mkdtempSync(path8.join(os4.tmpdir(), "instafy-cli-tunnel-"));
+  const configPath2 = path8.join(workdir, "rathole.toml");
+  fs7.writeFileSync(configPath2, configBody, { encoding: "utf8", mode: 384 });
   const child = spawn3(rathole, ["-c", configPath2], {
     stdio: "inherit",
     cwd: workdir,
@@ -4961,11 +5460,11 @@ async function startTunnelSession(opts) {
     cleanedUp = true;
     child.kill("SIGTERM");
     await revokeTunnel(controllerUrl, controllerToken, projectId, grant.tunnelId);
-    fs6.rmSync(workdir, { recursive: true, force: true });
+    fs7.rmSync(workdir, { recursive: true, force: true });
   };
   child.on("exit", () => {
     void cleanup().catch((error) => {
-      console.warn(kleur6.yellow(`Tunnel cleanup failed: ${String(error)}`));
+      console.warn(kleur7.yellow(`Tunnel cleanup failed: ${String(error)}`));
     });
   });
   return {
@@ -4978,7 +5477,7 @@ async function startTunnelSession(opts) {
 async function runTunnelCommand(opts, options) {
   const session = await startTunnelSession(opts);
   console.log(
-    kleur6.green(`Tunnel ready: ${session.url} (tunnelId=${session.tunnelId})`)
+    kleur7.green(`Tunnel ready: ${session.url} (tunnelId=${session.tunnelId})`)
   );
   const timeoutMs = options?.timeoutMs ?? null;
   await new Promise((resolve) => {
@@ -5012,8 +5511,8 @@ async function startTunnelDetached(opts) {
     env: process.env,
     version: process.env.RATHOLE_VERSION ?? null,
     cacheDir: process.env.RATHOLE_CACHE_DIR ?? null,
-    logger: (message) => console.log(kleur6.cyan(`[rathole] ${message}`)),
-    warn: (message) => console.warn(kleur6.yellow(message))
+    logger: (message) => console.log(kleur7.cyan(`[rathole] ${message}`)),
+    warn: (message) => console.warn(kleur7.yellow(message))
   });
   if (!rathole) {
     throw new Error(
@@ -5026,14 +5525,14 @@ async function startTunnelDetached(opts) {
   ensureDir(TUNNEL_WORKDIR_DIR);
   ensureDir(TUNNEL_LOG_DIR);
   const tunnelIdSafe = safePathSegment(grant.tunnelId);
-  const workdir = path7.join(TUNNEL_WORKDIR_DIR, tunnelIdSafe);
+  const workdir = path8.join(TUNNEL_WORKDIR_DIR, tunnelIdSafe);
   ensureDir(workdir);
   const creds = grant.credentials && typeof grant.credentials === "object" ? grant.credentials : {};
   const configBody = buildRatholeConfig(creds, port);
-  const configPath2 = path7.join(workdir, "rathole.toml");
-  fs6.writeFileSync(configPath2, configBody, { encoding: "utf8", mode: 384 });
-  const logFile = opts.logFile?.trim() ? path7.resolve(opts.logFile.trim()) : path7.join(TUNNEL_LOG_DIR, `tunnel-${tunnelIdSafe}.log`);
-  const logFd = fs6.openSync(logFile, "a");
+  const configPath2 = path8.join(workdir, "rathole.toml");
+  fs7.writeFileSync(configPath2, configBody, { encoding: "utf8", mode: 384 });
+  const logFile = opts.logFile?.trim() ? path8.resolve(opts.logFile.trim()) : path8.join(TUNNEL_LOG_DIR, `tunnel-${tunnelIdSafe}.log`);
+  const logFd = fs7.openSync(logFile, "a");
   const child = spawn3(rathole, ["-c", configPath2], {
     stdio: ["ignore", logFd, logFd],
     cwd: workdir,
@@ -5050,7 +5549,7 @@ async function startTunnelDetached(opts) {
   if (exitedEarly || !isProcessAlive2(child.pid ?? -1)) {
     const logTail = (() => {
       try {
-        const text = fs6.readFileSync(logFile, "utf8");
+        const text = fs7.readFileSync(logFile, "utf8");
         const lines = text.split(/\r?\n/).filter(Boolean);
         return lines.slice(-20).join("\n");
       } catch {
@@ -5133,7 +5632,7 @@ async function stopTunnelSession(opts) {
     throw error;
   }
   try {
-    fs6.rmSync(entry.workdir, { recursive: true, force: true });
+    fs7.rmSync(entry.workdir, { recursive: true, force: true });
   } catch {
   }
   return { ok: true, tunnelId: entry.tunnelId };
@@ -5165,7 +5664,7 @@ async function tailTunnelLogs(options) {
     return;
   }
   if (!follow) {
-    const raw = fs6.existsSync(logFile) ? fs6.readFileSync(logFile, "utf8") : "";
+    const raw = fs7.existsSync(logFile) ? fs7.readFileSync(logFile, "utf8") : "";
     const rows = raw.split(/\r?\n/);
     const tail = rows.slice(Math.max(0, rows.length - lineCount));
     console.log(tail.join("\n"));
@@ -5194,7 +5693,7 @@ async function tailTunnelLogs(options) {
 // src/config-command.ts
 init_config();
 init_config();
-import kleur7 from "kleur";
+import kleur8 from "kleur";
 function normalizeKey(raw) {
   const key = raw.trim().toLowerCase().replace(/_/g, "-");
   if (key === "controller-url" || key === "controllerurl" || key === "server-url") {
@@ -5238,12 +5737,12 @@ function clearConfig(key) {
   }
 }
 function configPath(options) {
-  const path14 = getInstafyConfigPath();
+  const path15 = getInstafyConfigPath();
   if (options?.json) {
-    console.log(JSON.stringify({ path: path14 }, null, 2));
+    console.log(JSON.stringify({ path: path15 }, null, 2));
     return;
   }
-  console.log(path14);
+  console.log(path15);
 }
 function configList(options) {
   const config = readInstafyCliConfig();
@@ -5260,13 +5759,13 @@ function configList(options) {
     console.log(JSON.stringify(payload, null, 2));
     return;
   }
-  console.log(kleur7.green("Instafy CLI config"));
+  console.log(kleur8.green("Instafy CLI config"));
   console.log(`Path: ${payload.path}`);
-  console.log(`controller-url: ${payload.controllerUrl ?? kleur7.yellow("(not set)")}`);
+  console.log(`controller-url: ${payload.controllerUrl ?? kleur8.yellow("(not set)")}`);
   console.log(`controller-url (effective): ${payload.effectiveControllerUrl}`);
-  console.log(`studio-url: ${payload.studioUrl ?? kleur7.yellow("(not set)")}`);
-  console.log(`access-token: ${payload.accessTokenSet ? kleur7.green("(set)") : kleur7.yellow("(not set)")}`);
-  console.log(`refresh-token: ${payload.refreshTokenSet ? kleur7.green("(set)") : kleur7.yellow("(not set)")}`);
+  console.log(`studio-url: ${payload.studioUrl ?? kleur8.yellow("(not set)")}`);
+  console.log(`access-token: ${payload.accessTokenSet ? kleur8.green("(set)") : kleur8.yellow("(not set)")}`);
+  console.log(`refresh-token: ${payload.refreshTokenSet ? kleur8.green("(set)") : kleur8.yellow("(not set)")}`);
   if (payload.updatedAt) {
     console.log(`updated-at: ${payload.updatedAt}`);
   }
@@ -5295,7 +5794,7 @@ function configSet(params) {
     console.log(JSON.stringify({ key, value, path: getInstafyConfigPath() }, null, 2));
     return;
   }
-  console.log(kleur7.green(`Set ${key}`));
+  console.log(kleur8.green(`Set ${key}`));
   console.log(value);
 }
 function configUnset(params) {
@@ -5305,7 +5804,7 @@ function configUnset(params) {
     console.log(JSON.stringify({ ok: true, key }, null, 2));
     return;
   }
-  console.log(kleur7.green(`Unset ${key}`));
+  console.log(kleur8.green(`Unset ${key}`));
 }
 
 // src/index.ts
@@ -5314,28 +5813,28 @@ init_config();
 // src/git-wrapper.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs7 from "node:fs";
-import path8 from "node:path";
-import kleur8 from "kleur";
+import fs8 from "node:fs";
+import path9 from "node:path";
+import kleur9 from "kleur";
 function pathExists(candidate) {
   try {
-    fs7.statSync(candidate);
+    fs8.statSync(candidate);
     return true;
   } catch {
     return false;
   }
 }
 function findInstafyGitContext(startDir) {
-  let current = path8.resolve(startDir);
-  const root = path8.parse(current).root;
+  let current = path9.resolve(startDir);
+  const root = path9.parse(current).root;
   while (true) {
-    const gitDir = path8.join(current, ".instafy", ".git");
+    const gitDir = path9.join(current, ".instafy", ".git");
     if (pathExists(gitDir)) {
       return { workTree: current, gitDir };
     }
     if (current === root)
       break;
-    current = path8.dirname(current);
+    current = path9.dirname(current);
   }
   return null;
 }
@@ -5382,9 +5881,9 @@ function validateGitArgs(userArgs) {
     }
     if (arg === "--git-dir" || arg.startsWith("--git-dir=") || arg === "--work-tree" || arg.startsWith("--work-tree=") || arg === "-C") {
       throw new Error(
-        `Unsupported argument "${arg}". Use ${kleur8.cyan(
+        `Unsupported argument "${arg}". Use ${kleur9.cyan(
           "cd"
-        )} instead; ${kleur8.cyan("instafy git")} manages --git-dir/--work-tree automatically.`
+        )} instead; ${kleur9.cyan("instafy git")} manages --git-dir/--work-tree automatically.`
       );
     }
     if (arg === "-c" || arg === "--config-env" || arg === "--exec-path" || arg === "--namespace") {
@@ -5496,7 +5995,7 @@ function collectDirtyPaths(context, options) {
   return unique;
 }
 function findEmbeddedGitDirs(context, pathSpecs) {
-  const instafyGitDir = path8.resolve(context.gitDir);
+  const instafyGitDir = path9.resolve(context.gitDir);
   const seen = /* @__PURE__ */ new Set();
   for (const rawPath of pathSpecs) {
     const normalized = normalizePathSpec(rawPath).replace(/\/+$/, "");
@@ -5505,11 +6004,11 @@ function findEmbeddedGitDirs(context, pathSpecs) {
     }
     let cursor = normalized;
     while (cursor && cursor !== ".") {
-      const candidate = path8.join(context.workTree, ...cursor.split("/"), ".git");
-      if (pathExists(candidate) && path8.resolve(candidate) !== instafyGitDir) {
-        seen.add(path8.resolve(candidate));
+      const candidate = path9.join(context.workTree, ...cursor.split("/"), ".git");
+      if (pathExists(candidate) && path9.resolve(candidate) !== instafyGitDir) {
+        seen.add(path9.resolve(candidate));
       }
-      const next = path8.posix.dirname(cursor);
+      const next = path9.posix.dirname(cursor);
       if (next === "." || next === cursor) {
         break;
       }
@@ -5518,8 +6017,8 @@ function findEmbeddedGitDirs(context, pathSpecs) {
   }
   const candidates = Array.from(seen);
   candidates.sort((a, b) => {
-    const depthA = a.split(path8.sep).length;
-    const depthB = b.split(path8.sep).length;
+    const depthA = a.split(path9.sep).length;
+    const depthB = b.split(path9.sep).length;
     return depthB - depthA;
   });
   return candidates;
@@ -5529,17 +6028,17 @@ function hideEmbeddedGitDirs(context, pathSpecs) {
   if (candidates.length === 0) {
     return [];
   }
-  const stagingBase = path8.join(context.workTree, ".instafy", "origin-staging", "embedded-git");
-  fs7.mkdirSync(stagingBase, { recursive: true });
+  const stagingBase = path9.join(context.workTree, ".instafy", "origin-staging", "embedded-git");
+  fs8.mkdirSync(stagingBase, { recursive: true });
   const renames = [];
   for (const candidate of candidates) {
-    let hidden = path8.join(stagingBase, randomUUID2());
+    let hidden = path9.join(stagingBase, randomUUID2());
     for (let attempt = 0; attempt < 8; attempt += 1) {
       if (!pathExists(hidden))
         break;
-      hidden = path8.join(stagingBase, randomUUID2());
+      hidden = path9.join(stagingBase, randomUUID2());
     }
-    fs7.renameSync(candidate, hidden);
+    fs8.renameSync(candidate, hidden);
     renames.push({ original: candidate, hidden });
   }
   return renames;
@@ -5550,7 +6049,7 @@ function restoreEmbeddedGitDirs(renames) {
     if (!rename)
       continue;
     try {
-      fs7.renameSync(rename.hidden, rename.original);
+      fs8.renameSync(rename.hidden, rename.original);
     } catch {
     }
   }
@@ -5620,15 +6119,15 @@ function runInstafyGit(userArgs, options) {
     console.log("instafy git <git-args...>");
     console.log("");
     console.log(
-      `Runs ${kleur8.cyan("git")} against the Instafy canonical repo at ${kleur8.cyan(
+      `Runs ${kleur9.cyan("git")} against the Instafy canonical repo at ${kleur9.cyan(
         ".instafy/.git"
       )} (auto-detected by walking up from cwd).`
     );
     console.log("");
     console.log("Example:");
-    console.log(`  ${kleur8.cyan("instafy git status")}`);
-    console.log(`  ${kleur8.cyan("instafy git add -A")}`);
-    console.log(`  ${kleur8.cyan('instafy git commit -am "instafy: checkpoint"')}`);
+    console.log(`  ${kleur9.cyan("instafy git status")}`);
+    console.log(`  ${kleur9.cyan("instafy git add -A")}`);
+    console.log(`  ${kleur9.cyan('instafy git commit -am "instafy: checkpoint"')}`);
     return 0;
   }
   const context = findInstafyGitContext(cwd);
@@ -5638,8 +6137,8 @@ function runInstafyGit(userArgs, options) {
         "No Instafy canonical git checkout found (expected .instafy/.git).",
         "",
         "Tips:",
-        `- Run this inside a git-canonical workspace (where ${kleur8.cyan(".instafy/.git")} exists).`,
-        `- If you're trying to operate on a user repo, use normal ${kleur8.cyan("git")} (it uses .git).`
+        `- Run this inside a git-canonical workspace (where ${kleur9.cyan(".instafy/.git")} exists).`,
+        `- If you're trying to operate on a user repo, use normal ${kleur9.cyan("git")} (it uses .git).`
       ].join("\n")
     );
   }
@@ -5904,7 +6403,7 @@ async function runInstafyGitSync(args, options) {
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.warn(kleur8.yellow(`[instafy git sync] ${message}; falling back to environment token.`));
+      console.warn(kleur9.yellow(`[instafy git sync] ${message}; falling back to environment token.`));
     }
   }
   if (!originToken) {
@@ -5952,7 +6451,7 @@ async function runInstafyGitSync(args, options) {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       console.warn(
-        kleur8.yellow(
+        kleur9.yellow(
           `[instafy git sync] failed to recover from invalid origin token: ${message}`
         )
       );
@@ -5960,13 +6459,13 @@ async function runInstafyGitSync(args, options) {
   }
   if (!response.ok) {
     const suffix = text.trim() ? `: ${text.trim()}` : "";
-    console.error(kleur8.red(`Origin git sync failed (${response.status} ${response.statusText})${suffix}`));
+    console.error(kleur9.red(`Origin git sync failed (${response.status} ${response.statusText})${suffix}`));
     return 1;
   }
   const payload = text.trim() ? JSON.parse(text) : null;
   const rev = typeof payload?.rev === "string" ? payload.rev.trim() : "";
   if (!rev) {
-    console.error(kleur8.red("Origin git sync response missing rev field."));
+    console.error(kleur9.red("Origin git sync response missing rev field."));
     return 1;
   }
   if (parsed.json) {
@@ -5981,7 +6480,7 @@ async function runInstafyGitSync(args, options) {
 init_config();
 init_errors();
 init_controller_fetch();
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 function normalizeUrl5(raw) {
   const value = (raw ?? "").trim();
   if (!value)
@@ -6060,7 +6559,7 @@ function parseHeader(raw) {
 }
 function parseJsonBody(options) {
   if (options.jsonFile) {
-    const raw = fs8.readFileSync(options.jsonFile, "utf8");
+    const raw = fs9.readFileSync(options.jsonFile, "utf8");
     const parsed = JSON.parse(raw);
     return JSON.stringify(parsed);
   }
@@ -6298,9 +6797,9 @@ async function historyConversations(options) {
 
 // src/hardware-bindings.ts
 init_project_manifest();
-import fs9 from "node:fs";
-import path9 from "node:path";
-import kleur9 from "kleur";
+import fs10 from "node:fs";
+import path10 from "node:path";
+import kleur10 from "kleur";
 var SERIAL_HARDWARE_PROVIDER_ID = "hardware.serial";
 var DEFAULT_SERIAL_CAPABILITIES = [
   "hardware_serial_list",
@@ -6310,7 +6809,7 @@ var SUPPORTED_HARDWARE_CAPABILITIES = new Set(
   DEFAULT_SERIAL_CAPABILITIES
 );
 function resolveHardwareBindingContext(startDir) {
-  const lookup = findProjectManifest(path9.resolve(startDir));
+  const lookup = findProjectManifest(path10.resolve(startDir));
   if (!lookup.manifest || !lookup.path) {
     throw new Error(
       "Linked space manifest required. Run `instafy space init` in this folder or pass --path <dir>."
@@ -6320,17 +6819,17 @@ function resolveHardwareBindingContext(startDir) {
   if (!projectId) {
     throw new Error("Linked space manifest is missing a spaceId.");
   }
-  const instafyDir = path9.dirname(lookup.path);
+  const instafyDir = path10.dirname(lookup.path);
   return {
-    bindingsPath: path9.join(instafyDir, "hardware-bindings.json"),
+    bindingsPath: path10.join(instafyDir, "hardware-bindings.json"),
     projectId
   };
 }
 function readHardwareBindingStore(bindingsPath) {
-  if (!fs9.existsSync(bindingsPath)) {
+  if (!fs10.existsSync(bindingsPath)) {
     return { version: 1, bindings: {} };
   }
-  const raw = JSON.parse(fs9.readFileSync(bindingsPath, "utf8"));
+  const raw = JSON.parse(fs10.readFileSync(bindingsPath, "utf8"));
   const bindings = raw && typeof raw.bindings === "object" && raw.bindings !== null ? raw.bindings : {};
   return {
     version: 1,
@@ -6338,8 +6837,8 @@ function readHardwareBindingStore(bindingsPath) {
   };
 }
 function writeHardwareBindingStore(bindingsPath, store) {
-  fs9.mkdirSync(path9.dirname(bindingsPath), { recursive: true });
-  fs9.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
+  fs10.mkdirSync(path10.dirname(bindingsPath), { recursive: true });
+  fs10.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
 }
 function normalizeCapabilities(providerId, values) {
   const requested = Array.isArray(values) && values.length > 0 ? values : providerId === SERIAL_HARDWARE_PROVIDER_ID ? DEFAULT_SERIAL_CAPABILITIES : [];
@@ -6367,18 +6866,18 @@ function normalizeDevices(values) {
     if (!trimmed) {
       continue;
     }
-    const resolved = path9.resolve(trimmed);
+    const resolved = path10.resolve(trimmed);
     unique.set(resolved, {
       kind: "serial_device",
       id: resolved,
       path: resolved,
-      displayName: path9.basename(resolved)
+      displayName: path10.basename(resolved)
     });
   }
   return [...unique.values()];
 }
 function printHardwareBinding(record) {
-  console.log(kleur9.cyan(`Hardware provider: ${record.providerId}`));
+  console.log(kleur10.cyan(`Hardware provider: ${record.providerId}`));
   console.log(`Status: ${record.status}`);
   console.log(`Project: ${record.projectId}`);
   console.log(`Capabilities: ${record.grantedCapabilities.join(", ") || "(none)"}`);
@@ -6424,10 +6923,10 @@ function showHardwareBinding(options) {
     return;
   }
   if (bindings.length === 0) {
-    console.log(kleur9.yellow("No hardware bindings recorded for this space."));
+    console.log(kleur10.yellow("No hardware bindings recorded for this space."));
     return;
   }
-  console.log(kleur9.cyan(`Hardware bindings for ${context.projectId}:`));
+  console.log(kleur10.cyan(`Hardware bindings for ${context.projectId}:`));
   for (const record of bindings) {
     console.log(`- ${record.providerId} (${record.status})`);
   }
@@ -6460,9 +6959,9 @@ function grantHardwareBinding(options) {
     console.log(JSON.stringify(record));
     return;
   }
-  console.log(kleur9.green(`Hardware binding granted: ${providerId}`));
+  console.log(kleur10.green(`Hardware binding granted: ${providerId}`));
   printHardwareBinding(record);
-  console.log(kleur9.cyan(`Stored at ${context.bindingsPath}`));
+  console.log(kleur10.cyan(`Stored at ${context.bindingsPath}`));
 }
 function revokeHardwareBinding(options) {
   const providerId = options.providerId.trim();
@@ -6481,12 +6980,12 @@ function revokeHardwareBinding(options) {
     console.log(JSON.stringify({ revoked: true, providerId }));
     return;
   }
-  console.log(kleur9.green(`Hardware binding revoked: ${providerId}`));
-  console.log(kleur9.cyan(`Updated ${context.bindingsPath}`));
+  console.log(kleur10.green(`Hardware binding revoked: ${providerId}`));
+  console.log(kleur10.cyan(`Updated ${context.bindingsPath}`));
 }
 
 // src/agents.ts
-import kleur10 from "kleur";
+import kleur11 from "kleur";
 init_project_manifest();
 var DEFAULT_CONTEXT_LIMIT = 50;
 var MAX_CONTEXT_LIMIT = 200;
@@ -6597,16 +7096,16 @@ async function agentsList(options) {
     return;
   }
   if (!agents.length) {
-    console.log(kleur10.yellow("No agents found."));
+    console.log(kleur11.yellow("No agents found."));
     return;
   }
-  console.log(kleur10.bold("Agents"));
+  console.log(kleur11.bold("Agents"));
   for (const agent of agents) {
     const provider = trimOrNull(agent.provider);
     const model = trimOrNull(agent.model);
     const details = [provider, model].filter(Boolean).join(" \xB7 ");
     console.log(
-      `- ${kleur10.cyan(`@${agent.handle}`)} ${displayName(agent)}${details ? ` (${details})` : ""}`
+      `- ${kleur11.cyan(`@${agent.handle}`)} ${displayName(agent)}${details ? ` (${details})` : ""}`
     );
     console.log(`  id: ${agent.id}`);
   }
@@ -6626,15 +7125,15 @@ async function agentContextsList(options) {
     return;
   }
   if (!contexts.length) {
-    console.log(kleur10.yellow("No agent context cards found."));
+    console.log(kleur11.yellow("No agent context cards found."));
     return;
   }
-  console.log(kleur10.bold("Agent context"));
+  console.log(kleur11.bold("Agent context"));
   for (const card of contexts) {
     const title = trimOrNull(card.title);
     const updatedAt = trimOrNull(card.updatedAt) ?? trimOrNull(card.updated_at);
     console.log(
-      `- ${kleur10.cyan(contextAgentLabel(card))} ${kleur10.gray(`[${contextScope(card)}]`)}${title ? ` ${title}` : ""}`
+      `- ${kleur11.cyan(contextAgentLabel(card))} ${kleur11.gray(`[${contextScope(card)}]`)}${title ? ` ${title}` : ""}`
     );
     console.log(`  ${summarize(card.context)}`);
     if (updatedAt) {
@@ -6671,7 +7170,7 @@ async function agentContextPut(options) {
     return;
   }
   console.log(
-    `${kleur10.green("Saved")} ${kleur10.cyan(contextAgentLabel(saved))} context for ${kleur10.gray(contextScope(saved))}.`
+    `${kleur11.green("Saved")} ${kleur11.cyan(contextAgentLabel(saved))} context for ${kleur11.gray(contextScope(saved))}.`
   );
 }
 function workerLabel(worker) {
@@ -6697,7 +7196,7 @@ async function agentPlanGroupStatus(options) {
     console.log(JSON.stringify(status, null, 2));
     return;
   }
-  console.log(kleur10.bold(`Plan group ${trimOrNull(status.groupId) ?? groupId}`));
+  console.log(kleur11.bold(`Plan group ${trimOrNull(status.groupId) ?? groupId}`));
   const conversationId = trimOrNull(status.conversationId);
   if (conversationId) {
     console.log(`  conversation: ${conversationId}`);
@@ -6707,13 +7206,13 @@ async function agentPlanGroupStatus(options) {
   );
   const workers = status.workers ?? [];
   if (!workers.length) {
-    console.log(kleur10.yellow("No worker jobs found."));
+    console.log(kleur11.yellow("No worker jobs found."));
     return;
   }
   for (const worker of workers) {
     const marker = worker.terminal ? "terminal" : "running";
     const details = [trimOrNull(worker.status) ?? "unknown", marker, trimOrNull(worker.outcome)].filter(Boolean).join(" \xB7 ");
-    console.log(`- ${kleur10.cyan(workerLabel(worker))} ${kleur10.gray(`[${details}]`)}`);
+    console.log(`- ${kleur11.cyan(workerLabel(worker))} ${kleur11.gray(`[${details}]`)}`);
     const scope = trimOrNull(worker.scopeSummary);
     if (scope) {
       console.log(`  scope: ${scope}`);
@@ -6724,7 +7223,7 @@ async function agentPlanGroupStatus(options) {
     }
     const errorMessage = trimOrNull(worker.errorMessage);
     if (errorMessage) {
-      console.log(`  ${kleur10.red(`error: ${summarize(errorMessage)}`)}`);
+      console.log(`  ${kleur11.red(`error: ${summarize(errorMessage)}`)}`);
     }
   }
 }
@@ -6751,11 +7250,11 @@ async function agentJobsCancel(options) {
   const canceledJobs = result.canceledJobIds?.length ?? 0;
   const canceledRuns = result.canceledRunIds?.length ?? 0;
   if (!canceledJobs && !canceledRuns) {
-    console.log(kleur10.yellow(`Nothing to cancel for ${target} (no queued or leased jobs).`));
+    console.log(kleur11.yellow(`Nothing to cancel for ${target} (no queued or leased jobs).`));
     return;
   }
   console.log(
-    `${kleur10.green("Canceled")} ${canceledJobs} job(s) and ${canceledRuns} run(s) for ${target}.`
+    `${kleur11.green("Canceled")} ${canceledJobs} job(s) and ${canceledRuns} run(s) for ${target}.`
   );
 }
 
@@ -6800,17 +7299,17 @@ function extractMentionedAgentHandles(prompt) {
   }
   return handles;
 }
-function buildPromptMetadata(prompt) {
+function buildPromptMetadata(prompt, intent) {
   const mentionedHandles = extractMentionedAgentHandles(prompt);
+  const metadata = intent.toLowerCase() === "terminal_command" ? {} : { writeIntent: true };
   if (mentionedHandles.length === 0) {
-    return {};
+    return metadata;
   }
-  return {
-    agentSelection: {
-      active: mentionedHandles,
-      mentions: mentionedHandles
-    }
+  metadata.agentSelection = {
+    active: mentionedHandles,
+    mentions: mentionedHandles
   };
+  return metadata;
 }
 function normalizeBooleanEnv(value) {
   const normalized = value?.trim().toLowerCase();
@@ -6920,10 +7419,11 @@ async function sleep(ms) {
 }
 async function dispatchPrompt(options) {
   const prompt = normalizePrompt(options.prompt);
+  const intent = options.intent?.trim() || "feature";
   const payload = {
     promptText: prompt,
-    intent: options.intent?.trim() || "feature",
-    metadata: buildPromptMetadata(prompt)
+    intent,
+    metadata: buildPromptMetadata(prompt, intent)
   };
   if (options.conversation?.trim()) {
     const conversationId2 = options.conversation.trim();
@@ -7071,7 +7571,7 @@ async function chatPrompt(options) {
 
 // src/conversations.ts
 init_project_manifest();
-import kleur11 from "kleur";
+import kleur12 from "kleur";
 var DEFAULT_CONVERSATION_LIMIT = 50;
 var DEFAULT_MESSAGE_LIMIT = 80;
 var MAX_LIMIT = 200;
@@ -7298,7 +7798,7 @@ async function buildSearchMatches(conversations, options) {
   }));
 }
 function formatConversationMatch(match) {
-  const lines = [`- ${kleur11.green(match.title)} (${match.id})`];
+  const lines = [`- ${kleur12.green(match.title)} (${match.id})`];
   const details = [];
   if (match.matchedIn.length > 0) {
     details.push(`match: ${match.matchedIn.join(", ")}`);
@@ -7310,7 +7810,7 @@ function formatConversationMatch(match) {
     lines.push(`  ${details.join(" \xB7 ")}`);
   }
   if (match.preview) {
-    lines.push(`  ${kleur11.gray(summarizeContent(match.preview))}`);
+    lines.push(`  ${kleur12.gray(summarizeContent(match.preview))}`);
   }
   return lines.join("\n");
 }
@@ -7369,16 +7869,16 @@ async function createConversation(options) {
     console.log(JSON.stringify(payload, null, 2));
     return;
   }
-  console.log(kleur11.green("Created conversation"));
-  console.log(`${kleur11.gray("ID:")} ${conversationId}`);
+  console.log(kleur12.green("Created conversation"));
+  console.log(`${kleur12.gray("ID:")} ${conversationId}`);
   if (title) {
-    console.log(`${kleur11.gray("Title:")} ${title}`);
+    console.log(`${kleur12.gray("Title:")} ${title}`);
   }
   if (parentConversationId) {
-    console.log(`${kleur11.gray("Parent:")} ${parentConversationId}`);
+    console.log(`${kleur12.gray("Parent:")} ${parentConversationId}`);
   }
   if (threadKind) {
-    console.log(`${kleur11.gray("Thread kind:")} ${threadKind}`);
+    console.log(`${kleur12.gray("Thread kind:")} ${threadKind}`);
   }
 }
 async function listConversations(options) {
@@ -7405,10 +7905,10 @@ async function listConversations(options) {
     return;
   }
   if (items.length === 0) {
-    console.log(kleur11.yellow("No conversations found for this space."));
+    console.log(kleur12.yellow("No conversations found for this space."));
     return;
   }
-  console.log(kleur11.green(`Conversations (${items.length})`));
+  console.log(kleur12.green(`Conversations (${items.length})`));
   for (const item of items) {
     console.log(formatConversationMatch({ ...item, score: 0, matchedIn: [] }));
   }
@@ -7430,10 +7930,10 @@ async function searchConversations(options) {
     return matches;
   }
   if (matches.length === 0) {
-    console.log(kleur11.yellow(`No conversations matched "${options.query}".`));
+    console.log(kleur12.yellow(`No conversations matched "${options.query}".`));
     return matches;
   }
-  console.log(kleur11.green(`Matches for "${options.query}"`));
+  console.log(kleur12.green(`Matches for "${options.query}"`));
   for (const match of matches.slice(0, Math.min(limit, matches.length))) {
     console.log(formatConversationMatch(match));
   }
@@ -7517,35 +8017,35 @@ async function showConversation(options) {
     );
     return;
   }
-  console.log(kleur11.green(selected.title));
-  console.log(`${kleur11.gray("ID:")} ${selected.id}`);
+  console.log(kleur12.green(selected.title));
+  console.log(`${kleur12.gray("ID:")} ${selected.id}`);
   if (selected.updatedAt) {
-    console.log(`${kleur11.gray("Updated:")} ${selected.updatedAt}`);
+    console.log(`${kleur12.gray("Updated:")} ${selected.updatedAt}`);
   }
   if (selected.preview) {
-    console.log(`${kleur11.gray("Preview:")} ${summarizeContent(selected.preview, 240)}`);
+    console.log(`${kleur12.gray("Preview:")} ${summarizeContent(selected.preview, 240)}`);
   }
   console.log("");
   if (messages.length === 0) {
-    console.log(kleur11.yellow("No messages found in this conversation."));
+    console.log(kleur12.yellow("No messages found in this conversation."));
     return;
   }
   for (const message of messages.slice().reverse()) {
     const role = (message.role ?? "unknown").trim().toLowerCase();
     const createdAt = trimOrNull2(message.createdAt) ?? trimOrNull2(message.created_at);
     const header = createdAt ? `${role} \xB7 ${createdAt}` : role;
-    console.log(kleur11.cyan(`[${header}]`));
+    console.log(kleur12.cyan(`[${header}]`));
     console.log(summarizeContent(message.content ?? "", 4e3));
     console.log("");
   }
 }
 
 // src/invitations.ts
-import kleur12 from "kleur";
-import path10 from "node:path";
+import kleur13 from "kleur";
+import path11 from "node:path";
 init_project_manifest();
 function resolveStartDir(rawPath) {
-  return path10.resolve(rawPath ?? process.cwd());
+  return path11.resolve(rawPath ?? process.cwd());
 }
 function trimOrNull3(value) {
   const trimmed = value?.trim() ?? "";
@@ -7687,7 +8187,7 @@ async function inviteSpaceMember(options) {
     return normalized;
   }
   const scopeLabel = orgName ? `${orgName}` : "this space";
-  console.log(kleur12.green(`Invitation sent to ${normalized.email}`));
+  console.log(kleur13.green(`Invitation sent to ${normalized.email}`));
   console.log(`Scope: ${scopeLabel}`);
   console.log(`Role: ${normalized.role}`);
   if (normalized.expiresAt) {
@@ -7747,7 +8247,7 @@ async function setSpaceMemberRole(options) {
       return normalized;
     }
     console.log(
-      kleur12.green(
+      kleur13.green(
         normalized.status === "updated" ? `Updated ${normalized.email} to ${normalized.role}` : `${normalized.email} already has role ${normalized.role}`
       )
     );
@@ -7786,7 +8286,7 @@ async function setSpaceMemberRole(options) {
       return normalized;
     }
     console.log(
-      kleur12.green(
+      kleur13.green(
         normalized.status === "updated" ? `Updated pending invite for ${normalized.email} to ${normalized.role}` : `Pending invite for ${normalized.email} already has role ${normalized.role}`
       )
     );
@@ -7832,14 +8332,446 @@ async function sendSpaceInvitation(options) {
   };
 }
 
+// src/team.ts
+init_config();
+init_controller_fetch();
+init_errors();
+import kleur14 from "kleur";
+var DEFAULT_STUDIO_URL = "https://instafy.dev";
+var ORG_ROLES = ["owner", "admin", "builder", "viewer"];
+var INVITE_LINK_ROLES = ["builder", "viewer"];
+var UUID_PATTERN3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var ControllerRequestError = class extends Error {
+  constructor(status, serverMessage, message) {
+    super(message);
+    this.name = "ControllerRequestError";
+    this.status = status;
+    this.serverMessage = serverMessage;
+  }
+};
+function normalizeBaseUrl(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed)
+    return null;
+  return trimmed.replace(/\/$/, "");
+}
+function isUuid3(value) {
+  return UUID_PATTERN3.test(value.trim());
+}
+function requireUuid(value, label) {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    throw new Error(`${label} is required.`);
+  }
+  if (!isUuid3(trimmed)) {
+    throw new Error(`${label} must be a UUID.`);
+  }
+  return trimmed;
+}
+function normalizeRole2(value, allowed, label) {
+  const resolved = (value ?? "").trim().toLowerCase();
+  if (!resolved) {
+    throw new Error(`${label} is required.`);
+  }
+  if (!allowed.includes(resolved)) {
+    throw new Error(`${label} must be one of ${allowed.join(", ")}.`);
+  }
+  return resolved;
+}
+function resolveControllerAuth4(options, retryCommand) {
+  const cwd = options.cwd ?? process.cwd();
+  const controllerUrl = resolveControllerUrl({
+    controllerUrl: options.controllerUrl ?? null,
+    cwd
+  });
+  const resolved = resolveUserAccessTokenWithSource({
+    accessToken: options.accessToken ?? null,
+    cwd
+  });
+  if (!resolved.token) {
+    throw formatAuthRequiredError({
+      retryCommand,
+      advancedHint: "pass --access-token, or set INSTAFY_ACCESS_TOKEN / SUPABASE_ACCESS_TOKEN"
+    });
+  }
+  return {
+    controllerUrl,
+    accessToken: resolved.token,
+    tokenSource: resolved.source,
+    profile: resolved.profile,
+    cwd
+  };
+}
+async function controllerJson(auth, retryCommand, params) {
+  const url = `${auth.controllerUrl.replace(/\/$/, "")}${params.path}`;
+  const headers = new Headers();
+  headers.set("accept", "application/json");
+  let bodyText;
+  if (params.body !== void 0) {
+    headers.set("content-type", "application/json");
+    bodyText = JSON.stringify(params.body);
+  }
+  const response = (await fetchWithControllerAuth({
+    url,
+    init: {
+      method: params.method,
+      headers,
+      body: bodyText
+    },
+    accessToken: auth.accessToken,
+    tokenSource: auth.tokenSource,
+    profile: auth.profile,
+    cwd: auth.cwd
+  })).response;
+  const text = await response.text().catch(() => "");
+  if (response.status === 401 || response.status === 403) {
+    throw formatAuthRejectedError({
+      status: response.status,
+      responseBody: text,
+      retryCommand,
+      advancedHint: "run `instafy login`, or pass --access-token"
+    });
+  }
+  if (!response.ok) {
+    const serverMessage = extractControllerErrorMessage(text);
+    throw new ControllerRequestError(
+      response.status,
+      serverMessage,
+      `Request failed (${response.status} ${response.statusText})${serverMessage ? `: ${serverMessage}` : ""}`
+    );
+  }
+  return text ? JSON.parse(text) : null;
+}
+async function fetchOrgs(auth) {
+  const payload = await controllerJson(auth, "instafy team list", {
+    method: "GET",
+    path: "/orgs"
+  });
+  return Array.isArray(payload?.orgs) ? payload.orgs : [];
+}
+async function resolveTeamId(auth, teamOpt) {
+  const raw = teamOpt?.trim();
+  if (raw && isUuid3(raw)) {
+    return raw;
+  }
+  const orgs = await fetchOrgs(auth);
+  if (raw) {
+    const bySlug = orgs.find(
+      (org) => (org.slug ?? "").toLowerCase() === raw.toLowerCase()
+    );
+    if (bySlug)
+      return bySlug.id;
+    const byId = orgs.find((org) => org.id === raw);
+    if (byId)
+      return byId.id;
+    throw new Error(
+      `No team matches "${raw}". Run \`instafy team list\` to see the teams you belong to.`
+    );
+  }
+  if (orgs.length === 1) {
+    return orgs[0].id;
+  }
+  if (orgs.length === 0) {
+    throw new Error(
+      "No teams found for this account. Run `instafy team list` to see your teams."
+    );
+  }
+  throw new Error(
+    "Multiple teams found. Pass --team-id <uuid|slug>. Run `instafy team list` to see the options."
+  );
+}
+function resolveStudioBaseUrl(auth, studioUrlOption) {
+  return normalizeBaseUrl(studioUrlOption ?? null) ?? normalizeBaseUrl(process.env["INSTAFY_STUDIO_URL"] ?? null) ?? normalizeBaseUrl(
+    resolveConfiguredStudioUrl({ profile: auth.profile, cwd: auth.cwd })
+  ) ?? DEFAULT_STUDIO_URL;
+}
+function shortId(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 8 ? trimmed.slice(0, 8) : trimmed;
+}
+function printTable(headers, rows) {
+  const widths = headers.map(
+    (header, index) => Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))
+  );
+  const format = (cells) => cells.map((cell, index) => (cell ?? "").padEnd(widths[index])).join("  ").trimEnd();
+  console.log(kleur14.bold(format(headers)));
+  for (const row of rows) {
+    console.log(format(row));
+  }
+}
+async function teamMembersList(options) {
+  const auth = resolveControllerAuth4(options, "instafy team members");
+  const orgId = await resolveTeamId(auth, options.teamId);
+  const payload = await controllerJson(auth, "instafy team members", {
+    method: "GET",
+    path: `/orgs/${encodeURIComponent(orgId)}/members`
+  });
+  const members = Array.isArray(payload?.members) ? payload.members : [];
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          members,
+          nextCursor: payload?.nextCursor ?? null,
+          hasMore: payload?.hasMore ?? false,
+          total: payload?.total
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (members.length === 0) {
+    console.log(kleur14.gray("No members."));
+    return;
+  }
+  const rows = members.map((member) => [
+    shortId(member.userId),
+    (member.email ?? "").trim() || "-",
+    (member.fullName ?? "").trim() || "-",
+    member.role,
+    (member.createdAt ?? "").trim() || "-"
+  ]);
+  printTable(["ID", "EMAIL", "NAME", "ROLE", "JOINED"], rows);
+}
+async function teamInvite(options) {
+  const auth = resolveControllerAuth4(options, "instafy team invite");
+  const email = options.email?.trim() ?? "";
+  if (!email) {
+    throw new Error("An email address is required.");
+  }
+  const role = options.role !== void 0 ? normalizeRole2(options.role, ORG_ROLES, "--role") : void 0;
+  const orgId = await resolveTeamId(auth, options.teamId);
+  const body = { email };
+  if (role)
+    body.role = role;
+  let payload;
+  try {
+    payload = await controllerJson(auth, "instafy team invite", {
+      method: "POST",
+      path: `/orgs/${encodeURIComponent(orgId)}/invitations`,
+      body
+    });
+  } catch (error) {
+    if (error instanceof ControllerRequestError && error.status >= 400 && error.status < 500 && /already a member|already exists|already has access/i.test(
+      error.serverMessage ?? ""
+    )) {
+      throw new Error(
+        `${error.serverMessage}
+
+If they already have an Instafy account, add them directly with:
+  instafy team add-member --user-id <uuid>${options.teamId ? ` --team-id ${options.teamId}` : ""}`
+      );
+    }
+    throw error;
+  }
+  const invitation = payload?.invitation;
+  if (!invitation?.id) {
+    throw new Error("Invitation response missing invitation details.");
+  }
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        { invitation, acceptUrl: payload?.acceptUrl ?? null },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(kleur14.green(`Invitation sent to ${invitation.email}`));
+  console.log(`Role: ${invitation.role}`);
+  if (invitation.expiresAt) {
+    console.log(`Expires: ${invitation.expiresAt}`);
+  }
+  console.log("");
+  console.log(
+    `${invitation.email} must sign in to Instafy with this email address to accept the invitation.`
+  );
+}
+async function teamInviteLink(options) {
+  const auth = resolveControllerAuth4(options, "instafy team invite-link");
+  const role = options.role !== void 0 ? normalizeRole2(options.role, INVITE_LINK_ROLES, "--role") : void 0;
+  const orgId = await resolveTeamId(auth, options.teamId);
+  const body = {};
+  if (role)
+    body.role = role;
+  const payload = await controllerJson(auth, "instafy team invite-link", {
+    method: "POST",
+    path: `/orgs/${encodeURIComponent(orgId)}/invite-links`,
+    body
+  });
+  const inviteLink = payload?.inviteLink;
+  if (!inviteLink?.token || !inviteLink.acceptPath) {
+    throw new Error("Invite link response missing link details.");
+  }
+  const studioBase = resolveStudioBaseUrl(auth, options.studioUrl);
+  const acceptUrl = typeof payload?.acceptUrl === "string" && payload.acceptUrl.trim() || `${studioBase}${inviteLink.acceptPath}`;
+  if (options.json) {
+    console.log(JSON.stringify({ inviteLink, acceptUrl }, null, 2));
+    return;
+  }
+  console.log(kleur14.green("Shareable invite link created."));
+  console.log(`Role: ${inviteLink.role}`);
+  console.log(`Link: ${acceptUrl}`);
+  console.log(`Token: ${inviteLink.token}`);
+  if (inviteLink.expiresAt) {
+    console.log(`Expires: ${inviteLink.expiresAt}`);
+  }
+  console.log("");
+  console.log(
+    "Anyone who opens this link and signs in (with any sign-in method) can join the team. Treat it like a shared secret."
+  );
+}
+async function teamInvites(options) {
+  const auth = resolveControllerAuth4(options, "instafy team invites");
+  const orgId = await resolveTeamId(auth, options.teamId);
+  const [invitationsPayload, linksPayload] = await Promise.all([
+    controllerJson(auth, "instafy team invites", {
+      method: "GET",
+      path: `/orgs/${encodeURIComponent(orgId)}/invitations`
+    }),
+    controllerJson(auth, "instafy team invites", {
+      method: "GET",
+      path: `/orgs/${encodeURIComponent(orgId)}/invite-links`
+    })
+  ]);
+  const invitations = Array.isArray(invitationsPayload?.invitations) ? invitationsPayload.invitations : [];
+  const inviteLinks = Array.isArray(linksPayload?.inviteLinks) ? linksPayload.inviteLinks : [];
+  if (options.json) {
+    console.log(JSON.stringify({ invitations, inviteLinks }, null, 2));
+    return;
+  }
+  if (invitations.length === 0 && inviteLinks.length === 0) {
+    console.log(kleur14.gray("No pending invitations or invite links."));
+    return;
+  }
+  if (invitations.length > 0) {
+    console.log(kleur14.bold("Email invitations"));
+    const rows = invitations.map((invitation) => [
+      shortId(invitation.id),
+      invitation.email,
+      invitation.role,
+      (invitation.expiresAt ?? "").trim() || "-"
+    ]);
+    printTable(["ID", "EMAIL", "ROLE", "EXPIRES"], rows);
+  }
+  if (inviteLinks.length > 0) {
+    if (invitations.length > 0)
+      console.log("");
+    console.log(kleur14.bold("Invite links (shareable, grant join on sign-in)"));
+    const rows = inviteLinks.map((link) => [
+      shortId(link.id),
+      link.role,
+      (link.status ?? "").trim() || "-",
+      (link.expiresAt ?? "").trim() || "-"
+    ]);
+    printTable(["ID", "ROLE", "STATUS", "EXPIRES"], rows);
+  }
+}
+async function teamAddMember(options) {
+  const auth = resolveControllerAuth4(options, "instafy team add-member");
+  const userId = requireUuid(options.userId, "--user-id");
+  const role = options.role !== void 0 ? normalizeRole2(options.role, ORG_ROLES, "--role") : void 0;
+  const orgId = await resolveTeamId(auth, options.teamId);
+  const body = { userId };
+  if (role)
+    body.role = role;
+  const payload = await controllerJson(auth, "instafy team add-member", {
+    method: "POST",
+    path: `/orgs/${encodeURIComponent(orgId)}/members`,
+    body
+  });
+  const member = payload?.member;
+  if (!member?.userId) {
+    throw new Error("Add member response missing member details.");
+  }
+  if (options.json) {
+    console.log(JSON.stringify({ member }, null, 2));
+    return;
+  }
+  const label = (member.email ?? "").trim() || member.userId;
+  console.log(kleur14.green(`Added ${label} as ${member.role}.`));
+}
+async function teamAccept(options) {
+  const auth = resolveControllerAuth4(options, "instafy team accept");
+  const token = requireUuid(options.token, "token");
+  const payload = await controllerJson(auth, "instafy team accept", {
+    method: "POST",
+    path: "/org-invitations/accept",
+    body: { token }
+  });
+  if (options.json) {
+    console.log(JSON.stringify(payload ?? {}, null, 2));
+    return;
+  }
+  const name = (payload?.orgName ?? "").trim() || payload?.orgSlug || payload?.orgId || "team";
+  console.log(kleur14.green(`Joined ${name} as ${payload?.role ?? "member"}.`));
+}
+async function confirmDestructive(message, yes, json) {
+  if (yes)
+    return;
+  const input3 = process.stdin;
+  const interactive = Boolean(
+    input3.isTTY && process.stdout.isTTY && json !== true && process.env["CI"] !== "true"
+  );
+  if (!interactive) {
+    throw new Error("Refusing to continue without confirmation. Re-run with --yes.");
+  }
+  const { confirm, isCancel } = await import("@clack/prompts");
+  const proceed = await confirm({ message, initialValue: false });
+  if (isCancel(proceed) || !proceed) {
+    throw new Error("Cancelled.");
+  }
+}
+async function teamRevokeInvite(options) {
+  const auth = resolveControllerAuth4(options, "instafy team revoke-invite");
+  const invitationId = requireUuid(options.invitationId, "invitation id");
+  const orgId = await resolveTeamId(auth, options.teamId);
+  await confirmDestructive(
+    `Revoke pending invitation ${shortId(invitationId)}?`,
+    options.yes,
+    options.json
+  );
+  await controllerJson(auth, "instafy team revoke-invite", {
+    method: "DELETE",
+    path: `/orgs/${encodeURIComponent(orgId)}/invitations/${encodeURIComponent(invitationId)}`
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, invitationId }, null, 2));
+    return;
+  }
+  console.log(kleur14.green(`Revoked invitation ${invitationId}.`));
+}
+async function teamRevokeLink(options) {
+  const auth = resolveControllerAuth4(options, "instafy team revoke-link");
+  const inviteLinkId = requireUuid(options.inviteLinkId, "invite link id");
+  const orgId = await resolveTeamId(auth, options.teamId);
+  await confirmDestructive(
+    `Revoke invite link ${shortId(inviteLinkId)}?`,
+    options.yes,
+    options.json
+  );
+  await controllerJson(auth, "instafy team revoke-link", {
+    method: "DELETE",
+    path: `/orgs/${encodeURIComponent(orgId)}/invite-links/${encodeURIComponent(inviteLinkId)}`
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, inviteLinkId }, null, 2));
+    return;
+  }
+  console.log(kleur14.green(`Revoked invite link ${inviteLinkId}.`));
+}
+
 // src/provider-bindings.ts
 init_project_manifest();
-import fs10 from "node:fs";
-import path11 from "node:path";
+import fs11 from "node:fs";
+import path12 from "node:path";
 import { pathToFileURL } from "node:url";
-import kleur13 from "kleur";
+import kleur15 from "kleur";
 function resolveBindingContext(startDir) {
-  const lookup = findProjectManifest(path11.resolve(startDir));
+  const lookup = findProjectManifest(path12.resolve(startDir));
   if (!lookup.manifest || !lookup.path) {
     throw new Error(
       "Linked space manifest required. Run `instafy space init` in this folder or pass --path <dir>."
@@ -7849,19 +8781,19 @@ function resolveBindingContext(startDir) {
   if (!projectId) {
     throw new Error("Linked space manifest is missing a spaceId.");
   }
-  const instafyDir = path11.dirname(lookup.path);
-  const projectRoot = path11.dirname(instafyDir);
+  const instafyDir = path12.dirname(lookup.path);
+  const projectRoot = path12.dirname(instafyDir);
   return {
-    bindingsPath: path11.join(instafyDir, "provider-bindings.json"),
+    bindingsPath: path12.join(instafyDir, "provider-bindings.json"),
     projectId,
     projectRoot
   };
 }
 function readBindingStore(bindingsPath) {
-  if (!fs10.existsSync(bindingsPath)) {
+  if (!fs11.existsSync(bindingsPath)) {
     return { version: 1, bindings: {} };
   }
-  const raw = JSON.parse(fs10.readFileSync(bindingsPath, "utf8"));
+  const raw = JSON.parse(fs11.readFileSync(bindingsPath, "utf8"));
   const bindings = raw && typeof raw.bindings === "object" && raw.bindings !== null ? raw.bindings : {};
   return {
     version: 1,
@@ -7869,8 +8801,8 @@ function readBindingStore(bindingsPath) {
   };
 }
 function writeBindingStore(bindingsPath, store) {
-  fs10.mkdirSync(path11.dirname(bindingsPath), { recursive: true });
-  fs10.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
+  fs11.mkdirSync(path12.dirname(bindingsPath), { recursive: true });
+  fs11.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
 }
 function normalizeCapabilities2(values) {
   const requested = Array.isArray(values) && values.length > 0 ? values : ["project_content_read", "project_content_write"];
@@ -7893,7 +8825,7 @@ function deriveStatus(capabilities) {
   return "bound_read_only";
 }
 function printBinding(record) {
-  console.log(kleur13.cyan(`Provider: ${record.providerId}`));
+  console.log(kleur15.cyan(`Provider: ${record.providerId}`));
   console.log(`Status: ${record.status}`);
   console.log(`Project: ${record.projectId}`);
   console.log(`Root URI: ${record.rootUri}`);
@@ -7935,10 +8867,10 @@ function showProviderBinding(options) {
     return;
   }
   if (bindings.length === 0) {
-    console.log(kleur13.yellow("No provider bindings recorded for this space."));
+    console.log(kleur15.yellow("No provider bindings recorded for this space."));
     return;
   }
-  console.log(kleur13.cyan(`Bindings for ${context.projectId}:`));
+  console.log(kleur15.cyan(`Bindings for ${context.projectId}:`));
   for (const record of bindings) {
     console.log(`- ${record.providerId} (${record.status})`);
   }
@@ -7970,9 +8902,9 @@ function grantProviderBinding(options) {
     console.log(JSON.stringify(record));
     return;
   }
-  console.log(kleur13.green(`Provider binding granted: ${providerId}`));
+  console.log(kleur15.green(`Provider binding granted: ${providerId}`));
   printBinding(record);
-  console.log(kleur13.cyan(`Stored at ${context.bindingsPath}`));
+  console.log(kleur15.cyan(`Stored at ${context.bindingsPath}`));
 }
 function revokeProviderBinding(options) {
   const providerId = options.providerId.trim();
@@ -7991,12 +8923,12 @@ function revokeProviderBinding(options) {
     console.log(JSON.stringify({ revoked: true, providerId }));
     return;
   }
-  console.log(kleur13.green(`Provider binding revoked: ${providerId}`));
-  console.log(kleur13.cyan(`Updated ${context.bindingsPath}`));
+  console.log(kleur15.green(`Provider binding revoked: ${providerId}`));
+  console.log(kleur15.cyan(`Updated ${context.bindingsPath}`));
 }
 
 // src/providers.ts
-import kleur14 from "kleur";
+import kleur16 from "kleur";
 
 // ../provider-client/index.js
 var DEFAULT_PROVIDER_HOST_BASE_URL = "http://127.0.0.1:8797";
@@ -8068,12 +9000,12 @@ function resolveFetchImplementation(fetchImpl) {
 function createProviderHostClient(options = {}) {
   const fetchImpl = resolveFetchImplementation(options.fetch);
   const baseUrl = normalizeProviderHostBaseUrl(options.baseUrl);
-  async function jsonRequest(path14, init) {
-    const response = await fetchImpl(`${baseUrl}${path14}`, init);
+  async function jsonRequest(path15, init) {
+    const response = await fetchImpl(`${baseUrl}${path15}`, init);
     const json = await response.json();
     if (!response.ok || json?.ok === false) {
       throw new Error(
-        json?.error || json?.stderr || `provider host request failed for ${path14}`
+        json?.error || json?.stderr || `provider host request failed for ${path15}`
       );
     }
     return json;
@@ -8166,7 +9098,7 @@ function formatProviderLabel(provider) {
   return provider.title?.trim().length ? provider.title.trim() : provider.id;
 }
 function printProviderSummary(provider) {
-  console.log(kleur14.green(formatProviderLabel(provider)));
+  console.log(kleur16.green(formatProviderLabel(provider)));
   console.log(`  id: ${provider.id}`);
   if (provider.description) {
     console.log(`  description: ${provider.description}`);
@@ -8178,7 +9110,7 @@ function printProviderSummary(provider) {
     console.log(`  type: ${provider.providerType}`);
   }
   console.log(
-    `  discoverable: ${provider.discoverable !== false ? kleur14.green("yes") : kleur14.yellow("no")}`
+    `  discoverable: ${provider.discoverable !== false ? kleur16.green("yes") : kleur16.yellow("no")}`
   );
   if (provider.capabilityIds?.length) {
     console.log(`  capabilities: ${provider.capabilityIds.join(", ")}`);
@@ -8190,7 +9122,7 @@ function printProviderSummary(provider) {
     console.log(`  resources: ${provider.resourceUris.join(", ")}`);
   }
   if (provider.error) {
-    console.log(`  error: ${kleur14.yellow(provider.error)}`);
+    console.log(`  error: ${kleur16.yellow(provider.error)}`);
   }
 }
 function parseCommandJson(commandJson) {
@@ -8210,10 +9142,10 @@ async function providersList(options = {}) {
     });
     return;
   }
-  console.log(kleur14.green("Local providers"));
+  console.log(kleur16.green("Local providers"));
   console.log(`Host: ${providerHostUrl}`);
   if (!result.providers.length) {
-    console.log(kleur14.yellow("No providers discovered."));
+    console.log(kleur16.yellow("No providers discovered."));
     return;
   }
   for (const provider of result.providers) {
@@ -8230,7 +9162,7 @@ async function providersDiscover(params) {
     });
     return;
   }
-  console.log(kleur14.green(`Provider discovery: ${params.providerId}`));
+  console.log(kleur16.green(`Provider discovery: ${params.providerId}`));
   console.log(`Host: ${providerHostUrl}`);
   console.log(JSON.stringify(result.provider ?? result, null, 2));
 }
@@ -8244,10 +9176,10 @@ async function providersRead(params) {
     });
     return;
   }
-  console.log(kleur14.green(`Provider resource: ${params.uri}`));
+  console.log(kleur16.green(`Provider resource: ${params.uri}`));
   console.log(`Host: ${providerHostUrl}`);
   if (result.exists === false) {
-    console.log(kleur14.yellow("Resource does not exist."));
+    console.log(kleur16.yellow("Resource does not exist."));
     return;
   }
   console.log(JSON.stringify(result.value ?? result, null, 2));
@@ -8273,7 +9205,7 @@ async function providersProbe(params) {
     });
     return;
   }
-  console.log(kleur14.green(`Provider transport probe: ${params.providerId}`));
+  console.log(kleur16.green(`Provider transport probe: ${params.providerId}`));
   console.log(`Host: ${providerHostUrl}`);
   console.log(JSON.stringify(result, null, 2));
 }
@@ -8479,8 +9411,8 @@ async function diagnosticsRunResult(options) {
 }
 
 // src/support.ts
-import fs11 from "node:fs";
-import path12 from "node:path";
+import fs12 from "node:fs";
+import path13 from "node:path";
 init_project_manifest();
 var MAX_SUMMARY_CHARS = 500;
 var MAX_DETAILS_BYTES = 2e4;
@@ -8494,34 +9426,34 @@ function cleanText3(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 function readRegularFile(filePath, maxBytes, label) {
-  const resolved = path12.resolve(filePath);
+  const resolved = path13.resolve(filePath);
   const manifestPath = findProjectManifest(process.cwd()).path;
-  const workspaceRoot = manifestPath ? path12.dirname(path12.dirname(manifestPath)) : process.cwd();
-  const canonicalRoot = fs11.realpathSync(workspaceRoot);
-  const canonicalParent = fs11.realpathSync(path12.dirname(resolved));
-  const canonicalTarget = path12.join(canonicalParent, path12.basename(resolved));
-  const relativeTarget = path12.relative(canonicalRoot, canonicalTarget);
-  if (relativeTarget === ".." || relativeTarget.startsWith(`..${path12.sep}`) || path12.isAbsolute(relativeTarget)) {
+  const workspaceRoot = manifestPath ? path13.dirname(path13.dirname(manifestPath)) : process.cwd();
+  const canonicalRoot = fs12.realpathSync(workspaceRoot);
+  const canonicalParent = fs12.realpathSync(path13.dirname(resolved));
+  const canonicalTarget = path13.join(canonicalParent, path13.basename(resolved));
+  const relativeTarget = path13.relative(canonicalRoot, canonicalTarget);
+  if (relativeTarget === ".." || relativeTarget.startsWith(`..${path13.sep}`) || path13.isAbsolute(relativeTarget)) {
     throw new Error(`${label} must stay inside the active Instafy workspace.`);
   }
-  const initialStat = fs11.lstatSync(canonicalTarget);
+  const initialStat = fs12.lstatSync(canonicalTarget);
   if (initialStat.isSymbolicLink() || !initialStat.isFile()) {
     throw new Error(`${label} must be a regular file, not a symlink.`);
   }
-  const noFollow = typeof fs11.constants.O_NOFOLLOW === "number" ? fs11.constants.O_NOFOLLOW : 0;
-  const descriptor = fs11.openSync(canonicalTarget, fs11.constants.O_RDONLY | noFollow);
+  const noFollow = typeof fs12.constants.O_NOFOLLOW === "number" ? fs12.constants.O_NOFOLLOW : 0;
+  const descriptor = fs12.openSync(canonicalTarget, fs12.constants.O_RDONLY | noFollow);
   try {
-    const openedStat = fs11.fstatSync(descriptor);
+    const openedStat = fs12.fstatSync(descriptor);
     if (!openedStat.isFile() || openedStat.dev !== initialStat.dev || openedStat.ino !== initialStat.ino || openedStat.size > maxBytes) {
       throw new Error(`${label} must be a regular file no larger than ${maxBytes} bytes.`);
     }
-    const bytes = fs11.readFileSync(descriptor);
+    const bytes = fs12.readFileSync(descriptor);
     if (bytes.length > maxBytes) {
       throw new Error(`${label} must be ${maxBytes} bytes or smaller.`);
     }
     return bytes;
   } finally {
-    fs11.closeSync(descriptor);
+    fs12.closeSync(descriptor);
   }
 }
 function readJsonFile(filePath, maxBytes, label) {
@@ -8597,7 +9529,7 @@ function resolveScreenshots(filePaths = []) {
       );
     }
     return {
-      fileName: path12.basename(filePath),
+      fileName: path13.basename(filePath),
       mediaType,
       dataBase64: bytes.toString("base64"),
       byteLength: bytes.length
@@ -8900,7 +9832,7 @@ program.command("login").description("Log in and save an access token for future
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -8908,7 +9840,7 @@ program.command("logout").description("Clear the saved CLI access token").option
   try {
     await logout({ json: opts.json, profile: opts.profile });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -8932,7 +9864,7 @@ chatCommand.option("--json", "Output JSON").action(async (promptParts, opts) =>
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -8956,7 +9888,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -8972,7 +9904,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -8986,7 +9918,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9009,7 +9941,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9021,7 +9953,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9043,7 +9975,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9059,7 +9991,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9085,7 +10017,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9110,7 +10042,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur17.red(String(error)));
+      console.error(kleur19.red(String(error)));
       process.exit(1);
     }
   });
@@ -9130,7 +10062,7 @@ hardwareBindingsCommand.command("show").description("Show hardware bindings for
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9150,7 +10082,7 @@ hardwareBindingsCommand.command("grant").description("Grant a local hardware pro
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9162,7 +10094,7 @@ hardwareBindingsCommand.command("revoke").description("Revoke a local hardware b
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9176,7 +10108,7 @@ hardwareSerialCommand.command("list").description("List local serial devices vis
       scanDirs: opts.scanDir
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9188,7 +10120,7 @@ hardwareSerialCommand.command("probe").description("Probe host permissions for o
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9200,7 +10132,7 @@ hardwareCommand.command("opportunities").description("List host-local IO opportu
       scanDirs: opts.scanDir
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9213,7 +10145,7 @@ hardwareCommand.command("run").description("Run one available host-local IO acti
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9228,7 +10160,7 @@ providersListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9242,7 +10174,7 @@ providersDiscoverCommand.option("--json", "Output JSON").action(async (providerI
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9257,7 +10189,7 @@ providersReadCommand.option("--json", "Output JSON").action(async (providerId, u
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9280,7 +10212,7 @@ providersProbeCommand.option("--json", "Output JSON").action(async (providerId,
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9302,7 +10234,7 @@ agentsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9330,7 +10262,7 @@ agentsContextListCommand.option("--agent <handle>", "Filter by agent handle (for
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9356,7 +10288,7 @@ agentsContextPutCommand.action(async (contextParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9372,7 +10304,7 @@ agentsStatusCommand.option("--json", "Output JSON").action(async (groupId, opts)
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9390,7 +10322,7 @@ agentsCancelCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9412,7 +10344,7 @@ secretsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9433,7 +10365,7 @@ secretsGetCommand.option("--json", "Output JSON").action(async (nameOrId, opts)
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9458,7 +10390,7 @@ secretsPutCommand.option("--json", "Output JSON").action(async (name, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9479,10 +10411,24 @@ secretsRevokeCommand.option("--json", "Output JSON").action(async (nameOrId, opt
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
+function resolveResultVisibilityFlag(opts) {
+  if (opts.resultVisibility !== void 0) {
+    const value = String(opts.resultVisibility).trim().toLowerCase();
+    if (value !== "private" && value !== "team") {
+      throw new Error("--result-visibility must be private or team");
+    }
+    return value;
+  }
+  if (opts.shareResults === true)
+    return "team";
+  if (opts.shareResults === false)
+    return "private";
+  return void 0;
+}
 var automationsCommand = program.command("automations").description("Manage scheduled automations (run prompts on a schedule)");
 failWithGroupHelp(automationsCommand);
 var automationsListCommand = automationsCommand.command("list").description("List automations for this space");
@@ -9501,13 +10447,22 @@ automationsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
 var automationsCreateCommand = automationsCommand.command("create").description("Create an automation").requiredOption("--name <name>", "Automation name").requiredOption("--prompt <text>", "Prompt to run on schedule").option("--schedule-kind <kind>", "weekly|hourly|once (default: weekly)").option("--run-at <datetime>", "Run time for once schedule (RFC3339 or YYYY-MM-DDTHH:MM[:SS])").option("--interval-hours <n>", "Interval hours (hourly schedule)", (value) => Number(value)).option("--days <list>", "Weekdays for weekly schedule (e.g. mo,tu,we,th,fr)").option("--time <hh:mm>", "Time for weekly schedule (24h, e.g. 09:00)").option("--timezone <tz>", "IANA timezone (e.g. America/New_York)").option("--runtime-mode <mode>", "auto|hosted|existing (default: auto)").option("--runtime-provider <id>", "Runtime provider id (optional)").option(
   "--silent-when-nothing-to-report",
   "Do not post a completion result or send a result notification when a successful run has no findings"
+).option(
+  "--share-results",
+  "Share this automation's result threads with your team (visible to anyone with space access)"
+).option(
+  "--no-share-results",
+  "Keep this automation's result threads private to you (default)"
+).option(
+  "--result-visibility <private|team>",
+  "Result-thread visibility (private|team); overrides --share-results"
 ).option("--paused", "Create paused");
 addSpaceOption(
   automationsCreateCommand,
@@ -9529,6 +10484,7 @@ automationsCreateCommand.option("--json", "Output JSON").action(async (opts) =>
       runtimeMode: opts.runtimeMode,
       runtimeProvider: opts.runtimeProvider,
       silentWhenNothingToReport: Boolean(opts.silentWhenNothingToReport),
+      resultVisibility: resolveResultVisibilityFlag(opts),
       paused: Boolean(opts.paused),
       project: resolveSpaceIdOption(opts),
       controllerUrl: opts.serverUrl,
@@ -9536,7 +10492,53 @@ automationsCreateCommand.option("--json", "Output JSON").action(async (opts) =>
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var automationsUpdateCommand = automationsCommand.command("update").description(
+  "Update an automation's name, prompt, schedule, runtime settings, or result-sharing visibility in place"
+).argument("<automation-id>", "Automation UUID").option("--name <name>", "New automation name").option("--prompt <text>", "New prompt to run on schedule").option("--prompt-file <path>", "Read the new prompt from a file").option("--schedule-kind <kind>", "weekly|hourly|once").option("--run-at <datetime>", "Run time for once schedule (RFC3339 or YYYY-MM-DDTHH:MM[:SS])").option("--interval-hours <n>", "Interval hours (hourly schedule)", (value) => Number(value)).option("--days <list>", "Weekdays for weekly schedule (e.g. mo,tu,we,th,fr)").option("--time <hh:mm>", "Time for weekly schedule (24h, e.g. 09:00)").option("--timezone <tz>", "IANA timezone (e.g. America/New_York)").option("--runtime-mode <mode>", "auto|hosted|existing").option("--runtime-provider <id>", "Runtime provider id").option(
+  "--silent-when-nothing-to-report",
+  "Do not post a completion result or send a result notification when a successful run has no findings"
+).option(
+  "--no-silent-when-nothing-to-report",
+  "Always post a completion result and send a result notification"
+).option(
+  "--share-results",
+  "Share this automation's result threads with your team (visible to anyone with space access)"
+).option(
+  "--no-share-results",
+  "Keep this automation's result threads private to you"
+).option(
+  "--result-visibility <private|team>",
+  "Result-thread visibility (private|team); overrides --share-results"
+);
+addServerUrlOptions(automationsUpdateCommand);
+addAccessTokenOptions(automationsUpdateCommand, "Instafy access token");
+automationsUpdateCommand.option("--json", "Output JSON").action(async (automationId, opts) => {
+  try {
+    await automationsUpdate({
+      automationId,
+      name: opts.name,
+      prompt: opts.prompt,
+      promptFile: opts.promptFile,
+      scheduleKind: opts.scheduleKind,
+      runAt: opts.runAt,
+      intervalHours: opts.intervalHours,
+      days: opts.days,
+      time: opts.time,
+      timezone: opts.timezone,
+      runtimeMode: opts.runtimeMode,
+      runtimeProvider: opts.runtimeProvider,
+      silentWhenNothingToReport: opts.silentWhenNothingToReport,
+      resultVisibility: resolveResultVisibilityFlag(opts),
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9553,7 +10555,7 @@ automationsPauseCommand.option("--json", "Output JSON").action(async (automation
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9570,7 +10572,7 @@ automationsResumeCommand.option("--json", "Output JSON").action(async (automatio
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9586,7 +10588,7 @@ automationsRunCommand.option("--json", "Output JSON").action(async (automationId
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9602,7 +10604,92 @@ automationsDeleteCommand.option("--json", "Output JSON").action(async (automatio
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var credentialsCommand = program.command("credentials").description("Inspect, verify and pick the AI provider credentials your jobs use");
+failWithGroupHelp(credentialsCommand);
+var credentialsListCommand = credentialsCommand.command("list").description("List your AI credentials (secret material is never shown)").option("--all", "Include revoked credentials");
+addServerUrlOptions(credentialsListCommand);
+addAccessTokenOptions(credentialsListCommand, "Instafy access token");
+credentialsListCommand.option("--json", "Output JSON").action(async (opts) => {
+  try {
+    await credentialsList({
+      all: Boolean(opts.all),
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var credentialsTestCommand = credentialsCommand.command("test").description("Probe one credential through the proxy against its upstream provider (exit 1 on failure)").argument("<id-or-prefix>", "Credential UUID or unique id prefix");
+addServerUrlOptions(credentialsTestCommand);
+addAccessTokenOptions(credentialsTestCommand, "Instafy access token");
+credentialsTestCommand.option("--json", "Output JSON").action(async (idOrPrefix, opts) => {
+  try {
+    const result = await credentialsTest({
+      idOrPrefix,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+    if (!result.ok) {
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var credentialsDefaultCommand = credentialsCommand.command("default").description("Set the default credential jobs use, or clear it with --clear").argument("[id-or-prefix]", "Credential UUID or unique id prefix").option("--clear", "Clear the default credential instead of setting one");
+addServerUrlOptions(credentialsDefaultCommand);
+addAccessTokenOptions(credentialsDefaultCommand, "Instafy access token");
+credentialsDefaultCommand.option("--json", "Output JSON").action(async (idOrPrefix, opts) => {
+  try {
+    const target = pickTrimmedString2(idOrPrefix);
+    if (opts.clear && target) {
+      throw new Error("Pass either a credential id or --clear, not both.");
+    }
+    if (!opts.clear && !target) {
+      throw new Error("Provide a credential id (or unique prefix), or pass --clear.");
+    }
+    if (opts.clear) {
+      await credentialsClearDefault({
+        controllerUrl: opts.serverUrl,
+        accessToken: opts.accessToken,
+        json: opts.json
+      });
+      return;
+    }
+    await credentialsSetDefault({
+      idOrPrefix: target,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var credentialsRevokeCommand = credentialsCommand.command("revoke").description("Revoke a credential (asks for confirmation unless --yes)").argument("<id-or-prefix>", "Credential UUID or unique id prefix").option("--yes", "Skip the confirmation prompt (required when not running in a terminal)");
+addServerUrlOptions(credentialsRevokeCommand);
+addAccessTokenOptions(credentialsRevokeCommand, "Instafy access token");
+credentialsRevokeCommand.option("--json", "Output JSON").action(async (idOrPrefix, opts) => {
+  try {
+    await credentialsRevoke({
+      idOrPrefix,
+      yes: Boolean(opts.yes),
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9612,7 +10699,7 @@ configCommand.command("path").description("Print the config file path").option("
   try {
     configPath({ json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9620,7 +10707,7 @@ configCommand.command("list").description("List saved configuration").option("--
   try {
     configList({ json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9628,7 +10715,7 @@ configCommand.command("get").description("Get a config value (controller-url, st
   try {
     configGet({ key, json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9636,7 +10723,7 @@ configCommand.command("set").description("Set a config value (controller-url, st
   try {
     configSet({ key, value, json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9644,7 +10731,7 @@ configCommand.command("unset").description("Unset a config value (controller-url
   try {
     configUnset({ key, json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9664,7 +10751,7 @@ runtimeStartCommand.option("--supabase-access-token <token>", "Supabase session
       controllerAccessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9672,7 +10759,7 @@ runtimeCommand.command("status").description("Show runtime health").option("--js
   try {
     await runtimeStatus({ json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9680,7 +10767,7 @@ runtimeCommand.command("stop").description("Stop the local Instafy runtime").opt
   try {
     await runtimeStop({ json: opts.json });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9706,7 +10793,7 @@ runtimeTokenCommand.option("--runtime-id <uuid>", "Runtime ID to bind token to")
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9728,7 +10815,7 @@ diagnosticsRuntimeEventsCommand.action(async (opts) => {
       accessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9743,7 +10830,7 @@ diagnosticsRunResultCommand.action(async (runId, opts) => {
       accessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9777,7 +10864,7 @@ supportReportCommand.action(async (summaryParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9796,7 +10883,7 @@ supportListCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9812,7 +10899,7 @@ supportShowCommand.action(async (reportId, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9857,19 +10944,19 @@ tunnelStartCommand.option("--no-detach", "Run in foreground until interrupted").
       console.log(JSON.stringify(started, null, 2));
       return;
     }
-    console.log(kleur17.green(`Tunnel started: ${started.url} (tunnelId=${started.tunnelId})`));
-    console.log(kleur17.gray(`pid=${started.pid} \xB7 port=${started.localPort}`));
-    console.log(kleur17.gray(`log: ${started.logFile}`));
+    console.log(kleur19.green(`Tunnel started: ${started.url} (tunnelId=${started.tunnelId})`));
+    console.log(kleur19.gray(`pid=${started.pid} \xB7 port=${started.localPort}`));
+    console.log(kleur19.gray(`log: ${started.logFile}`));
     console.log("");
     console.log("Next:");
-    console.log(`- ${kleur17.cyan(`instafy tunnel list`)}`);
-    console.log(`- ${kleur17.cyan(`instafy tunnel logs ${started.tunnelId} --follow`)}`);
-    console.log(`- ${kleur17.cyan(`instafy tunnel stop ${started.tunnelId}`)}`);
+    console.log(`- ${kleur19.cyan(`instafy tunnel list`)}`);
+    console.log(`- ${kleur19.cyan(`instafy tunnel logs ${started.tunnelId} --follow`)}`);
+    console.log(`- ${kleur19.cyan(`instafy tunnel stop ${started.tunnelId}`)}`);
     if (process.platform !== "win32") {
-      console.log(kleur17.gray(`(or) tail -n 200 -f ${started.logFile}`));
+      console.log(kleur19.gray(`(or) tail -n 200 -f ${started.logFile}`));
     }
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9881,14 +10968,14 @@ tunnelCommand.command("list").description("List local tunnel sessions started by
       return;
     }
     if (tunnels.length === 0) {
-      console.log(kleur17.yellow("No tunnels found."));
+      console.log(kleur19.yellow("No tunnels found."));
       return;
     }
     for (const tunnel of tunnels) {
       console.log(`${tunnel.tunnelId} \xB7 ${tunnel.url} \xB7 port=${tunnel.localPort} \xB7 pid=${tunnel.pid}`);
     }
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9904,9 +10991,9 @@ tunnelCommand.command("stop").description("Stop a local tunnel session and revok
       console.log(JSON.stringify(result, null, 2));
       return;
     }
-    console.log(kleur17.green(`Tunnel stopped: ${result.tunnelId}`));
+    console.log(kleur19.green(`Tunnel stopped: ${result.tunnelId}`));
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9920,7 +11007,7 @@ tunnelCommand.command("logs").description("Show logs for a local tunnel session"
       json: Boolean(opts.json)
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9936,7 +11023,158 @@ orgListCommand.option("--access-token <token>", "Instafy or Supabase access toke
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+function teamScopeCommandFactory(nameAndArgs, description) {
+  const command = orgCommand.command(nameAndArgs).description(description);
+  addServerUrlOptions(command);
+  addAccessTokenOptions(command, "Instafy access token");
+  command.option("--team-id <team>", "Team id (UUID) or slug (defaults to your only team)").option("--json", "Output JSON");
+  return command;
+}
+var teamMembersCommand = teamScopeCommandFactory("members", "List members of a team");
+teamMembersCommand.action(async (opts) => {
+  try {
+    await teamMembersList({
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamInviteCommand = teamScopeCommandFactory(
+  "invite <email>",
+  "Invite a teammate by email (they must sign in with that email to accept)"
+);
+teamInviteCommand.option("--role <role>", "owner, admin, builder, or viewer (default: builder)").action(async (email, opts) => {
+  try {
+    await teamInvite({
+      email,
+      role: opts.role,
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamInviteLinkCommand = teamScopeCommandFactory(
+  "invite-link",
+  "Create a shareable invite link that works with any sign-in method"
+);
+teamInviteLinkCommand.option("--role <role>", "builder or viewer (default: builder)").option("--studio-url <url>", "Studio base URL for the accept link (default: https://instafy.dev)").action(async (opts) => {
+  try {
+    await teamInviteLink({
+      role: opts.role,
+      studioUrl: opts.studioUrl,
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamInvitesCommand = teamScopeCommandFactory(
+  "invites",
+  "List pending email invitations and invite links"
+);
+teamInvitesCommand.action(async (opts) => {
+  try {
+    await teamInvites({
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamAddMemberCommand = teamScopeCommandFactory(
+  "add-member",
+  "Add an existing Instafy account to a team by user id"
+);
+teamAddMemberCommand.requiredOption("--user-id <uuid>", "User id of an existing Instafy account").option("--role <role>", "owner, admin, builder, or viewer (default: builder)").action(async (opts) => {
+  try {
+    await teamAddMember({
+      userId: opts.userId,
+      role: opts.role,
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamAcceptCommand = teamScopeCommandFactory(
+  "accept <token>",
+  "Accept a team invitation or invite link with the current account"
+);
+teamAcceptCommand.action(async (token, opts) => {
+  try {
+    await teamAccept({
+      token,
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamRevokeInviteCommand = teamScopeCommandFactory(
+  "revoke-invite <invitation-id>",
+  "Revoke a pending email invitation"
+);
+teamRevokeInviteCommand.option("--yes", "Skip the confirmation prompt").action(async (invitationId, opts) => {
+  try {
+    await teamRevokeInvite({
+      invitationId,
+      yes: opts.yes,
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
+    process.exit(1);
+  }
+});
+var teamRevokeLinkCommand = teamScopeCommandFactory(
+  "revoke-link <invite-link-id>",
+  "Revoke a shareable invite link"
+);
+teamRevokeLinkCommand.option("--yes", "Skip the confirmation prompt").action(async (inviteLinkId, opts) => {
+  try {
+    await teamRevokeLink({
+      inviteLinkId,
+      yes: opts.yes,
+      teamId: opts.teamId,
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9961,17 +11199,17 @@ profileCommand.command("list").description("List saved CLI profiles").option("--
       return;
     }
     if (profiles.length === 0) {
-      console.log(kleur17.yellow("No profiles found."));
-      console.log(`Create one with: ${kleur17.cyan("instafy login --profile <name>")}`);
+      console.log(kleur19.yellow("No profiles found."));
+      console.log(`Create one with: ${kleur19.cyan("instafy login --profile <name>")}`);
       return;
     }
-    console.log(kleur17.green("Instafy CLI profiles"));
+    console.log(kleur19.green("Instafy CLI profiles"));
     for (const profile of profiles) {
-      const token = profile.accessTokenSet ? kleur17.green("token") : kleur17.yellow("no-token");
-      console.log(`- ${kleur17.cyan(profile.name)} (${token})`);
+      const token = profile.accessTokenSet ? kleur19.green("token") : kleur19.yellow("no-token");
+      console.log(`- ${kleur19.cyan(profile.name)} (${token})`);
     }
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -9991,7 +11229,7 @@ historyMessagesCommand.option("--limit <n>", "Max messages to return (1-200, def
       pretty: opts.pretty
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -10008,7 +11246,7 @@ historyRunsCommand.option("--limit <n>", "Max runs to return (1-200, default: 50
       pretty: opts.pretty
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -10025,7 +11263,7 @@ historyConversationsCommand.option("--limit <n>", "Max conversations to return (
       pretty: opts.pretty
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -10046,7 +11284,7 @@ conversationCreateCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -10064,7 +11302,7 @@ conversationListCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -10083,7 +11321,7 @@ conversationSearchCommand.action(async (queryParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });
@@ -10102,7 +11340,7 @@ conversationShowCommand.action(async (targetParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur17.red(String(error)));
+    console.error(kleur19.red(String(error)));
     process.exit(1);
   }
 });