@intercom/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2403 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/types.ts
+var CLIError = class extends Error {
+  constructor(message, exitCode = 1, error) {
+    super(message);
+    this.exitCode = exitCode;
+    this.error = error;
+    this.name = "CLIError";
+  }
+};
+var AuthError = class extends CLIError {
+  constructor(message) {
+    super(message, 2);
+  }
+};
+var RateLimitError = class extends CLIError {
+  constructor(message, retryAfter) {
+    super(message, 3);
+    this.retryAfter = retryAfter;
+  }
+};
+var NotFoundError = class extends CLIError {
+  constructor(message) {
+    super(message, 4);
+  }
+};
+var PermissionError = class extends CLIError {
+  constructor(message) {
+    super(message, 5);
+  }
+};
+var TimeoutError = class extends CLIError {
+  constructor(message) {
+    super(message, 6);
+  }
+};
+function detectAuthType(token) {
+  try {
+    const decoded = Buffer.from(token, "base64").toString("utf-8");
+    if (decoded.startsWith("tok:")) {
+      return "oauth";
+    }
+  } catch {
+  }
+  return "api_key";
+}
+
+// src/output/json.ts
+function formatJson(data) {
+  return JSON.stringify(data, null, 2);
+}
+function applyJq(data, expr) {
+  if (expr === ".") return data;
+  if (!expr.startsWith(".")) {
+    throw new CLIError(
+      `Unsupported jq expression: "${expr}". Supported: ".", ".field", ".field.nested", ".field[].nested"`
+    );
+  }
+  if (/[|(){},;]/.test(expr)) {
+    throw new CLIError(
+      `Unsupported jq expression: "${expr}". Supported: ".", ".field", ".field.nested", ".field[].nested"`
+    );
+  }
+  const parts = expr.replace(/^\.\s*/, "").split(/\./).filter(Boolean);
+  for (const part of parts) {
+    if (!/^\w+(\[\])?$/.test(part)) {
+      throw new CLIError(
+        `Unsupported jq expression: "${expr}". Supported: ".", ".field", ".field.nested", ".field[].nested"`
+      );
+    }
+  }
+  let current = data;
+  for (const part of parts) {
+    const arrayMatch = part.match(/^(\w+)\[\]$/);
+    if (arrayMatch) {
+      const key = arrayMatch[1];
+      if (current && typeof current === "object" && key in current) {
+        const arr = current[key];
+        if (!Array.isArray(arr)) return void 0;
+        current = arr;
+      } else {
+        return void 0;
+      }
+    } else if (Array.isArray(current)) {
+      current = current.map(
+        (item) => item && typeof item === "object" ? item[part] : void 0
+      );
+    } else if (current && typeof current === "object") {
+      current = current[part];
+    } else {
+      return void 0;
+    }
+  }
+  return current;
+}
+
+// src/commands/api.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// src/api/timeouts.ts
+var API_TIMEOUT_MS = 3e4;
+
+// src/api/fetch.ts
+var USER_AGENT = "IntercomCLI/0.1.0";
+async function fetchWithTimeout(url, init, options) {
+  const headers = new Headers(init.headers);
+  if (!headers.has("User-Agent")) {
+    headers.set("User-Agent", USER_AGENT);
+  }
+  if (options.verbose) {
+    console.error(`> ${init.method ?? "GET"} ${url}`);
+  }
+  let response;
+  try {
+    response = await fetch(url, { ...init, headers, signal: AbortSignal.timeout(options.timeoutMs) });
+  } catch (err) {
+    if (err instanceof DOMException && err.name === "TimeoutError") {
+      throw new TimeoutError(`Request timed out after ${options.timeoutMs / 1e3}s: ${init.method ?? "GET"} ${url}`);
+    }
+    throw err;
+  }
+  if (options.verbose) {
+    console.error(`< ${response.status} ${response.statusText}`);
+  }
+  return response;
+}
+
+// src/api/client.ts
+var DEFAULT_BASE_URL = "https://api.intercom.io";
+var IntercomClient = class {
+  token;
+  authType;
+  appId;
+  baseUrl;
+  maxRetries;
+  verbose;
+  timeoutMs;
+  constructor(options) {
+    this.token = options.token;
+    this.authType = options.authType;
+    this.appId = options.appId ?? "";
+    this.baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
+    this.maxRetries = options.maxRetries ?? 3;
+    this.verbose = options.verbose ?? false;
+    this.timeoutMs = options.timeoutMs ?? API_TIMEOUT_MS;
+  }
+  authHeader() {
+    if (this.authType === "api_key") {
+      return `Basic ${Buffer.from(`${this.appId}:${this.token}`).toString("base64")}`;
+    }
+    return `Bearer ${this.token}`;
+  }
+  async request(method, path, body, responseType = "json", extraHeaders) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      Authorization: this.authHeader()
+    };
+    const isFormData = body instanceof FormData;
+    if (responseType === "json") {
+      headers.Accept = "application/json";
+    }
+    if (!isFormData) {
+      headers["Content-Type"] = "application/json";
+    }
+    if (extraHeaders) {
+      Object.assign(headers, extraHeaders);
+    }
+    const maxAttempts = this.maxRetries + 1;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      const options = { method, headers };
+      if (body && method !== "GET") {
+        if (isFormData) {
+          options.body = body;
+        } else {
+          options.body = JSON.stringify(body);
+        }
+      }
+      if (this.verbose) {
+        console.error(`> ${method} ${url}`);
+        if (body) {
+          console.error(
+            `> Body: ${body instanceof FormData ? "[FormData]" : JSON.stringify(body)}`
+          );
+        }
+      }
+      const response = await fetchWithTimeout(url, options, {
+        timeoutMs: this.timeoutMs
+      });
+      if (this.verbose) {
+        console.error(`< ${response.status} ${response.statusText}`);
+      }
+      if (response.ok) {
+        if (response.status === 204) return {};
+        switch (responseType) {
+          case "text":
+            return response.text();
+          case "buffer":
+            return Buffer.from(await response.arrayBuffer());
+          default:
+            return response.json();
+        }
+      }
+      const errorBody = await response.json().catch(() => ({}));
+      const errorMsg = errorBody?.errors?.[0]?.message ?? `HTTP ${response.status}`;
+      if (response.status === 401) {
+        throw new AuthError(
+          `Authentication expired or invalid: ${errorMsg}. Run "intercom auth login" to re-authenticate.`
+        );
+      }
+      if (response.status === 403) {
+        throw new PermissionError(`Permission denied: ${errorMsg}`);
+      }
+      if (response.status === 404) {
+        throw new NotFoundError(errorMsg);
+      }
+      if (response.status === 429) {
+        const retryAfter = parseInt(
+          response.headers.get("Retry-After") ?? "5",
+          10
+        );
+        if (attempt < this.maxRetries) {
+          if (this.verbose) {
+            console.error(
+              `Rate limited. Retrying in ${retryAfter}s (attempt ${attempt + 1}/${this.maxRetries})...`
+            );
+          }
+          await new Promise((r) => setTimeout(r, retryAfter * 1e3));
+          continue;
+        }
+        throw new RateLimitError(
+          `Rate limit exceeded. Retry after ${retryAfter} seconds.`,
+          retryAfter
+        );
+      }
+      throw new CLIError(errorMsg);
+    }
+    throw new CLIError("Request failed after retries");
+  }
+  async get(path, params, headers) {
+    let url = path;
+    if (params && Object.keys(params).length > 0) {
+      const qs = new URLSearchParams(params).toString();
+      url = `${path}?${qs}`;
+    }
+    return this.request("GET", url, void 0, "json", headers);
+  }
+  async post(path, body, headers) {
+    return this.request("POST", path, body, "json", headers);
+  }
+  async put(path, body, headers) {
+    return this.request("PUT", path, body, "json", headers);
+  }
+  async patch(path, body, headers) {
+    return this.request("PATCH", path, body, "json", headers);
+  }
+  async delete(path, headers) {
+    return this.request("DELETE", path, void 0, "json", headers);
+  }
+  async getText(path, params) {
+    let url = path;
+    if (params && Object.keys(params).length > 0) {
+      const qs = new URLSearchParams(params).toString();
+      url = `${path}?${qs}`;
+    }
+    return this.request("GET", url, void 0, "text");
+  }
+  async getBuffer(path, params) {
+    let url = path;
+    if (params && Object.keys(params).length > 0) {
+      const qs = new URLSearchParams(params).toString();
+      url = `${path}?${qs}`;
+    }
+    return this.request("GET", url, void 0, "buffer");
+  }
+  async postFormData(path, formData) {
+    return this.request("POST", path, formData);
+  }
+  async paginate(path, params, dataKey = "data") {
+    const allData = [];
+    const firstResponse = await this.get(path, { ...params });
+    const firstData = firstResponse[dataKey];
+    if (firstData) allData.push(...firstData);
+    const pages = firstResponse.pages;
+    const startingAfter = pages?.next && typeof pages.next === "object" ? pages.next.starting_after : void 0;
+    if (startingAfter) {
+      let cursor = startingAfter;
+      while (cursor) {
+        const response = await this.get(path, {
+          ...params,
+          starting_after: cursor
+        });
+        const data = response[dataKey];
+        if (data) allData.push(...data);
+        const p = response.pages;
+        cursor = p?.next && typeof p.next === "object" ? p.next.starting_after : void 0;
+      }
+      return allData;
+    }
+    const totalPages = pages?.total_pages ?? 1;
+    for (let page = 2; page <= totalPages; page++) {
+      const response = await this.get(path, { ...params, page: String(page) });
+      const data = response[dataKey];
+      if (data) allData.push(...data);
+    }
+    return allData;
+  }
+};
+
+// src/auth/store.ts
+import { readFileSync, mkdirSync } from "fs";
+
+// src/utils/fs.ts
+import { writeFile, rename } from "fs/promises";
+import { writeFileSync, renameSync } from "fs";
+async function atomicWriteFile(filePath, data, mode = 384) {
+  const tmpPath = filePath + ".tmp";
+  await writeFile(tmpPath, data, { mode });
+  await rename(tmpPath, filePath);
+}
+function atomicWriteFileSync(filePath, data, mode = 384) {
+  const tmpPath = filePath + ".tmp";
+  writeFileSync(tmpPath, data, { mode });
+  renameSync(tmpPath, filePath);
+}
+
+// src/auth/store.ts
+import { join } from "path";
+import { homedir } from "os";
+import { randomBytes, createCipheriv, createDecipheriv } from "crypto";
+var SERVICE_NAME = "intercom-cli";
+var NativeKeychainBackend = class {
+  async get(service, account) {
+    const { Entry } = await import("@napi-rs/keyring");
+    const entry = new Entry(service, account);
+    return entry.getPassword() ?? void 0;
+  }
+  async set(service, account, value) {
+    const { Entry } = await import("@napi-rs/keyring");
+    const entry = new Entry(service, account);
+    entry.setPassword(value);
+  }
+  async delete(service, account) {
+    const { Entry } = await import("@napi-rs/keyring");
+    const entry = new Entry(service, account);
+    try {
+      entry.deletePassword();
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/not found|no matching/i.test(msg)) return;
+      throw err;
+    }
+  }
+};
+var CREDENTIALS_FILE = "credentials";
+var KEY_FILE = ".key";
+var ALGORITHM = "aes-256-gcm";
+var EncryptedFileBackend = class {
+  dir;
+  constructor(dir) {
+    this.dir = dir ?? join(homedir(), ".intercom");
+  }
+  getEncryptionKey() {
+    const keyPath = join(this.dir, KEY_FILE);
+    try {
+      return Buffer.from(readFileSync(keyPath, "utf-8").trim(), "hex");
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      mkdirSync(this.dir, { recursive: true });
+      const key = randomBytes(32);
+      atomicWriteFileSync(keyPath, key.toString("hex") + "\n");
+      return key;
+    }
+  }
+  readStore() {
+    const filePath = join(this.dir, CREDENTIALS_FILE);
+    let raw;
+    try {
+      raw = readFileSync(filePath, "utf-8");
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      return {};
+    }
+    const { iv, tag, data } = JSON.parse(raw);
+    const key = this.getEncryptionKey();
+    const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(iv, "hex"));
+    decipher.setAuthTag(Buffer.from(tag, "hex"));
+    let decrypted = decipher.update(data, "hex", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return JSON.parse(decrypted);
+  }
+  writeStore(store) {
+    mkdirSync(this.dir, { recursive: true });
+    const key = this.getEncryptionKey();
+    const iv = randomBytes(16);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(JSON.stringify(store), "utf-8", "hex");
+    encrypted += cipher.final("hex");
+    const tag = cipher.getAuthTag();
+    const filePath = join(this.dir, CREDENTIALS_FILE);
+    atomicWriteFileSync(
+      filePath,
+      JSON.stringify({ iv: iv.toString("hex"), tag: tag.toString("hex"), data: encrypted }) + "\n"
+    );
+  }
+  storeKey(service, account) {
+    return `${service}:${account}`;
+  }
+  async get(service, account) {
+    const store = this.readStore();
+    return store[this.storeKey(service, account)];
+  }
+  async set(service, account, value) {
+    const store = this.readStore();
+    store[this.storeKey(service, account)] = value;
+    this.writeStore(store);
+  }
+  async delete(service, account) {
+    const store = this.readStore();
+    delete store[this.storeKey(service, account)];
+    this.writeStore(store);
+  }
+};
+var FallbackBackend = class {
+  constructor(primary, secondary) {
+    this.primary = primary;
+    this.secondary = secondary;
+    this.active = primary;
+  }
+  active;
+  fallen = false;
+  fallback(err) {
+    if (this.fallen) throw err;
+    this.fallen = true;
+    this.active = this.secondary;
+    console.error(
+      `Warning: System keyring unavailable (${err instanceof Error ? err.message : String(err)}). Falling back to encrypted file storage.`
+    );
+  }
+  async get(service, account) {
+    try {
+      return await this.active.get(service, account);
+    } catch (err) {
+      this.fallback(err);
+      return this.active.get(service, account);
+    }
+  }
+  async set(service, account, value) {
+    try {
+      return await this.active.set(service, account, value);
+    } catch (err) {
+      this.fallback(err);
+      return this.active.set(service, account, value);
+    }
+  }
+  async delete(service, account) {
+    try {
+      return await this.active.delete(service, account);
+    } catch (err) {
+      this.fallback(err);
+      return this.active.delete(service, account);
+    }
+  }
+};
+function createDefaultBackend(configDir) {
+  if (configDir) {
+    return new EncryptedFileBackend(configDir);
+  }
+  return new FallbackBackend(
+    new NativeKeychainBackend(),
+    new EncryptedFileBackend()
+  );
+}
+var CredentialStore = class {
+  constructor(backend) {
+    this.backend = backend;
+  }
+  async get(appId) {
+    const raw = await this.backend.get(SERVICE_NAME, appId);
+    if (!raw) return void 0;
+    return JSON.parse(raw);
+  }
+  async set(appId, credential) {
+    await this.backend.set(SERVICE_NAME, appId, JSON.stringify(credential));
+  }
+  async delete(appId) {
+    await this.backend.delete(SERVICE_NAME, appId);
+  }
+  resolveFromEnv(envToken) {
+    return {
+      token: envToken,
+      auth_type: detectAuthType(envToken),
+      app_id: "env"
+    };
+  }
+};
+
+// src/auth/config.ts
+import { readFile, mkdir } from "fs/promises";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+var CONFIG_FILE = "config.json";
+function defaultConfigDir() {
+  return join2(homedir2(), ".intercom");
+}
+async function readConfig(configDir) {
+  const dir = configDir ?? defaultConfigDir();
+  try {
+    const raw = await readFile(join2(dir, CONFIG_FILE), "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return { workspaces: {} };
+  }
+}
+async function writeConfig(config, configDir) {
+  const dir = configDir ?? defaultConfigDir();
+  await mkdir(dir, { recursive: true });
+  await atomicWriteFile(join2(dir, CONFIG_FILE), JSON.stringify(config, null, 2) + "\n");
+}
+async function addWorkspace(configDir, workspace) {
+  const config = await readConfig(configDir);
+  config.workspaces[workspace.app_id] = workspace;
+  if (!config.default) {
+    config.default = workspace.app_id;
+  }
+  await writeConfig(config, configDir);
+}
+async function removeWorkspace(configDir, appId) {
+  const config = await readConfig(configDir);
+  delete config.workspaces[appId];
+  if (config.default === appId) {
+    const remaining = Object.keys(config.workspaces);
+    config.default = remaining.length > 0 ? remaining[0] : void 0;
+  }
+  await writeConfig(config, configDir);
+}
+
+// src/commands/helpers.ts
+async function resolveClient(options = {}) {
+  const envToken = process.env.INTERCOM_TOKEN;
+  if (envToken) {
+    return new IntercomClient({
+      token: envToken,
+      authType: detectAuthType(envToken),
+      appId: process.env.INTERCOM_APP_ID ?? "",
+      baseUrl: process.env.INTERCOM_API_BASE_URL || void 0,
+      verbose: options.verbose,
+      maxRetries: options.retry === false ? 0 : void 0,
+      timeoutMs: options.timeout ? parseInt(options.timeout, 10) * 1e3 : void 0
+    });
+  }
+  const configDir = process.env.INTERCOM_CONFIG_DIR;
+  const config = await readConfig(configDir);
+  const appId = options.workspace ?? config.default;
+  if (!appId) {
+    throw new AuthError(
+      'Not authenticated. Run "intercom auth login" to get started.'
+    );
+  }
+  const store = new CredentialStore(createDefaultBackend(configDir));
+  const cred = await store.get(appId);
+  if (!cred) {
+    throw new AuthError(
+      `No credentials found for workspace ${appId}. Run "intercom auth login".`
+    );
+  }
+  return new IntercomClient({
+    token: cred.token,
+    authType: cred.auth_type,
+    appId: cred.app_id,
+    baseUrl: process.env.INTERCOM_API_BASE_URL || void 0,
+    verbose: options.verbose,
+    maxRetries: options.retry === false ? 0 : void 0,
+    timeoutMs: options.timeout ? parseInt(options.timeout, 10) * 1e3 : void 0
+  });
+}
+function parseFieldArgs(fields) {
+  return Object.fromEntries(
+    fields.map((f) => {
+      const eq = f.indexOf("=");
+      if (eq === -1) {
+        throw new CLIError(
+          `Invalid field argument "${f}": expected format key=value`
+        );
+      }
+      return [f.slice(0, eq), f.slice(eq + 1)];
+    })
+  );
+}
+function formatTimestamp(ts) {
+  if (!ts) return "";
+  const n = typeof ts === "number" ? ts : Number(ts);
+  if (isNaN(n)) return String(ts);
+  return new Date(n * 1e3).toISOString().slice(0, 10);
+}
+
+// src/output/render.ts
+function render(data, opts, humanRenderer, listItems) {
+  if (opts.jq) {
+    const filtered = applyJq(data, opts.jq);
+    if (Array.isArray(filtered)) {
+      for (const item of filtered) {
+        console.log(JSON.stringify(item));
+      }
+    } else {
+      console.log(JSON.stringify(filtered));
+    }
+    return;
+  }
+  if (opts.json) {
+    console.log(formatJson(data));
+    return;
+  }
+  if (!process.stdout.isTTY) {
+    if (listItems) {
+      for (const item of listItems) {
+        console.log(JSON.stringify(item));
+      }
+    } else {
+      console.log(JSON.stringify(data));
+    }
+    return;
+  }
+  console.log(humanRenderer());
+}
+
+// src/commands/api.ts
+function parseFields(fields, typed) {
+  const result = {};
+  for (const field of fields) {
+    const eqIndex = field.indexOf("=");
+    if (eqIndex === -1) {
+      throw new CLIError(
+        `Invalid field argument "${field}": expected format key=value`
+      );
+    }
+    const key = field.slice(0, eqIndex);
+    const rawValue = field.slice(eqIndex + 1);
+    if (typed) {
+      if (rawValue === "true") result[key] = true;
+      else if (rawValue === "false") result[key] = false;
+      else if (rawValue === "null") result[key] = null;
+      else if (rawValue.startsWith("@")) {
+        const filePath = rawValue.slice(1);
+        result[key] = readFileSync2(filePath, "utf-8");
+      } else if (/^\d+$/.test(rawValue)) result[key] = parseInt(rawValue, 10);
+      else result[key] = rawValue;
+    } else {
+      result[key] = rawValue;
+    }
+  }
+  return result;
+}
+function registerApiCommand(program) {
+  program.command("api").description("Make an authenticated API request (like gh api)").argument("<endpoint>", "API endpoint path (e.g., /articles)").option("-X, --method <method>", "HTTP method").option("-f, --field <key=value...>", "String field").option(
+    "-F, --typed-field <key=value...>",
+    "Typed field (bools, numbers, file reads)"
+  ).option("--jq <expr>", "Filter response with jq expression").option("--json", "Output as JSON").option("--paginate", "Auto-paginate through all pages").option("--verbose", "Show full HTTP request/response").action(async function(endpoint) {
+    const options = this.optsWithGlobals();
+    const client = await resolveClient(options);
+    const stringFields = options.field ?? [];
+    const typedFields = options.typedField ?? [];
+    const body = {
+      ...parseFields(stringFields, false),
+      ...parseFields(typedFields, true)
+    };
+    const hasBody = stringFields.length > 0 || typedFields.length > 0;
+    const method = options.method ?? (hasBody ? "POST" : "GET");
+    let result;
+    if (options.paginate && method.toUpperCase() === "GET") {
+      result = await client.paginate(
+        endpoint,
+        hasBody ? body : void 0
+      );
+    } else {
+      switch (method.toUpperCase()) {
+        case "GET":
+          result = await client.get(
+            endpoint,
+            hasBody ? body : void 0
+          );
+          break;
+        case "POST":
+          result = await client.post(endpoint, hasBody ? body : void 0);
+          break;
+        case "PUT":
+          result = await client.put(endpoint, hasBody ? body : void 0);
+          break;
+        case "PATCH":
+          result = await client.patch(endpoint, hasBody ? body : void 0);
+          break;
+        case "DELETE":
+          result = await client.delete(endpoint);
+          break;
+        default:
+          throw new CLIError(`Unsupported method: ${method}`);
+      }
+    }
+    let listItems;
+    if (Array.isArray(result)) {
+      listItems = result;
+    } else if (result && typeof result === "object" && Array.isArray(result.data)) {
+      listItems = result.data;
+    }
+    render(result, options, () => formatJson(result), listItems);
+  });
+}
+
+// src/commands/auth/login.ts
+function registerLoginCommand(auth) {
+  auth.command("login").description("Authenticate with Intercom").option("--token <token>", "Authenticate with an API key or token directly").option("--device", "Use device flow (for headless environments)").action(async (options) => {
+    if (options.token) {
+      await loginWithToken(options.token);
+    } else if (options.device) {
+      throw new CLIError("Device flow not yet available. Server-side endpoints required. Use --token for now, or run the browser flow without --device.", 1);
+    } else {
+      throw new CLIError(
+        "OAuth login is not yet available. Use --token <token> or set the INTERCOM_TOKEN environment variable.",
+        1
+      );
+    }
+  });
+}
+async function loginWithToken(token) {
+  const authType = detectAuthType(token);
+  const client = new IntercomClient({
+    token,
+    authType,
+    baseUrl: process.env.INTERCOM_API_BASE_URL || void 0
+  });
+  const me = await client.get("/me");
+  const app = me.app;
+  const appId = app?.id_code ?? me.id;
+  const name = app?.name ?? "Unknown";
+  const configDir = process.env.INTERCOM_CONFIG_DIR;
+  const store = new CredentialStore(createDefaultBackend(configDir));
+  await store.set(appId, { token, auth_type: authType, app_id: appId });
+  await addWorkspace(configDir, { app_id: appId, name });
+  console.log(`Authenticated to ${name} (${appId})`);
+}
+
+// src/auth/cookies.ts
+function extractCookies(response) {
+  const setCookies = typeof response.headers.getSetCookie === "function" ? response.headers.getSetCookie() : (response.headers.get("set-cookie") ?? "").split(/,(?=[^ ])/).filter(Boolean);
+  return setCookies.map((c) => c.split(";")[0]).join("; ");
+}
+function mergeCookies(existing, newCookies) {
+  const map = /* @__PURE__ */ new Map();
+  for (const cookie of [...existing.split("; "), ...newCookies.split("; ")]) {
+    const eqIdx = cookie.indexOf("=");
+    if (eqIdx === -1) continue;
+    const name = cookie.slice(0, eqIdx).trim();
+    const value = cookie.slice(eqIdx + 1);
+    if (name) map.set(name, value);
+  }
+  return Array.from(map.entries()).map(([k, v]) => `${k}=${v}`).join("; ");
+}
+
+// src/auth/signup.ts
+var DEFAULT_APP_BASE_URL = "https://app.intercom.com";
+function getAppBaseUrl() {
+  return process.env.INTERCOM_APP_BASE_URL ?? DEFAULT_APP_BASE_URL;
+}
+var PLAN_SOLUTION_IDS = {
+  essential: 28,
+  advanced: 29,
+  expert: 30
+};
+var CSRF_TOKEN_PATTERN = /<meta\s+name="csrf-token"\s+content="([^"]+)"/;
+async function fetchCsrfToken(url, timeoutMs = API_TIMEOUT_MS, init) {
+  const response = await fetchWithTimeout(url, init ?? {}, { timeoutMs });
+  if (!response.ok)
+    throw new Error(`Failed to fetch ${url}: ${response.status}`);
+  const html = await response.text();
+  const match = CSRF_TOKEN_PATTERN.exec(html);
+  if (!match) throw new Error("Could not find CSRF token");
+  return { token: match[1], cookies: extractCookies(response) };
+}
+async function signup(options) {
+  const {
+    baseUrl,
+    email,
+    name,
+    password,
+    companyName,
+    plan = "advanced",
+    timeoutMs = API_TIMEOUT_MS
+  } = options;
+  const csrfUrl = `${baseUrl}/admins/sign_up/email`;
+  const { token: csrfToken, cookies } = await fetchCsrfToken(
+    csrfUrl,
+    timeoutMs
+  );
+  const solutionId = PLAN_SOLUTION_IDS[plan] ?? PLAN_SOLUTION_IDS["advanced"];
+  const body = {
+    admin: {
+      name,
+      email,
+      password,
+      terms_of_service: true
+    },
+    app: {
+      name: companyName,
+      solution_id: solutionId
+    },
+    pageview: {},
+    email_submission: {},
+    sign_up_locale: "en",
+    new_app_feature_flags: [
+      "synchronously-create-subscription-on-signup",
+      "fin-sdk",
+      "messenger-public-api"
+    ]
+  };
+  const response = await fetchWithTimeout(
+    `${baseUrl}/ember/signups`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-CSRF-Token": csrfToken,
+        Accept: "application/json",
+        ...cookies ? { Cookie: cookies } : {}
+      },
+      body: JSON.stringify(body)
+    },
+    { timeoutMs }
+  );
+  if (response.status === 409) {
+    throw new Error("An account with that email address already exists.");
+  }
+  if (response.status === 422) {
+    const data = await response.json();
+    const msg = data.errors?.join(", ") ?? "Validation error";
+    throw new Error(`Signup validation failed: ${msg}`);
+  }
+  if (response.status === 403) {
+    throw new Error(
+      "Signup blocked (403 Forbidden). The request may have been blocked by WAF."
+    );
+  }
+  if (!response.ok) {
+    throw new Error(`Signup failed with status ${response.status}`);
+  }
+  const workspace = await response.json();
+  return { id: workspace.id, name: workspace.name };
+}
+
+// src/auth/devhub.ts
+async function deviseSignIn(baseUrl, email, password, timeoutMs = API_TIMEOUT_MS) {
+  const signInUrl = `${baseUrl}/admins/sign_in`;
+  const { token: csrfToken, cookies: initialCookies } = await fetchCsrfToken(
+    signInUrl,
+    timeoutMs,
+    { redirect: "manual" }
+  );
+  let cookies = initialCookies;
+  const body = new URLSearchParams({
+    "admin[email]": email,
+    "admin[password]": password,
+    "admin[remember_me]": "1",
+    authenticity_token: csrfToken
+  });
+  const signInResponse = await fetchWithTimeout(
+    signInUrl,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "text/html",
+        ...cookies ? { Cookie: cookies } : {}
+      },
+      body: body.toString(),
+      redirect: "manual"
+    },
+    { timeoutMs }
+  );
+  if (signInResponse.status !== 302 && signInResponse.status !== 301) {
+    throw new Error(
+      `Sign-in returned unexpected status ${signInResponse.status}`
+    );
+  }
+  const location = signInResponse.headers.get("location") ?? "";
+  if (location.includes("/admins/sign_in")) {
+    throw new Error("Invalid credentials");
+  }
+  if (location.includes("two_factor")) {
+    throw new Error(
+      "Two-factor authentication is required. Please use an API key instead."
+    );
+  }
+  cookies = mergeCookies(cookies, extractCookies(signInResponse));
+  return cookies;
+}
+async function findOrCreateAppPackage(baseUrl, cookies, appId, appPackageId, timeoutMs = API_TIMEOUT_MS) {
+  if (appPackageId) {
+    return { id: appPackageId, name: "CLI Access Token", created: false };
+  }
+  const listUrl = `${baseUrl}/ember/developer_home/app_packages?app_id=${appId}`;
+  const listResponse = await fetchWithTimeout(
+    listUrl,
+    {
+      headers: {
+        Accept: "application/json",
+        Cookie: cookies
+      }
+    },
+    { timeoutMs }
+  );
+  if (!listResponse.ok) {
+    throw new Error(`Failed to list app packages: ${listResponse.status}`);
+  }
+  const data = await listResponse.json();
+  const packages = data.app_packages ?? (Array.isArray(data) ? data : []);
+  if (packages.length > 0) {
+    return {
+      id: String(packages[0].id),
+      name: packages[0].name ?? "CLI Access Token",
+      created: false
+    };
+  }
+  let freshCsrf = "";
+  try {
+    const { token, cookies: csrfCookies } = await fetchCsrfToken(
+      `${baseUrl}/admins/sign_in`,
+      timeoutMs,
+      { headers: { Cookie: cookies } }
+    );
+    freshCsrf = token;
+    if (csrfCookies) cookies = mergeCookies(cookies, csrfCookies);
+  } catch {
+  }
+  const createResponse = await fetchWithTimeout(
+    `${baseUrl}/ember/developer_home/app_packages`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        Cookie: cookies,
+        ...freshCsrf ? { "X-CSRF-Token": freshCsrf } : {}
+      },
+      body: JSON.stringify({
+        name: "CLI Access Token",
+        owner_app_id: appId,
+        app_id: appId
+      })
+    },
+    { timeoutMs }
+  );
+  if (!createResponse.ok) {
+    throw new Error(`Failed to create app package: ${createResponse.status}`);
+  }
+  const created = await createResponse.json();
+  const pkg = created.app_package ?? created;
+  return {
+    id: String(pkg.id),
+    name: pkg.name ?? "CLI Access Token",
+    created: true
+  };
+}
+async function fetchAccessToken(baseUrl, cookies, appPackageId, appId, timeoutMs = API_TIMEOUT_MS) {
+  const url = `${baseUrl}/ember/developer_home/app_package_installs?app_package_id=${appPackageId}&only_owner_app=true&app_id=${appId}`;
+  const response = await fetchWithTimeout(
+    url,
+    {
+      headers: {
+        Accept: "application/json",
+        Cookie: cookies
+      }
+    },
+    { timeoutMs }
+  );
+  if (!response.ok) {
+    throw new Error(`Failed to fetch app package installs: ${response.status}`);
+  }
+  const data = await response.json();
+  if (Array.isArray(data)) {
+    const token = data[0]?.access_token;
+    if (token) return token;
+  } else if (data.access_token) {
+    return data.access_token;
+  } else if (data.app_package_installs?.[0]?.access_token) {
+    return data.app_package_installs[0].access_token;
+  }
+  throw new Error("No access token found in app package installs response");
+}
+async function getToken(options) {
+  const { baseUrl, email, password, appId, appPackageId, timeoutMs } = options;
+  const cookies = await deviseSignIn(baseUrl, email, password, timeoutMs);
+  const appPackage = await findOrCreateAppPackage(
+    baseUrl,
+    cookies,
+    appId,
+    appPackageId,
+    timeoutMs
+  );
+  const token = await fetchAccessToken(
+    baseUrl,
+    cookies,
+    appPackage.id,
+    appId,
+    timeoutMs
+  );
+  return { token, appId, appPackage };
+}
+
+// src/auth/password.ts
+async function resolvePassword(options) {
+  const envPassword = process.env.INTERCOM_PASSWORD;
+  if (envPassword) return envPassword;
+  if (options.passwordStdin) {
+    return readStdin();
+  }
+  throw new CLIError(
+    'Password required. Set INTERCOM_PASSWORD env var or pass --password-stdin.\n  Example: INTERCOM_PASSWORD=secret intercom auth bootstrap --email admin@co.com --app-id abc123\n  Example: echo "$PASSWORD" | intercom auth bootstrap --password-stdin --email admin@co.com --app-id abc123'
+  );
+}
+async function readStdin() {
+  if (process.stdin.isTTY) {
+    throw new CLIError(
+      '--password-stdin requires piped input. Stdin is a TTY.\n  Example: echo "$PASSWORD" | intercom auth bootstrap --password-stdin ...'
+    );
+  }
+  return new Promise((resolve, reject) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on("end", () => resolve(data.trim()));
+    process.stdin.on("error", reject);
+  });
+}
+
+// src/commands/auth/bootstrap.ts
+function registerBootstrapCommand(auth) {
+  auth.command("bootstrap").description("Acquire a Developer Hub access token for a workspace").requiredOption("--email <email>", "Admin email address").requiredOption("--app-id <appId>", "Workspace app ID (e.g. abc123de)").option("--app-package-id <id>", "Skip package discovery and use this app package ID").option("--password-stdin", "Read password from stdin (or set INTERCOM_PASSWORD env var)").action(async (options) => {
+    const baseUrl = getAppBaseUrl();
+    try {
+      const password = await resolvePassword({ passwordStdin: options.passwordStdin });
+      const { token, appId, appPackage } = await getToken({
+        baseUrl,
+        email: options.email,
+        password,
+        appId: options.appId,
+        appPackageId: options.appPackageId
+      });
+      console.log("Signed in to Intercom");
+      if (appPackage.created) {
+        console.log(`Created app package: ${appPackage.name} (id: ${appPackage.id})`);
+      } else {
+        console.log(`Found app package: ${appPackage.name} (id: ${appPackage.id})`);
+      }
+      console.log("Access token acquired");
+      const configDir = process.env.INTERCOM_CONFIG_DIR;
+      const store = new CredentialStore(createDefaultBackend(configDir));
+      await store.set(appId, { token, auth_type: "oauth", app_id: appId });
+      await addWorkspace(configDir, { app_id: appId, name: appId });
+      console.log(`
+Authenticated to workspace ${appId}`);
+    } catch (err) {
+      if (err instanceof CLIError) throw err;
+      const message = err instanceof Error ? err.message : String(err);
+      throw new CLIError(message);
+    }
+  });
+}
+
+// src/output/formatter.ts
+function table({ columns, rows }) {
+  if (rows.length === 0) return "";
+  const widths = columns.map(
+    (col) => Math.max(col.length, ...rows.map((row) => (row[col] ?? "").length))
+  );
+  const formatRow = (values) => values.map((val, i) => i < values.length - 1 ? val.padEnd(widths[i]) : val).join("  ");
+  const header = formatRow(columns);
+  const body = rows.map(
+    (row) => formatRow(columns.map((col) => row[col] ?? ""))
+  );
+  return [header, ...body].join("\n");
+}
+function detail(data) {
+  const entries = Object.entries(data).filter(
+    ([, v]) => v !== null && v !== void 0
+  );
+  if (entries.length === 0) return "";
+  const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+  return entries.map(([key, value]) => `${key.padEnd(maxKeyLen)}:  ${value}`).join("\n");
+}
+
+// src/commands/auth/status.ts
+function registerStatusCommand(auth) {
+  auth.command("status").description("Show current authentication status").option("--json", "Output as JSON").action(async (options) => {
+    const configDir = process.env.INTERCOM_CONFIG_DIR;
+    const config = await readConfig(configDir);
+    const appId = config.default;
+    if (!appId) {
+      throw new AuthError('Not authenticated. Run "intercom auth login" to get started.');
+    }
+    const store = new CredentialStore(createDefaultBackend(configDir));
+    const cred = await store.get(appId);
+    if (!cred) {
+      throw new AuthError('Not authenticated. Run "intercom auth login" to get started.');
+    }
+    const workspace = config.workspaces[appId];
+    if (options.json) {
+      console.log(formatJson({
+        app_id: cred.app_id,
+        workspace_name: workspace?.name ?? cred.workspace_name,
+        auth_type: cred.auth_type,
+        expires_at: cred.expires_at ?? null
+      }));
+    } else {
+      console.log(detail({
+        "Workspace": workspace?.name ?? cred.workspace_name ?? cred.app_id,
+        "App ID": cred.app_id,
+        "Auth type": cred.auth_type,
+        "Expires": cred.expires_at ?? void 0
+      }));
+    }
+  });
+}
+
+// src/commands/auth/logout.ts
+function registerLogoutCommand(auth) {
+  auth.command("logout").description("Remove stored credentials").option("--workspace <id>", "Workspace app_id to log out of").action(async (options) => {
+    const configDir = process.env.INTERCOM_CONFIG_DIR;
+    const config = await readConfig(configDir);
+    const appId = options.workspace ?? config.default;
+    if (!appId) {
+      throw new AuthError("Not authenticated.");
+    }
+    const store = new CredentialStore(createDefaultBackend(configDir));
+    await store.delete(appId);
+    await removeWorkspace(configDir, appId);
+    const name = config.workspaces[appId]?.name ?? appId;
+    console.log(`Logged out of ${name} (${appId})`);
+  });
+}
+
+// src/commands/auth/signup.ts
+function registerSignupCommand(auth) {
+  auth.command("signup").description("Create a new Intercom workspace").requiredOption("--email <email>", "Admin email address").requiredOption("--name <name>", "Admin full name").requiredOption("--company <company>", "Workspace/company name").option("--password-stdin", "Read password from stdin (or set INTERCOM_PASSWORD env var)").option("--plan <plan>", "Trial plan: essential, advanced, or expert", "advanced").action(async (options) => {
+    const validPlans = ["essential", "advanced", "expert"];
+    if (!validPlans.includes(options.plan)) {
+      throw new CLIError(`Unknown plan "${options.plan}". Valid options: ${validPlans.join(", ")}`);
+    }
+    const baseUrl = getAppBaseUrl();
+    try {
+      const password = await resolvePassword({ passwordStdin: options.passwordStdin });
+      const workspace = await signup({
+        baseUrl,
+        email: options.email,
+        name: options.name,
+        password,
+        companyName: options.company,
+        plan: options.plan
+      });
+      console.log("Workspace created successfully!");
+      console.log(
+        detail({
+          Name: workspace.name,
+          "Workspace ID": workspace.id,
+          URL: `${baseUrl}/a/apps/${workspace.id}`
+        })
+      );
+    } catch (err) {
+      if (err instanceof CLIError) throw err;
+      const message = err instanceof Error ? err.message : String(err);
+      throw new CLIError(message);
+    }
+  });
+}
+
+// src/commands/auth/verify-email.ts
+function registerVerifyEmailCommand(auth) {
+  auth.command("verify-email").description(
+    'Verify workspace email address. After signup, Intercom sends a verification email.\nProvide the verification URL from that email, or verify manually in your browser.\n\nOption 1 \u2014 Manual verification (recommended for humans):\n  1. Open the inbox for the email address you signed up with\n  2. Find the email from Intercom (team@intercom.io) with subject\n     "Verify your email address on Intercom" (check spam if not found)\n  3. Click the "Verify your email" button in the email\n  4. You should see a redirect to the Intercom getting-started page\n  5. Once verified, you can skip this command entirely\n\nOption 2 \u2014 Provide the verification URL to this command:\n  intercom auth verify-email --url <url>\n\nOption 3 \u2014 Retrieve the URL automatically with a mail CLI:\n  Google Workspace (gog): gog gmail messages search "from:team@intercom.io verify email"\n    Then: gog gmail get <message_id> | grep verify_email\n  Google Workspace (gws): gws gmail search "from:team@intercom.io verify email"\n  Any tool that can read the inbox will work \u2014 the URL looks like:\n    https://app.intercom.com/admins/<uuid>/verify_email?...'
+  ).requiredOption("--url <url>", "Verification URL from the email").action(async (options) => {
+    const url = options.url;
+    if (!url.includes("verify_email")) {
+      throw new CLIError(
+        "URL does not look like a verification link. Expected format:\n  https://app.intercom.com/admins/<uuid>/verify_email?..."
+      );
+    }
+    const response = await fetchWithTimeout(url, { redirect: "manual" }, { timeoutMs: API_TIMEOUT_MS });
+    if (response.status === 302 || response.status === 301) {
+      const location = response.headers.get("location") ?? "";
+      if (location.includes("sign_in") || location.includes("getting-started") || location.includes("apps/")) {
+        console.log("Email verified successfully!");
+        return;
+      }
+    }
+    if (response.status === 200) {
+      console.log("Email verified successfully!");
+      return;
+    }
+    throw new CLIError(
+      `Email verification returned unexpected status ${response.status}. The link may have expired \u2014 check for a newer verification email.`
+    );
+  });
+}
+
+// src/commands/auth/index.ts
+function registerAuthCommand(program) {
+  const auth = program.command("auth").description("Manage authentication credentials");
+  registerLoginCommand(auth);
+  registerBootstrapCommand(auth);
+  registerStatusCommand(auth);
+  registerLogoutCommand(auth);
+  registerSignupCommand(auth);
+  registerVerifyEmailCommand(auth);
+}
+
+// src/commands/me.ts
+function registerMeCommand(program) {
+  program.command("me").description("Show current authenticated admin and workspace info").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").action(async function(options) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const me = await client.get("/me");
+    const app = me.app;
+    render(
+      me,
+      opts,
+      () => detail({
+        "Name": me.name,
+        "Email": me.email,
+        "App ID": app?.id_code ?? me.app_id,
+        "Type": me.type
+      })
+    );
+  });
+}
+
+// src/output/html.ts
+import TurndownService from "turndown";
+var turndown = new TurndownService({
+  headingStyle: "atx",
+  bulletListMarker: "-"
+});
+function htmlToText(html) {
+  if (!html) return "";
+  return turndown.turndown(html).trim();
+}
+
+// src/commands/articles.ts
+function registerArticlesCommand(program) {
+  const articles = program.command("articles").description("Manage help center articles");
+  articles.command("list").description("List help center articles").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").option("--limit <n>", "Max results to return", "25").option("--all", "Auto-paginate all pages").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    let result;
+    if (opts.all) {
+      const allItems = await client.paginate("/articles", { per_page: "25" });
+      result = { type: "list", data: allItems };
+    } else {
+      const limit = opts.limit ?? "25";
+      result = await client.get("/articles", { per_page: limit });
+    }
+    const response = result;
+    const items = response.data ?? [];
+    render(
+      result,
+      opts,
+      () => {
+        const rows = items.map((a) => ({
+          ID: String(a.id ?? ""),
+          TITLE: String(a.title ?? ""),
+          STATE: String(a.state ?? ""),
+          UPDATED: formatTimestamp(a.updated_at)
+        }));
+        return table({ columns: ["ID", "TITLE", "STATE", "UPDATED"], rows });
+      },
+      items
+    );
+  });
+  articles.command("get <id>").description("Get a help center article by ID").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get(`/articles/${id}`);
+    render(result, opts, () => {
+      const meta = detail({
+        ID: String(result.id ?? ""),
+        Title: String(result.title ?? ""),
+        State: String(result.state ?? ""),
+        "Author ID": result.author_id != null ? String(result.author_id) : void 0,
+        Updated: formatTimestamp(result.updated_at),
+        Created: formatTimestamp(result.created_at)
+      });
+      const body = typeof result.body === "string" ? htmlToText(result.body) : "";
+      return body ? `${meta}
+
+${body}` : meta;
+    });
+  });
+  articles.command("create").description("Create a help center article").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    if (body.author_id && typeof body.author_id === "string") {
+      const parsed = parseInt(body.author_id, 10);
+      if (!isNaN(parsed)) body.author_id = parsed;
+    }
+    const result = await client.post("/articles", body);
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(result.id ?? ""),
+        Title: String(result.title ?? ""),
+        State: String(result.state ?? "")
+      })
+    );
+  });
+  articles.command("update <id>").description("Update a help center article").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    if (body.author_id && typeof body.author_id === "string") {
+      const parsed = parseInt(body.author_id, 10);
+      if (!isNaN(parsed)) body.author_id = parsed;
+    }
+    const result = await client.put(`/articles/${id}`, body);
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(result.id ?? ""),
+        Title: String(result.title ?? ""),
+        State: String(result.state ?? "")
+      })
+    );
+  });
+  articles.command("delete <id>").description("Delete a help center article").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.delete(`/articles/${id}`);
+    const deleted = result;
+    render(result, opts, () => `Deleted article ${deleted.id ?? id}`);
+  });
+}
+
+// src/commands/contacts.ts
+function registerContactsCommand(program) {
+  const contacts = program.command("contacts").description("Manage contacts");
+  contacts.command("list").description("List contacts").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").option("--limit <n>", "Max results to return", "25").option("--all", "Auto-paginate all pages").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    let result;
+    if (opts.all) {
+      const allItems = await client.paginate("/contacts", { per_page: "25" });
+      result = { type: "list", data: allItems };
+    } else {
+      const limit = opts.limit ?? "25";
+      result = await client.get("/contacts", { per_page: limit });
+    }
+    const response = result;
+    const items = response.data ?? [];
+    render(
+      result,
+      opts,
+      () => {
+        const rows = items.map((c) => ({
+          ID: String(c.id ?? ""),
+          EMAIL: String(c.email ?? ""),
+          NAME: String(c.name ?? ""),
+          ROLE: String(c.role ?? ""),
+          UPDATED: formatTimestamp(c.updated_at)
+        }));
+        return table({
+          columns: ["ID", "EMAIL", "NAME", "ROLE", "UPDATED"],
+          rows
+        });
+      },
+      items
+    );
+  });
+  contacts.command("get <id>").description("Get a contact by ID").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get(`/contacts/${id}`);
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(result.id ?? ""),
+        Name: result.name != null ? String(result.name) : void 0,
+        Email: result.email != null ? String(result.email) : void 0,
+        Role: String(result.role ?? ""),
+        Created: formatTimestamp(result.created_at),
+        Updated: formatTimestamp(result.updated_at)
+      })
+    );
+  });
+  contacts.command("create").description("Create a contact").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    const result = await client.post("/contacts", body);
+    const r = result;
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(r.id ?? ""),
+        Name: r.name != null ? String(r.name) : void 0,
+        Email: r.email != null ? String(r.email) : void 0,
+        Role: String(r.role ?? "")
+      })
+    );
+  });
+  contacts.command("update <id>").description("Update a contact").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    const result = await client.put(`/contacts/${id}`, body);
+    const r = result;
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(r.id ?? ""),
+        Name: r.name != null ? String(r.name) : void 0,
+        Email: r.email != null ? String(r.email) : void 0,
+        Role: String(r.role ?? "")
+      })
+    );
+  });
+  contacts.command("delete <id>").description("Delete a contact").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.delete(`/contacts/${id}`);
+    const deleted = result;
+    render(result, opts, () => `Deleted contact ${deleted.id ?? id}`);
+  });
+}
+
+// src/commands/conversations.ts
+function formatDatetime(ts) {
+  if (!ts) return "";
+  const n = typeof ts === "number" ? ts : Number(ts);
+  if (isNaN(n)) return String(ts);
+  return new Date(n * 1e3).toISOString().slice(0, 16).replace("T", " ");
+}
+function renderConversationStream(result) {
+  const parts = [];
+  parts.push(
+    detail({
+      ID: String(result.id ?? ""),
+      State: String(result.state ?? ""),
+      Open: String(result.open ?? ""),
+      Created: formatTimestamp(result.created_at),
+      Updated: formatTimestamp(result.updated_at)
+    })
+  );
+  const source = result.source;
+  const partsData = result.conversation_parts;
+  const convParts = partsData?.conversation_parts ?? [];
+  if (!source && convParts.length === 0) return parts.join("\n");
+  parts.push("");
+  parts.push("\u2500\u2500 Conversation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (source) {
+    const authorName = source.author?.name ?? "Unknown";
+    const authorType = source.author?.type ?? "user";
+    const body = htmlToText(source.body);
+    parts.push("");
+    parts.push(
+      `${authorName} (${authorType}) \xB7 ${formatDatetime(result.created_at)}`
+    );
+    if (body) parts.push(body);
+  }
+  for (const part of convParts) {
+    const author = part.author;
+    const authorName = author?.name ?? "System";
+    const authorType = author?.type ?? "bot";
+    const partType = String(part.part_type ?? "unknown");
+    const body = htmlToText(part.body);
+    const ts = formatDatetime(part.created_at);
+    parts.push("");
+    switch (partType) {
+      case "comment":
+        parts.push(`${authorName} (${authorType}) \xB7 ${ts}`);
+        if (body) parts.push(body);
+        break;
+      case "note":
+        parts.push(`[note] ${authorName} (${authorType}) \xB7 ${ts}`);
+        if (body) parts.push(body);
+        break;
+      case "assignment": {
+        const assignedTo = part.assigned_to;
+        parts.push(`[assignment] ${authorName} (${authorType}) \xB7 ${ts}`);
+        if (assignedTo?.name) parts.push(`Assigned to ${assignedTo.name}`);
+        break;
+      }
+      case "close":
+        parts.push(`[closed] ${authorName} (${authorType}) \xB7 ${ts}`);
+        if (body) parts.push(body);
+        break;
+      case "open":
+        parts.push(`[opened] ${authorName} (${authorType}) \xB7 ${ts}`);
+        if (body) parts.push(body);
+        break;
+      default:
+        parts.push(`[${partType}] ${authorName} (${authorType}) \xB7 ${ts}`);
+        if (body) parts.push(body);
+        break;
+    }
+  }
+  return parts.join("\n");
+}
+function registerConversationsCommand(program) {
+  const conversations = program.command("conversations").description("Manage conversations");
+  conversations.command("list").description("List conversations").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").option("--limit <n>", "Max results to return", "25").option("--all", "Auto-paginate all pages").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    let result;
+    if (opts.all) {
+      const allItems = await client.paginate(
+        "/conversations",
+        { per_page: "25" },
+        "conversations"
+      );
+      result = { type: "conversation.list", conversations: allItems };
+    } else {
+      const limit = opts.limit ?? "25";
+      result = await client.get("/conversations", { per_page: limit });
+    }
+    const response = result;
+    const items = response.conversations ?? [];
+    render(
+      result,
+      opts,
+      () => {
+        const rows = items.map((c) => ({
+          ID: String(c.id ?? ""),
+          STATE: String(c.state ?? ""),
+          OPEN: String(c.open ?? ""),
+          CREATED: formatTimestamp(c.created_at),
+          UPDATED: formatTimestamp(c.updated_at)
+        }));
+        return table({
+          columns: ["ID", "STATE", "OPEN", "CREATED", "UPDATED"],
+          rows
+        });
+      },
+      items
+    );
+  });
+  conversations.command("get <id>").description("Get a conversation by ID").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get(`/conversations/${id}`);
+    render(result, opts, () => {
+      const r = result;
+      return renderConversationStream(r);
+    });
+  });
+  conversations.command("reply <id>").description("Reply to a conversation").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    const result = await client.post(`/conversations/${id}/reply`, body);
+    const r = result;
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(r.id ?? ""),
+        Type: String(r.type ?? ""),
+        Body: r.body != null ? String(r.body) : void 0
+      })
+    );
+  });
+}
+
+// src/commands/help-center.ts
+function registerHelpCenterCommand(program) {
+  const helpCenter = program.command("help-center").description("Manage help center collections");
+  helpCenter.command("list").description("List help center collections").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").option("--limit <n>", "Max results to return", "25").option("--all", "Auto-paginate all pages").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    let result;
+    if (opts.all) {
+      const allItems = await client.paginate("/help_center/collections", {
+        per_page: "25"
+      });
+      result = { type: "list", data: allItems };
+    } else {
+      const limit = opts.limit ?? "25";
+      result = await client.get("/help_center/collections", {
+        per_page: limit
+      });
+    }
+    const response = result;
+    const items = response.data ?? [];
+    render(
+      result,
+      opts,
+      () => {
+        const rows = items.map((c) => ({
+          ID: String(c.id ?? ""),
+          NAME: String(c.name ?? ""),
+          DESCRIPTION: String(c.description ?? ""),
+          UPDATED: formatTimestamp(c.updated_at)
+        }));
+        return table({
+          columns: ["ID", "NAME", "DESCRIPTION", "UPDATED"],
+          rows
+        });
+      },
+      items
+    );
+  });
+  helpCenter.command("get <id>").description("Get a help center collection by ID").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get(`/help_center/collections/${id}`);
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(result.id ?? ""),
+        Name: String(result.name ?? ""),
+        Description: result.description != null ? String(result.description) : void 0,
+        Updated: formatTimestamp(result.updated_at),
+        Created: formatTimestamp(result.created_at)
+      })
+    );
+  });
+  helpCenter.command("create").description("Create a help center collection").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    const result = await client.post("/help_center/collections", body);
+    const r = result;
+    render(
+      result,
+      opts,
+      () => detail({
+        ID: String(r.id ?? ""),
+        Name: String(r.name ?? ""),
+        Description: r.description != null ? String(r.description) : void 0
+      })
+    );
+  });
+}
+
+// src/commands/messenger.ts
+var UNSTABLE_HEADERS = { "Intercom-Version": "Unstable" };
+function generateHtmlSnippet(appId) {
+  return `<script>
+  window.intercomSettings = { api_base: "https://api-iam.intercom.io", app_id: "${appId}" };
+  (function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',w.intercomSettings);}else{var d=document;var i=function(){i.c(arguments);};i.q=[];i.c=function(args){i.q.push(args);};w.Intercom=i;var l=function(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='https://widget.intercom.io/widget/${appId}';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s,x);};if(document.readyState==='complete'){l();}else if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}}})();
+</script>`;
+}
+function generateReactSnippet(appId) {
+  return `import { useEffect } from "react";
+
+export function IntercomWidget() {
+  useEffect(() => {
+    window.intercomSettings = { api_base: "https://api-iam.intercom.io", app_id: "${appId}" };
+    (function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',w.intercomSettings);}else{var d=document;var i=function(){i.c(arguments);};i.q=[];i.c=function(args){i.q.push(args);};w.Intercom=i;var l=function(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='https://widget.intercom.io/widget/${appId}';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s,x);};if(document.readyState==='complete'){l();}else if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}}})();
+  }, []);
+  return null;
+}`;
+}
+function registerMessengerCommand(program) {
+  const messenger = program.command("messenger").description("Manage Intercom Messenger settings");
+  messenger.command("get").description("Get Messenger settings").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get("/messenger", void 0, UNSTABLE_HEADERS);
+    const r = result;
+    render(
+      result,
+      opts,
+      () => detail({
+        "Color": r.secondary_color != null ? String(r.secondary_color) : void 0,
+        "Alignment": r.alignment != null ? String(r.alignment) : void 0,
+        "Theme": r.theme_mode != null ? String(r.theme_mode) : void 0,
+        "Background": r.background_type != null ? String(r.background_type) : void 0,
+        "Launcher (Users)": r.messenger_enabled_for_users != null ? String(r.messenger_enabled_for_users) : void 0,
+        "Launcher (Visitors)": r.messenger_enabled_for_visitors != null ? String(r.messenger_enabled_for_visitors) : void 0,
+        "Launcher (Mobile)": r.messenger_enabled_for_mobile_users != null ? String(r.messenger_enabled_for_mobile_users) : void 0,
+        "Inbound (Users)": r.inbound_conversations_enabled_for_users != null ? String(r.inbound_conversations_enabled_for_users) : void 0,
+        "Inbound (Visitors)": r.inbound_conversations_enabled_for_visitors != null ? String(r.inbound_conversations_enabled_for_visitors) : void 0
+      })
+    );
+  });
+  messenger.command("update").description("Update Messenger settings").option(
+    "-f, --field <key=value>",
+    "Field to set (repeatable)",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const body = parseFieldArgs(opts.field ?? []);
+    const result = await client.put("/messenger", body, UNSTABLE_HEADERS);
+    const r = result;
+    render(
+      result,
+      opts,
+      () => detail({
+        "Color": r.secondary_color != null ? String(r.secondary_color) : void 0,
+        "Alignment": r.alignment != null ? String(r.alignment) : void 0,
+        "Theme": r.theme_mode != null ? String(r.theme_mode) : void 0,
+        "Background": r.background_type != null ? String(r.background_type) : void 0,
+        "Launcher (Users)": r.messenger_enabled_for_users != null ? String(r.messenger_enabled_for_users) : void 0,
+        "Launcher (Visitors)": r.messenger_enabled_for_visitors != null ? String(r.messenger_enabled_for_visitors) : void 0,
+        "Launcher (Mobile)": r.messenger_enabled_for_mobile_users != null ? String(r.messenger_enabled_for_mobile_users) : void 0,
+        "Inbound (Users)": r.inbound_conversations_enabled_for_users != null ? String(r.inbound_conversations_enabled_for_users) : void 0,
+        "Inbound (Visitors)": r.inbound_conversations_enabled_for_visitors != null ? String(r.inbound_conversations_enabled_for_visitors) : void 0
+      })
+    );
+  });
+  messenger.command("snippet").description("Generate the Intercom Messenger JavaScript install snippet").option(
+    "--format <format>",
+    "Output format: html (default) or react",
+    "html"
+  ).option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const me = await client.get("/me");
+    const app = me.app;
+    const appId = String(app?.id_code ?? "");
+    if (opts.format === "react") {
+      console.log(generateReactSnippet(appId));
+    } else {
+      console.log(generateHtmlSnippet(appId));
+    }
+  });
+}
+
+// src/commands/fin/guidance.ts
+function registerGuidanceCommand(fin) {
+  const guidance = fin.command("guidance").description("Manage Fin SDK guidance");
+  guidance.command("list").description("List guidance from the Fin SDK manifest").option("--json", "Output as JSON").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get("/fin-sdk/manifest");
+    const manifest = result;
+    const items = manifest.guidance ?? [];
+    render(items, opts, () => {
+      if (items.length === 0) {
+        return "No guidance found.";
+      }
+      const rows = items.map((item) => ({
+        ID: String(item.id ?? ""),
+        NAME: String(item.name ?? "")
+      }));
+      return table({ columns: ["ID", "NAME"], rows });
+    }, items);
+  });
+  guidance.command("get <id>").description("Download a guidance item by ID and print its YAML content").option("--verbose", "Show HTTP request/response details").action(async function(id) {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const text = await client.getText(`/fin-sdk/guidance/${id}/download`);
+    console.log(text);
+  });
+}
+
+// src/auth/ember-session.ts
+async function getEmberSession(options) {
+  const { email, password, appId, verifyEmailUrl, timeoutMs = API_TIMEOUT_MS } = options;
+  const baseUrl = getAppBaseUrl();
+  let cookies = await deviseSignIn(baseUrl, email, password, timeoutMs);
+  if (verifyEmailUrl) {
+    const verifyResponse = await fetchWithTimeout(verifyEmailUrl, {
+      headers: { Cookie: cookies },
+      redirect: "manual"
+    }, { timeoutMs });
+    const newCookies = extractCookies2(verifyResponse);
+    if (newCookies) cookies = mergeCookies2(cookies, newCookies);
+  }
+  const appResponse = await fetchWithTimeout(`${baseUrl}/a/apps/${appId}`, {
+    headers: { Cookie: cookies }
+  }, { timeoutMs });
+  const appCookies = extractCookies2(appResponse);
+  if (appCookies) cookies = mergeCookies2(cookies, appCookies);
+  const html = await appResponse.text();
+  const csrfMatch = /<meta\s+name="csrf-token"\s+content="([^"]+)"/.exec(html);
+  if (!csrfMatch) {
+    throw new Error("Failed to get CSRF token from app page. Email may not be verified.");
+  }
+  return { cookies, csrf: csrfMatch[1], appId };
+}
+async function emberRequest(session, path, options = {}) {
+  const { method = "GET", body, timeoutMs = API_TIMEOUT_MS } = options;
+  const baseUrl = getAppBaseUrl();
+  const headers = {
+    Accept: "application/json",
+    "X-CSRF-Token": session.csrf,
+    Cookie: session.cookies
+  };
+  const fetchOptions = { method, headers };
+  if (body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    fetchOptions.body = JSON.stringify(body);
+  }
+  const response = await fetchWithTimeout(
+    `${baseUrl}${path}`,
+    fetchOptions,
+    { timeoutMs }
+  );
+  const text = await response.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    data = text;
+  }
+  return { status: response.status, data };
+}
+function extractCookies2(response) {
+  const setCookies = typeof response.headers.getSetCookie === "function" ? response.headers.getSetCookie() : (response.headers.get("set-cookie") ?? "").split(/,(?=[^ ])/).filter(Boolean);
+  return setCookies.map((c) => c.split(";")[0]).join("; ");
+}
+function mergeCookies2(existing, newCookies) {
+  const map = /* @__PURE__ */ new Map();
+  for (const cookie of [...existing.split("; "), ...newCookies.split("; ")]) {
+    const eqIdx = cookie.indexOf("=");
+    if (eqIdx === -1) continue;
+    const name = cookie.slice(0, eqIdx).trim();
+    const value = cookie.slice(eqIdx + 1);
+    if (name) map.set(name, value);
+  }
+  return Array.from(map.entries()).map(([k, v]) => `${k}=${v}`).join("; ");
+}
+
+// src/commands/fin/enable.ts
+function registerFinEnableCommand(fin) {
+  fin.command("enable").description(
+    "Enable Fin AI Agent on the workspace.\n\nThis opts the workspace into Fin and activates it to answer conversations.\nRequires email/password authentication (ember session)."
+  ).requiredOption("--email <email>", "Admin email address").option("--password-stdin", "Read password from stdin (or set INTERCOM_PASSWORD)").option("--verify-email-url <url>", "Email verification URL (if email not yet verified)").option("--verbose", "Show detailed output").action(async function() {
+    const opts = this.optsWithGlobals();
+    const password = await resolvePassword({ passwordStdin: opts.passwordStdin });
+    const configDir = process.env.INTERCOM_CONFIG_DIR;
+    const config = await readConfig(configDir);
+    const appId = opts.workspace ?? config.default;
+    if (!appId) {
+      throw new CLIError(
+        'No workspace configured. Run "intercom auth signup" or "intercom auth login" first.'
+      );
+    }
+    if (opts.verbose) {
+      console.log(`Workspace: ${appId}`);
+      console.log(`Email: ${opts.email}`);
+    }
+    console.log("Signing in...");
+    const session = await getEmberSession({
+      email: opts.email,
+      password,
+      appId,
+      verifyEmailUrl: opts.verifyEmailUrl
+    });
+    console.log("Enabling Fin...");
+    const optIn = await emberRequest(session, "/ember/fin_opt_in", {
+      method: "POST",
+      body: { app_id: appId }
+    });
+    if (optIn.status === 200) {
+      console.log("\u2713 Fin opted in");
+    } else if (optIn.status === 409) {
+      console.log("\u2713 Fin already opted in");
+    } else {
+      throw new CLIError(
+        `Fin opt-in failed (${optIn.status}). ` + (optIn.status === 403 ? "Email may not be verified \u2014 use --verify-email-url." : JSON.stringify(optIn.data))
+      );
+    }
+    console.log("Checking Fin configuration...");
+    const profile = await emberRequest(
+      session,
+      `/ember/operator_workflows/fin_setup_behavior?app_id=${appId}`
+    );
+    if (profile.status === 204) {
+      throw new CLIError(
+        "Fin setup profile not found. The workspace may not have Fin available on this plan."
+      );
+    }
+    if (profile.status !== 200) {
+      throw new CLIError(
+        `Failed to get Fin profile (${profile.status}): ${JSON.stringify(profile.data)}`
+      );
+    }
+    const profileData = profile.data;
+    const rulesetId = profileData.id;
+    const state = profileData.state;
+    if (opts.verbose) {
+      console.log(`  Ruleset ID: ${rulesetId}, current state: ${state}`);
+    }
+    if (state === 1) {
+      console.log("\u2713 Fin already active");
+    } else {
+      console.log("Activating Fin...");
+      const activate = await emberRequest(
+        session,
+        `/ember/matching_system/rulesets/${rulesetId}/activate?app_id=${appId}`,
+        { method: "PUT", body: {} }
+      );
+      if (activate.status === 200) {
+        const result = activate.data;
+        if (result.state === 1) {
+          console.log("\u2713 Fin activated!");
+        } else {
+          console.log(`\u26A0 Activation returned state ${result.state}`);
+        }
+      } else {
+        throw new CLIError(
+          `Fin activation failed (${activate.status}): ${JSON.stringify(activate.data)}`
+        );
+      }
+    }
+    console.log(`
+Fin is live on workspace ${appId}`);
+  });
+}
+
+// src/commands/fin.ts
+function renderResourceTable(label, items) {
+  if (items.length === 0) {
+    return `${label}:
+  (none)`;
+  }
+  const rows = items.map((item) => ({
+    ID: String(item.id ?? ""),
+    NAME: String(item.name ?? "")
+  }));
+  return `${label}:
+${table({ columns: ["ID", "NAME"], rows })}`;
+}
+function registerFinCommand(program) {
+  const fin = program.command("fin").description("Manage Fin SDK resources");
+  fin.command("manifest").description("Show the Fin SDK manifest for this workspace").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output with jq expression").option("--verbose", "Show HTTP request/response details").action(async function() {
+    const opts = this.optsWithGlobals();
+    const client = await resolveClient(opts);
+    const result = await client.get("/fin-sdk/manifest");
+    const manifest = result;
+    render(result, opts, () => {
+      const ws = manifest.workspace ?? {};
+      const lines = [];
+      lines.push(detail({
+        "Workspace": ws.name,
+        "App ID": ws.app_id != null ? String(ws.app_id) : void 0,
+        "App ID Code": ws.app_id_code
+      }));
+      lines.push("");
+      lines.push(renderResourceTable("Procedures", manifest.procedures ?? []));
+      lines.push("");
+      lines.push(renderResourceTable("Tasks", manifest.tasks ?? []));
+      lines.push("");
+      lines.push(renderResourceTable("Data Connectors", manifest.data_connectors ?? []));
+      lines.push("");
+      lines.push(renderResourceTable("Guidance", manifest.guidance ?? []));
+      return lines.join("\n");
+    });
+  });
+  registerFinEnableCommand(fin);
+  registerGuidanceCommand(fin);
+}
+
+// src/commands/setup.ts
+import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
+import { join as join3, basename } from "path";
+function isGreenfield(opts) {
+  return !!(opts.email && opts.name && (process.env.INTERCOM_PASSWORD || opts.passwordStdin));
+}
+function hasPartialGreenfieldFlags(opts) {
+  const hasPassword = !!(process.env.INTERCOM_PASSWORD || opts.passwordStdin);
+  return !!(opts.email && hasPassword && !opts.name);
+}
+function buildPlan(opts) {
+  const steps = [];
+  let stepNum = 1;
+  const greenfield = isGreenfield(opts);
+  if (greenfield) {
+    const company = opts.companyName ?? "<company-name>";
+    steps.push({
+      step: stepNum++,
+      description: "Create a new Intercom workspace",
+      commands: [
+        `INTERCOM_PASSWORD=*** intercom auth signup --email "${opts.email}" --name "${opts.name}" --company "${company}"`
+      ]
+    });
+    steps.push({
+      step: stepNum++,
+      description: "Bootstrap authentication token",
+      commands: [
+        `INTERCOM_PASSWORD=*** intercom auth bootstrap --email "${opts.email}" --app-id <workspace_id>`
+      ]
+    });
+  }
+  if (opts.companyName) {
+    steps.push({
+      step: stepNum++,
+      description: "Configure Messenger branding",
+      commands: [
+        `intercom messenger update -f name="${opts.companyName}"`
+      ]
+    });
+  } else {
+    steps.push({
+      step: stepNum++,
+      description: "Configure Messenger branding",
+      commands: [
+        `intercom messenger update -f name="<your-company-name>"`
+      ]
+    });
+  }
+  steps.push({
+    step: stepNum++,
+    description: "Get Messenger install snippet",
+    commands: [
+      `intercom messenger snippet --format html`
+    ]
+  });
+  const helpCenterName = opts.companyName ? `${opts.companyName} Help` : "<your-company-name> Help";
+  steps.push({
+    step: stepNum++,
+    description: "Create help center collection",
+    commands: [
+      `intercom help-center create -f name="${helpCenterName}"`
+    ]
+  });
+  if (opts.articlesFrom) {
+    let mdFiles = [];
+    try {
+      mdFiles = readdirSync(opts.articlesFrom).filter((f) => f.endsWith(".md"));
+    } catch {
+      mdFiles = [];
+    }
+    if (mdFiles.length > 0) {
+      const articleCommands = mdFiles.map((file) => {
+        const title = basename(file, ".md").replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+        return `intercom articles create -f title="${title}" -F body=@${join3(opts.articlesFrom, file)}`;
+      });
+      steps.push({
+        step: stepNum++,
+        description: `Create ${mdFiles.length} article(s) from ${opts.articlesFrom}`,
+        commands: articleCommands
+      });
+    } else {
+      steps.push({
+        step: stepNum++,
+        description: `Create articles from ${opts.articlesFrom}`,
+        commands: [
+          `intercom articles create -f title="<article-title>" -F body=@${opts.articlesFrom}/<file>.md`
+        ]
+      });
+    }
+  }
+  steps.push({
+    step: stepNum++,
+    description: "Verify Fin SDK access and view configuration",
+    commands: [
+      `intercom fin manifest`
+    ]
+  });
+  return steps;
+}
+function formatPlanText(steps) {
+  const lines = ["Steps to complete Intercom setup:"];
+  for (const step of steps) {
+    lines.push(`${step.step}. ${step.commands[0]}`);
+    for (let i = 1; i < step.commands.length; i++) {
+      lines.push(`   ${step.commands[i]}`);
+    }
+  }
+  return lines.join("\n");
+}
+async function runPostAuthSteps(client, opts, results, appId) {
+  const messengerBody = {};
+  if (opts.companyName) messengerBody.name = opts.companyName;
+  await client.put("/messenger", messengerBody, { "Intercom-Version": "Unstable" });
+  results.push(`\u2713 Messenger configured${opts.companyName ? ` (${opts.companyName})` : ""}`);
+  const helpCenterName = opts.companyName ? `${opts.companyName} Help` : "Help Center";
+  const collections = await client.paginate("/help_center/collections");
+  const existingCollection = collections.find(
+    (c) => String(c.name ?? "") === helpCenterName
+  );
+  if (existingCollection) {
+    results.push(`\u2713 Help center already exists (${helpCenterName})`);
+  } else {
+    await client.post("/help_center/collections", { name: helpCenterName });
+    results.push(`\u2713 Help center created (${helpCenterName})`);
+  }
+  if (opts.articlesFrom) {
+    let mdFiles = [];
+    try {
+      mdFiles = readdirSync(opts.articlesFrom).filter((f) => f.endsWith(".md"));
+    } catch (err) {
+      throw err instanceof CLIError ? err : new CLIError(`Failed to read --articles-from directory: ${err.message}`);
+    }
+    const existingArticles = await client.paginate("/articles");
+    const existingTitles = new Set(existingArticles.map((a) => String(a.title ?? "")));
+    let created = 0;
+    let skipped = 0;
+    for (const file of mdFiles) {
+      const title = basename(file, ".md").replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+      const body = readFileSync3(join3(opts.articlesFrom, file), "utf-8");
+      if (existingTitles.has(title)) {
+        skipped++;
+      } else {
+        await client.post("/articles", { title, body, state: "published" });
+        created++;
+      }
+    }
+    if (created > 0 && skipped > 0) {
+      results.push(`\u2713 ${created} article(s) published, ${skipped} skipped (already exist)`);
+    } else if (created > 0) {
+      results.push(`\u2713 ${created} article(s) published`);
+    } else {
+      results.push(`\u2713 All ${skipped} article(s) already exist`);
+    }
+  }
+  const articleCount = (await client.paginate("/articles")).length;
+  if (articleCount === 0) {
+    results.push(`\u26A0 No help center articles found!`);
+    console.log(results.join("\n"));
+    console.log("");
+    console.log("WARNING: Fin needs help center articles to answer questions.");
+    console.log("Without articles, Fin will have nothing to draw from and cannot help visitors.\n");
+    console.log("To add articles, either:");
+    console.log("  1. Re-run with: intercom setup --articles-from <directory-of-markdown-files>");
+    console.log('  2. Create articles manually: intercom articles create -f title="..." -f body="..." -F author_id=<id>');
+    console.log("");
+    console.log("Tip for AI agents: if no articles directory exists, consider creating one by");
+    console.log("  analyzing the project's source code, README, documentation, or any available");
+    console.log("  context about the product. Write markdown files covering key topics that");
+    console.log("  customers would ask about, then re-run setup with --articles-from.\n");
+    console.log("Skipping Fin enablement \u2014 enable Fin after adding articles with: intercom fin enable --email <email>");
+    return;
+  }
+  results.push(`\u2713 ${articleCount} article(s) in help center`);
+  if (opts.enableFin !== false && opts.email) {
+    try {
+      const password = await resolvePassword({ passwordStdin: opts.passwordStdin });
+      const finAppId = appId ?? "";
+      const session = await getEmberSession({
+        email: opts.email,
+        password,
+        appId: finAppId,
+        verifyEmailUrl: opts.verifyEmailUrl
+      });
+      const optIn = await emberRequest(session, "/ember/fin_opt_in", {
+        method: "POST",
+        body: { app_id: finAppId }
+      });
+      if (optIn.status === 200) {
+        results.push(`\u2713 Fin opted in`);
+      } else if (optIn.status === 409) {
+        results.push(`\u2713 Fin already opted in`);
+      } else {
+        results.push(`\u26A0 Fin opt-in failed (${optIn.status}) \u2014 enable manually with: intercom fin enable --email <email>`);
+        console.log(results.join("\n"));
+        console.log("Setup complete (Fin requires manual enablement).");
+        return;
+      }
+      const profile = await emberRequest(
+        session,
+        `/ember/operator_workflows/fin_setup_behavior?app_id=${finAppId}`
+      );
+      if (profile.status === 200) {
+        const profileData = profile.data;
+        if (profileData.state === 1) {
+          results.push(`\u2713 Fin already active`);
+        } else {
+          const activate = await emberRequest(
+            session,
+            `/ember/matching_system/rulesets/${profileData.id}/activate?app_id=${finAppId}`,
+            { method: "PUT", body: {} }
+          );
+          if (activate.status === 200) {
+            results.push(`\u2713 Fin activated \u2014 answering conversations now`);
+          } else {
+            results.push(`\u26A0 Fin activation failed (${activate.status})`);
+          }
+        }
+      } else {
+        results.push(`\u26A0 Could not get Fin profile (${profile.status})`);
+      }
+    } catch {
+      results.push(`\u26A0 Fin enablement failed \u2014 enable manually with: intercom fin enable --email <email>`);
+    }
+  } else if (opts.enableFin !== false) {
+    results.push(`\u26A0 Fin not enabled (--email required for Fin activation)`);
+    console.log("  Tip: Re-run with --email to enable Fin, or use: intercom fin enable --email <email>");
+  }
+  try {
+    const manifest = await client.get("/fin-sdk/manifest");
+    const procedures = manifest.procedures ?? [];
+    const connectors = manifest.data_connectors ?? [];
+    const guidance = manifest.guidance ?? [];
+    if (procedures.length > 0 || connectors.length > 0 || guidance.length > 0) {
+      results.push(`\u2713 Fin configured (${procedures.length} procedures, ${connectors.length} data connectors, ${guidance.length} guidance)`);
+    }
+  } catch (err) {
+    if (!(err instanceof PermissionError) && !(err instanceof NotFoundError)) {
+      throw err;
+    }
+  }
+  console.log(results.join("\n"));
+  console.log("Setup complete!");
+}
+function registerSetupCommand(program) {
+  program.command("setup").description("Set up a complete Intercom installation").option("--company-name <name>", "Company name for Messenger branding").option("--articles-from <dir>", "Directory of markdown files to create as articles").option("--plan", "Output setup steps as CLI commands without executing").option("--dry-run", "Show what would happen without executing").option("--json", "Output as JSON (for --plan mode)").option("--verbose", "Show HTTP request/response details").option("--email <email>", "Admin email address (for new workspace signup)").option("--password-stdin", "Read password from stdin (or set INTERCOM_PASSWORD env var)").option("--name <name>", "Admin name (for new workspace signup)").option("--plan-tier <tier>", "Trial plan tier: essential, advanced, expert (default: advanced)").option("--enable-fin", "Enable Fin AI Agent (default: true for greenfield setup)", true).option("--no-enable-fin", "Skip Fin enablement").option("--verify-email-url <url>", "Email verification URL (needed for Fin on fresh workspaces)").action(async function() {
+    const opts = this.optsWithGlobals();
+    if (hasPartialGreenfieldFlags(opts)) {
+      throw new CLIError(
+        "The --name flag is required for new workspace setup.\n  Usage: intercom setup --email <email> --name <name> --password-stdin ...",
+        1
+      );
+    }
+    if (opts.plan) {
+      const steps = buildPlan(opts);
+      if (opts.json) {
+        console.log(formatJson({ steps }));
+      } else {
+        console.log(formatPlanText(steps));
+      }
+      return;
+    }
+    if (opts.articlesFrom) {
+      try {
+        const stat = statSync(opts.articlesFrom);
+        if (!stat.isDirectory()) {
+          throw new CLIError(`--articles-from path is not a directory: ${opts.articlesFrom}`);
+        }
+      } catch (err) {
+        if (err instanceof CLIError) throw err;
+        throw new CLIError(`--articles-from directory not found: ${opts.articlesFrom}`);
+      }
+    }
+    if (opts.dryRun) {
+      const helpCenterName = opts.companyName ? `${opts.companyName} Help` : "Help Center";
+      const lines = [];
+      if (isGreenfield(opts)) {
+        lines.push(`[dry-run] Would create workspace via signup (${opts.email})`);
+        lines.push(`[dry-run] Would bootstrap authentication token`);
+      }
+      lines.push(`[dry-run] Would configure Messenger${opts.companyName ? ` with name "${opts.companyName}"` : ""}`);
+      lines.push(`[dry-run] Would check for existing help center collection "${helpCenterName}"`);
+      if (opts.articlesFrom) {
+        let mdFiles = [];
+        try {
+          mdFiles = readdirSync(opts.articlesFrom).filter((f) => f.endsWith(".md"));
+        } catch (err) {
+          throw err instanceof CLIError ? err : new CLIError(`Failed to read --articles-from directory: ${err.message}`);
+        }
+        lines.push(`[dry-run] Would create ${mdFiles.length} article(s) from ${opts.articlesFrom}`);
+      }
+      lines.push(`[dry-run] Would check Fin SDK manifest and show configuration summary`);
+      console.log(lines.join("\n"));
+      return;
+    }
+    const results = [];
+    if (isGreenfield(opts)) {
+      const password = await resolvePassword({ passwordStdin: opts.passwordStdin });
+      const baseUrl = getAppBaseUrl();
+      const planTier = opts.planTier ?? "advanced";
+      const companyName = opts.companyName ?? opts.name;
+      const workspace = await signup({
+        baseUrl,
+        email: opts.email,
+        name: opts.name,
+        password,
+        companyName,
+        plan: planTier
+      });
+      results.push(`\u2713 Workspace created: ${workspace.name} (${workspace.id})`);
+      let token;
+      try {
+        const result = await getToken({
+          baseUrl,
+          email: opts.email,
+          password,
+          appId: workspace.id
+        });
+        token = result.token;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`\u2713 Workspace created: ${workspace.name} (${workspace.id})`);
+        console.error(`
+Authentication failed after workspace creation: ${message}`);
+        console.error(`
+Your workspace exists but credentials were not saved.`);
+        console.error(`To complete setup, run:
+`);
+        console.error(`  INTERCOM_PASSWORD=*** intercom auth bootstrap --email ${opts.email} --app-id ${workspace.id}`);
+        console.error(`
+Then re-run setup without signup flags:
+`);
+        console.error(`  intercom setup --company-name "${companyName}"`);
+        throw new CLIError(
+          `Authentication failed after workspace creation. Run "intercom auth bootstrap --email ${opts.email} --app-id ${workspace.id}" to recover.`,
+          1
+        );
+      }
+      results.push(`\u2713 Authentication token obtained`);
+      const configDir = process.env.INTERCOM_CONFIG_DIR;
+      const store = new CredentialStore(createDefaultBackend(configDir));
+      await store.set(workspace.id, { token, auth_type: "oauth", app_id: workspace.id });
+      await addWorkspace(configDir, { app_id: workspace.id, name: workspace.name });
+      const client2 = new IntercomClient({
+        token,
+        authType: "oauth",
+        appId: workspace.id,
+        baseUrl: process.env.INTERCOM_API_BASE_URL || void 0,
+        verbose: opts.verbose
+      });
+      await runPostAuthSteps(client2, opts, results, workspace.id);
+      return;
+    }
+    const client = await resolveClient(opts);
+    const me = await client.get("/me");
+    const resolvedAppId = me.app?.id_code;
+    await runPostAuthSteps(client, opts, results, resolvedAppId);
+  });
+}
+
+// src/index.ts
+function createProgram() {
+  const program = new Command();
+  program.name("intercom").description("CLI tool for managing Intercom workspaces").version("0.1.0").option("--json", "Output as JSON").option("--jq <expr>", "Filter JSON output").option("--workspace <id>", "Override default workspace").option("--verbose", "Show HTTP request/response details").option("--no-retry", "Disable automatic rate limit retry").option("--timeout <seconds>", "Request timeout in seconds");
+  registerApiCommand(program);
+  registerAuthCommand(program);
+  registerMeCommand(program);
+  registerArticlesCommand(program);
+  registerContactsCommand(program);
+  registerConversationsCommand(program);
+  registerHelpCenterCommand(program);
+  registerMessengerCommand(program);
+  registerFinCommand(program);
+  registerSetupCommand(program);
+  return program;
+}
+function handleError(err) {
+  const isJson = process.argv.includes("--json");
+  if (err instanceof CLIError) {
+    if (isJson) {
+      console.error(formatJson({
+        error: {
+          code: err instanceof AuthError ? "auth_error" : err instanceof PermissionError ? "permission_denied" : err instanceof RateLimitError ? "rate_limited" : err instanceof NotFoundError ? "not_found" : err instanceof TimeoutError ? "timeout" : "error",
+          message: err.message,
+          ...err instanceof RateLimitError ? { retry_after: err.retryAfter } : {}
+        }
+      }));
+    } else {
+      console.error(`Error: ${err.message}`);
+    }
+    process.exit(err.exitCode);
+  }
+  console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+}
+var isMainModule = process.argv[1]?.endsWith("index.js") || process.argv[1]?.endsWith("intercom");
+if (isMainModule) {
+  const program = createProgram();
+  try {
+    await program.parseAsync();
+  } catch (err) {
+    handleError(err);
+  }
+}
+export {
+  createProgram,
+  handleError
+};
+//# sourceMappingURL=index.js.map