@khotan/cli 0.1.0

package/dist/khotan.js

@@ -0,0 +1,2491 @@
+#!/usr/bin/env node
+// @bun
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// ../khotan-core/src/version.ts
+var CATALOG_SCHEMA_VERSION = 1, CATALOG_VERSION = "2026-06-13", KHOTAN_ADAPTER_NAME = "khotan", KHOTAN_ADAPTER_VERSION = "0.1.0", SUPPORTED_CATALOG_SCHEMA_VERSIONS;
+var init_version = __esm(() => {
+  SUPPORTED_CATALOG_SCHEMA_VERSIONS = [
+    CATALOG_SCHEMA_VERSION
+  ];
+});
+
+// ../khotan-core/src/errors.ts
+var KhotanError, KhotanApiError, KhotanClientError, KhotanUnknownCapabilityError, KhotanCatalogVersionError, KhotanConfirmationRequiredError;
+var init_errors = __esm(() => {
+  KhotanError = class KhotanError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "KhotanError";
+    }
+  };
+  KhotanApiError = class KhotanApiError extends KhotanError {
+    status;
+    code;
+    details;
+    constructor(params) {
+      super(params.message);
+      this.name = "KhotanApiError";
+      this.status = params.status;
+      this.code = params.code;
+      this.details = params.details;
+    }
+  };
+  KhotanClientError = class KhotanClientError extends KhotanError {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.name = "KhotanClientError";
+      this.code = code;
+    }
+  };
+  KhotanUnknownCapabilityError = class KhotanUnknownCapabilityError extends KhotanClientError {
+    constructor(capabilityId) {
+      super("unknown_capability", `No Khotan capability is registered for id "${capabilityId}".`);
+      this.name = "KhotanUnknownCapabilityError";
+    }
+  };
+  KhotanCatalogVersionError = class KhotanCatalogVersionError extends KhotanClientError {
+    catalogSchemaVersion;
+    supportedSchemaVersions;
+    constructor(params) {
+      super("unsupported_catalog_version", `Khotan catalog schema version ${params.catalogSchemaVersion} is not supported by adapter ${params.adapterVersion} (supports: ${params.supportedSchemaVersions.join(", ")}). Upgrade the Khotan CLI.`);
+      this.name = "KhotanCatalogVersionError";
+      this.catalogSchemaVersion = params.catalogSchemaVersion;
+      this.supportedSchemaVersions = params.supportedSchemaVersions;
+    }
+  };
+  KhotanConfirmationRequiredError = class KhotanConfirmationRequiredError extends KhotanClientError {
+    constructor(message) {
+      super("confirmation_required", message);
+      this.name = "KhotanConfirmationRequiredError";
+    }
+  };
+});
+
+// ../khotan-core/src/safety.ts
+function requiresConfirmation(safety) {
+  return safety === "destructive";
+}
+function isSecret(safety) {
+  return safety === "secret";
+}
+function isDestructive(safety) {
+  return safety === "destructive";
+}
+function isReadOnly(safety) {
+  return safety === "read";
+}
+function isResourceEligible(safety) {
+  return safety === "read";
+}
+var SAFETY_LEVELS;
+var init_safety = __esm(() => {
+  SAFETY_LEVELS = ["read", "write", "destructive", "secret"];
+});
+
+// ../khotan-core/src/catalog/types.ts
+function isOperationCapability(capability) {
+  return capability.kind === "operation";
+}
+function isResourceCapability(capability) {
+  return capability.kind === "resource";
+}
+
+// ../khotan-core/src/catalog/catalog.ts
+function platformDomain(config) {
+  const { domain, noun, resourceParam, resourceField, operationIds } = config;
+  const base = `/api/v1/${domain}`;
+  const idArg = idField(resourceParam, `The ${noun} id.`);
+  const cap = domain;
+  const a = article(noun);
+  const tool = (suffix) => `khotan_${domain}_${suffix}`;
+  const operations = [
+    {
+      id: `${cap}.list`,
+      kind: "operation",
+      domain,
+      safety: "read",
+      auth: true,
+      title: `List ${noun}s`,
+      description: `List the organization's ${noun}s.`,
+      input: [],
+      http: { method: "GET", path: base, operationId: operationIds.list },
+      cli: { command: [domain, "list"], summary: `List ${noun}s`, defaultOutput: "table" },
+      mcp: { tool: { name: tool("list"), title: `List ${noun}s`, description: `List the organization's ${noun}s.` } }
+    },
+    {
+      id: `${cap}.get`,
+      kind: "operation",
+      domain,
+      safety: "read",
+      auth: true,
+      title: `Get ${a} ${noun}`,
+      description: `Get one ${noun} by id, including its current deployment.`,
+      input: [idArg],
+      http: { method: "GET", path: `${base}/{${resourceParam}}`, operationId: operationIds.get },
+      cli: { command: [domain, "get"], summary: `Get ${a} ${noun}`, defaultOutput: "detail" },
+      mcp: { tool: { name: tool("get"), title: `Get ${a} ${noun}`, description: `Get one ${noun} by id.` } }
+    },
+    {
+      id: `${cap}.create`,
+      kind: "operation",
+      domain,
+      safety: "write",
+      auth: true,
+      title: `Create ${a} ${noun}`,
+      description: `Provision a new ${noun}.`,
+      input: [
+        { name: "name", location: "body", type: "string", required: true, description: `The ${noun} name.` },
+        { name: "regionPreference", location: "body", type: "string", description: "Optional region id; omit for the default region." },
+        { name: "environmentVariables", location: "body", type: "json", description: "Optional initial env vars: array of { key, value }." },
+        { name: "idempotencyKey", location: "body", type: "string", description: "Optional retry token; repeating returns the existing resource." }
+      ],
+      http: { method: "POST", path: base, operationId: operationIds.create, bodyMode: "json" },
+      cli: { command: [domain, "create"], summary: `Create ${a} ${noun}`, defaultOutput: "detail" },
+      mcp: { tool: { name: tool("create"), title: `Create ${a} ${noun}`, description: `Provision a new ${noun}.` } }
+    },
+    {
+      id: `${cap}.delete`,
+      kind: "operation",
+      domain,
+      safety: "destructive",
+      auth: true,
+      title: `Delete ${a} ${noun}`,
+      description: `Permanently delete ${a} ${noun} and tear down its provider resources.`,
+      input: [idArg],
+      http: { method: "DELETE", path: `${base}/{${resourceParam}}`, operationId: operationIds.delete },
+      cli: { command: [domain, "delete"], summary: `Delete ${a} ${noun}` },
+      mcp: { tool: { name: tool("delete"), title: `Delete ${a} ${noun}`, description: `Permanently delete ${a} ${noun}. Requires confirmation.` } }
+    },
+    {
+      id: `${cap}.redeploy`,
+      kind: "operation",
+      domain,
+      safety: "write",
+      auth: true,
+      title: `Redeploy ${a} ${noun}`,
+      description: `Trigger a new deployment of ${a} ${noun}.`,
+      input: [idArg],
+      http: { method: "POST", path: `${base}/{${resourceParam}}/redeploy`, operationId: operationIds.redeploy, bodyMode: "none" },
+      cli: { command: [domain, "redeploy"], summary: `Redeploy ${a} ${noun}`, defaultOutput: "detail" },
+      mcp: { tool: { name: tool("redeploy"), title: `Redeploy ${a} ${noun}`, description: `Trigger a new deployment of ${a} ${noun}.` } }
+    },
+    {
+      id: `${cap}.env.list`,
+      kind: "operation",
+      domain,
+      safety: "read",
+      auth: true,
+      title: `List ${noun} environment variables`,
+      description: `List env var metadata (never values) for a ${noun}.`,
+      input: [idArg],
+      http: { method: "GET", path: `${base}/{${resourceParam}}/env`, operationId: operationIds.envList },
+      cli: { command: [domain, "env", "list"], summary: "List env var metadata", defaultOutput: "table" },
+      mcp: { tool: { name: tool("env_list"), title: "List env var metadata", description: "List env var metadata (keys and update times only; never values)." } }
+    },
+    {
+      id: `${cap}.env.bulk-set`,
+      kind: "operation",
+      domain,
+      safety: "write",
+      auth: true,
+      title: `Bulk upsert ${noun} environment variables`,
+      description: `Create or update many env vars in one request.`,
+      input: [
+        idArg,
+        { name: "variables", location: "body", type: "json", required: true, description: "Array of { key, value } to upsert." }
+      ],
+      http: { method: "POST", path: `${base}/{${resourceParam}}/env`, operationId: operationIds.envBulkSet, bodyMode: "json" },
+      cli: { command: [domain, "env", "bulk-set"], summary: "Bulk upsert env vars" },
+      mcp: { tool: { name: tool("env_bulk_set"), title: "Bulk upsert env vars", description: "Create or update many env vars in one request." } }
+    },
+    {
+      id: `${cap}.env.reveal`,
+      kind: "operation",
+      domain,
+      safety: "secret",
+      auth: true,
+      title: `Reveal one ${noun} environment variable value`,
+      description: `Reveal a single decrypted env var value. Secret-bearing; explicit-only.`,
+      input: [idArg, idField("key", "The env var key to reveal.")],
+      http: { method: "GET", path: `${base}/{${resourceParam}}/env/{key}`, operationId: operationIds.envReveal },
+      cli: { command: [domain, "env", "reveal"], summary: "Reveal one env var value (secret)", defaultOutput: "raw" },
+      mcp: { tool: { name: tool("env_reveal"), title: "Reveal one env var value (secret)", description: "Reveal one decrypted env var value. Secret-bearing — returns a credential, not a list." } }
+    },
+    {
+      id: `${cap}.env.set`,
+      kind: "operation",
+      domain,
+      safety: "write",
+      auth: true,
+      title: `Set one ${noun} environment variable`,
+      description: `Create or update one env var across all targets.`,
+      input: [
+        idArg,
+        idField("key", "The env var key."),
+        { name: "value", location: "body", type: "string", required: true, secret: true, description: "The env var value." }
+      ],
+      http: { method: "PUT", path: `${base}/{${resourceParam}}/env/{key}`, operationId: operationIds.envSet, bodyMode: "json" },
+      cli: { command: [domain, "env", "set"], summary: "Set one env var" },
+      mcp: { tool: { name: tool("env_set"), title: "Set one env var", description: "Create or update one env var across all targets." } }
+    },
+    {
+      id: `${cap}.env.unset`,
+      kind: "operation",
+      domain,
+      safety: "destructive",
+      auth: true,
+      title: `Unset one ${noun} environment variable`,
+      description: `Delete one env var across all targets.`,
+      input: [idArg, idField("key", "The env var key to delete.")],
+      http: { method: "DELETE", path: `${base}/{${resourceParam}}/env/{key}`, operationId: operationIds.envDelete },
+      cli: { command: [domain, "env", "unset"], summary: "Unset one env var" },
+      mcp: { tool: { name: tool("env_unset"), title: "Unset one env var", description: "Delete one env var across all targets. Requires confirmation." } }
+    }
+  ];
+  const resource = {
+    id: `${cap}.resource`,
+    kind: "resource",
+    domain,
+    safety: "read",
+    auth: true,
+    title: `${noun[0]?.toUpperCase()}${noun.slice(1)} summary`,
+    description: `Credential-free ${noun} summary addressed by id.`,
+    input: [idArg],
+    readsVia: `${cap}.get`,
+    http: { method: "GET", path: `${base}/{${resourceParam}}`, operationId: operationIds.get },
+    mcp: {
+      resource: {
+        uriTemplate: `khotan://${domain}/{${resourceField}}`,
+        name: `${domain}-summary`,
+        title: `${noun[0]?.toUpperCase()}${noun.slice(1)} summary`,
+        description: `Credential-free ${noun} summary as JSON.`,
+        mimeType: "application/json"
+      }
+    }
+  };
+  return [...operations, resource];
+}
+function getCapability(id) {
+  return capabilitiesById.get(id);
+}
+function listCapabilities() {
+  return capabilities;
+}
+function listDomains() {
+  const seen = [];
+  for (const capability of capabilities) {
+    if (!seen.includes(capability.domain)) {
+      seen.push(capability.domain);
+    }
+  }
+  return seen;
+}
+var idField = (name, description) => ({
+  name,
+  location: "path",
+  type: "string",
+  required: true,
+  description
+}), article = (noun) => /^[aeiou]/i.test(noun) ? "an" : "a", identityCapabilities, databaseCapabilities, fileCapabilities, folderCapabilities, contextCapabilities, appsCapabilities, pipelinesCapabilities, capabilities, khotanCatalog, capabilitiesById;
+var init_catalog = __esm(() => {
+  init_version();
+  identityCapabilities = [
+    {
+      id: "identity.whoami",
+      kind: "operation",
+      domain: "identity",
+      safety: "read",
+      auth: true,
+      title: "Identify the caller",
+      description: "Resolve the organization, role, and key id from the API key.",
+      input: [],
+      http: { method: "GET", path: "/api/v1/me", operationId: "getCurrentApiPrincipal" },
+      cli: { command: ["whoami"], summary: "Show the authenticated principal", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_whoami", title: "Identify the caller", description: "Resolve the organization, role, and key id from the API key." } }
+    },
+    {
+      id: "api-keys.create-from-credentials",
+      kind: "operation",
+      domain: "api-keys",
+      safety: "secret",
+      auth: false,
+      title: "Exchange credentials for an API key",
+      description: "Authenticate with email + password and mint an organization-scoped API key. Returns the key once. Used by `khotan login`; not exposed as an MCP tool because it accepts a password.",
+      input: [
+        { name: "email", location: "body", type: "string", required: true, description: "Account email." },
+        { name: "password", location: "body", type: "string", required: true, secret: true, description: "Account password." },
+        { name: "organizationId", location: "body", type: "string", required: true, description: "Organization the key is scoped to." },
+        { name: "name", location: "body", type: "string", description: "Optional key name." },
+        { name: "role", location: "body", type: "string", description: "Optional key role (cannot exceed the caller's role)." },
+        { name: "expiresInDays", location: "body", type: "number", description: "Optional expiry in days (max 365)." }
+      ],
+      http: { method: "POST", path: "/api/v1/api-keys", operationId: "createApiKeyFromCredentials", bodyMode: "json" },
+      cli: { command: ["auth", "login"], summary: "Exchange credentials for an API key" },
+      mcp: { tool: { name: "khotan_auth_login", title: "Exchange credentials for an API key", description: "Password-bearing credential exchange. CLI-only." } }
+    }
+  ];
+  databaseCapabilities = [
+    {
+      id: "databases.list",
+      kind: "operation",
+      domain: "databases",
+      safety: "read",
+      auth: true,
+      title: "List databases",
+      description: "List the organization's production databases (no credentials).",
+      input: [],
+      http: { method: "GET", path: "/api/v1/databases", operationId: "listDatabases" },
+      cli: { command: ["databases", "list"], summary: "List databases", defaultOutput: "table" },
+      mcp: { tool: { name: "khotan_databases_list", title: "List databases", description: "List the organization's databases (no credentials)." } }
+    },
+    {
+      id: "databases.get",
+      kind: "operation",
+      domain: "databases",
+      safety: "read",
+      auth: true,
+      title: "Get a database",
+      description: "Get one database by id (no credentials).",
+      input: [idField("databaseId", "The database id.")],
+      http: { method: "GET", path: "/api/v1/databases/{databaseId}", operationId: "getDatabase" },
+      cli: { command: ["databases", "get"], summary: "Get a database", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_databases_get", title: "Get a database", description: "Get one database by id (no credentials)." } }
+    },
+    {
+      id: "databases.create",
+      kind: "operation",
+      domain: "databases",
+      safety: "write",
+      auth: true,
+      title: "Create a database",
+      description: "Provision a production Postgres database.",
+      input: [
+        { name: "name", location: "body", type: "string", required: true, description: "The database name." },
+        { name: "regionId", location: "body", type: "string", description: "Optional region id; omit for the default region." }
+      ],
+      http: { method: "POST", path: "/api/v1/databases", operationId: "createDatabase", bodyMode: "json" },
+      cli: { command: ["databases", "create"], summary: "Create a database", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_databases_create", title: "Create a database", description: "Provision a production Postgres database." } }
+    },
+    {
+      id: "databases.delete",
+      kind: "operation",
+      domain: "databases",
+      safety: "destructive",
+      auth: true,
+      title: "Delete a database",
+      description: "Permanently delete a database.",
+      input: [idField("databaseId", "The database id.")],
+      http: { method: "DELETE", path: "/api/v1/databases/{databaseId}", operationId: "deleteDatabase" },
+      cli: { command: ["databases", "delete"], summary: "Delete a database" },
+      mcp: { tool: { name: "khotan_databases_delete", title: "Delete a database", description: "Permanently delete a database. Requires confirmation." } }
+    },
+    {
+      id: "databases.connection",
+      kind: "operation",
+      domain: "databases",
+      safety: "secret",
+      auth: true,
+      title: "Get a database connection (secret)",
+      description: "Retrieve a database connection URI. Secret-bearing; explicit-only.",
+      input: [idField("databaseId", "The database id.")],
+      http: { method: "GET", path: "/api/v1/databases/{databaseId}/connection", operationId: "getDatabaseConnection" },
+      cli: { command: ["databases", "connection"], summary: "Get a connection URI (secret)", defaultOutput: "raw" },
+      mcp: { tool: { name: "khotan_databases_connection", title: "Get a connection URI (secret)", description: "Retrieve a database connection URI. Secret-bearing — returns a credential." } }
+    },
+    {
+      id: "databases.rotate-credentials",
+      kind: "operation",
+      domain: "databases",
+      safety: "secret",
+      auth: true,
+      title: "Rotate database credentials (secret)",
+      description: "Rotate a database's credentials and return the new connection. Secret-bearing.",
+      input: [idField("databaseId", "The database id.")],
+      http: { method: "POST", path: "/api/v1/databases/{databaseId}/rotate-credentials", operationId: "rotateDatabaseCredentials", bodyMode: "none" },
+      cli: { command: ["databases", "rotate-credentials"], summary: "Rotate credentials (secret)", defaultOutput: "raw" },
+      mcp: { tool: { name: "khotan_databases_rotate_credentials", title: "Rotate credentials (secret)", description: "Rotate a database's credentials and return the new connection. Secret-bearing." } }
+    },
+    {
+      id: "databases.resource",
+      kind: "resource",
+      domain: "databases",
+      safety: "read",
+      auth: true,
+      title: "Database summary",
+      description: "Credential-free database summary addressed by id.",
+      input: [idField("databaseId", "The database id.")],
+      readsVia: "databases.get",
+      http: { method: "GET", path: "/api/v1/databases/{databaseId}", operationId: "getDatabase" },
+      mcp: {
+        resource: {
+          uriTemplate: "khotan://databases/{databaseId}",
+          name: "database-summary",
+          title: "Database summary",
+          description: "Credential-free database summary as JSON.",
+          mimeType: "application/json"
+        }
+      }
+    }
+  ];
+  fileCapabilities = [
+    {
+      id: "files.list",
+      kind: "operation",
+      domain: "files",
+      safety: "read",
+      auth: true,
+      title: "List files",
+      description: "List files, optionally scoped to a folder.",
+      input: [
+        { name: "folderId", location: "query", type: "string", description: "Scope to a folder id." },
+        { name: "path", location: "query", type: "string", description: "Scope to a folder path." },
+        { name: "limit", location: "query", type: "number", default: 50, description: "Page size (1-200)." },
+        { name: "cursor", location: "query", type: "string", description: "Opaque pagination cursor." }
+      ],
+      http: { method: "GET", path: "/api/v1/files", operationId: "listFiles" },
+      cli: { command: ["files", "list"], summary: "List files", defaultOutput: "table" },
+      mcp: { tool: { name: "khotan_files_list", title: "List files", description: "List files, optionally scoped to a folder." } }
+    },
+    {
+      id: "files.get",
+      kind: "operation",
+      domain: "files",
+      safety: "read",
+      auth: true,
+      title: "Get a file",
+      description: "Get one file's metadata by id.",
+      input: [idField("fileId", "The file id.")],
+      http: { method: "GET", path: "/api/v1/files/{fileId}", operationId: "getFile" },
+      cli: { command: ["files", "get"], summary: "Get file metadata", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_files_get", title: "Get a file", description: "Get one file's metadata by id." } }
+    },
+    {
+      id: "files.update",
+      kind: "operation",
+      domain: "files",
+      safety: "write",
+      auth: true,
+      title: "Rename or move a file",
+      description: "Update a file's name and/or containing folder.",
+      input: [
+        idField("fileId", "The file id."),
+        { name: "name", location: "body", type: "string", description: "New file name." },
+        { name: "folderId", location: "body", type: "string", description: "Destination folder id (null moves to root)." },
+        { name: "folderPath", location: "body", type: "string", description: "Destination folder path." }
+      ],
+      http: { method: "PATCH", path: "/api/v1/files/{fileId}", operationId: "updateFile", bodyMode: "json" },
+      cli: { command: ["files", "update"], summary: "Rename or move a file", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_files_update", title: "Rename or move a file", description: "Update a file's name and/or containing folder." } }
+    },
+    {
+      id: "files.delete",
+      kind: "operation",
+      domain: "files",
+      safety: "destructive",
+      auth: true,
+      title: "Delete a file",
+      description: "Permanently delete a file.",
+      input: [idField("fileId", "The file id.")],
+      http: { method: "DELETE", path: "/api/v1/files/{fileId}", operationId: "deleteFile" },
+      cli: { command: ["files", "delete"], summary: "Delete a file" },
+      mcp: { tool: { name: "khotan_files_delete", title: "Delete a file", description: "Permanently delete a file. Requires confirmation." } }
+    },
+    {
+      id: "files.uploads.prepare",
+      kind: "operation",
+      domain: "files",
+      safety: "write",
+      auth: true,
+      title: "Prepare file uploads",
+      description: "Reserve pending file records and return presigned PUT URLs.",
+      input: [
+        { name: "files", location: "body", type: "json", required: true, description: "Array of { name, size, type? } descriptors." },
+        { name: "folderId", location: "body", type: "string", description: "Target folder id." },
+        { name: "folderPath", location: "body", type: "string", description: "Target folder path (created if missing)." }
+      ],
+      http: { method: "POST", path: "/api/v1/files/uploads", operationId: "prepareFileUploads", bodyMode: "json" },
+      cli: { command: ["files", "uploads", "prepare"], summary: "Prepare presigned uploads" },
+      mcp: { tool: { name: "khotan_files_uploads_prepare", title: "Prepare file uploads", description: "Reserve pending file records and return presigned PUT URLs." } }
+    },
+    {
+      id: "files.uploads.complete",
+      kind: "operation",
+      domain: "files",
+      safety: "write",
+      auth: true,
+      title: "Complete file uploads",
+      description: "Finalize uploads after bytes are PUT to the presigned URLs.",
+      input: [
+        { name: "files", location: "body", type: "json", required: true, description: "Array of { fileId } to finalize." }
+      ],
+      http: { method: "POST", path: "/api/v1/files/uploads/complete", operationId: "completeFileUploads", bodyMode: "json" },
+      cli: { command: ["files", "uploads", "complete"], summary: "Complete presigned uploads" },
+      mcp: { tool: { name: "khotan_files_uploads_complete", title: "Complete file uploads", description: "Finalize uploads after bytes are PUT to the presigned URLs." } }
+    },
+    {
+      id: "files.download",
+      kind: "operation",
+      domain: "files",
+      safety: "read",
+      auth: true,
+      title: "Get a file download URL",
+      description: "Return a short-lived presigned GET URL for a ready file.",
+      input: [idField("fileId", "The file id.")],
+      http: { method: "GET", path: "/api/v1/files/{fileId}/download", operationId: "getFileDownloadUrl" },
+      cli: { command: ["files", "download-url"], summary: "Get a file download URL", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_files_download", title: "Get a file download URL", description: "Return a short-lived presigned GET URL for a ready file." } }
+    },
+    {
+      id: "files.resource",
+      kind: "resource",
+      domain: "files",
+      safety: "read",
+      auth: true,
+      title: "File metadata",
+      description: "File metadata addressed by id (no raw bytes).",
+      input: [idField("fileId", "The file id.")],
+      readsVia: "files.get",
+      http: { method: "GET", path: "/api/v1/files/{fileId}", operationId: "getFile" },
+      mcp: {
+        resource: {
+          uriTemplate: "khotan://files/{fileId}",
+          name: "file-metadata",
+          title: "File metadata",
+          description: "File metadata as JSON (no raw bytes).",
+          mimeType: "application/json"
+        }
+      }
+    }
+  ];
+  folderCapabilities = [
+    {
+      id: "folders.list",
+      kind: "operation",
+      domain: "folders",
+      safety: "read",
+      auth: true,
+      title: "List folders",
+      description: "List all active folders as a flat list.",
+      input: [],
+      http: { method: "GET", path: "/api/v1/folders", operationId: "listFolders" },
+      cli: { command: ["folders", "list"], summary: "List folders", defaultOutput: "table" },
+      mcp: { tool: { name: "khotan_folders_list", title: "List folders", description: "List all active folders as a flat list." } }
+    },
+    {
+      id: "folders.create",
+      kind: "operation",
+      domain: "folders",
+      safety: "write",
+      auth: true,
+      title: "Create a folder",
+      description: "Create a folder under the root, a parent id, or a parent path.",
+      input: [
+        { name: "name", location: "body", type: "string", required: true, description: "The folder name." },
+        { name: "parentId", location: "body", type: "string", description: "Parent folder id." },
+        { name: "parentPath", location: "body", type: "string", description: "Parent folder path." }
+      ],
+      http: { method: "POST", path: "/api/v1/folders", operationId: "createFolder", bodyMode: "json" },
+      cli: { command: ["folders", "create"], summary: "Create a folder", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_folders_create", title: "Create a folder", description: "Create a folder under the root, a parent id, or a parent path." } }
+    },
+    {
+      id: "folders.rename",
+      kind: "operation",
+      domain: "folders",
+      safety: "write",
+      auth: true,
+      title: "Rename a folder",
+      description: "Rename a folder.",
+      input: [
+        idField("folderId", "The folder id."),
+        { name: "name", location: "body", type: "string", required: true, description: "The new folder name." }
+      ],
+      http: { method: "PATCH", path: "/api/v1/folders/{folderId}", operationId: "renameFolder", bodyMode: "json" },
+      cli: { command: ["folders", "rename"], summary: "Rename a folder", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_folders_rename", title: "Rename a folder", description: "Rename a folder." } }
+    },
+    {
+      id: "folders.delete",
+      kind: "operation",
+      domain: "folders",
+      safety: "destructive",
+      auth: true,
+      title: "Delete a folder",
+      description: "Delete a folder and its contents.",
+      input: [idField("folderId", "The folder id.")],
+      http: { method: "DELETE", path: "/api/v1/folders/{folderId}", operationId: "deleteFolder" },
+      cli: { command: ["folders", "delete"], summary: "Delete a folder" },
+      mcp: { tool: { name: "khotan_folders_delete", title: "Delete a folder", description: "Delete a folder and its contents. Requires confirmation." } }
+    }
+  ];
+  contextCapabilities = [
+    {
+      id: "context.list",
+      kind: "operation",
+      domain: "context",
+      safety: "read",
+      auth: true,
+      title: "List context documents",
+      description: "List the context document manifest (metadata only, never content).",
+      input: [
+        { name: "kind", location: "query", type: "string", description: "Filter by kind: instructions, knowledge, or record." },
+        { name: "q", location: "query", type: "string", description: "Full-text search query." }
+      ],
+      http: { method: "GET", path: "/api/v1/context", operationId: "listContextDocuments" },
+      cli: { command: ["context", "list"], summary: "List context documents", defaultOutput: "table" },
+      mcp: { tool: { name: "khotan_context_list", title: "List context documents", description: "List the context document manifest (metadata only)." } }
+    },
+    {
+      id: "context.get",
+      kind: "operation",
+      domain: "context",
+      safety: "read",
+      auth: true,
+      title: "Get a context document",
+      description: "Get a context document including its markdown content, in a JSON envelope.",
+      input: [idField("slug", "The document slug.")],
+      http: { method: "GET", path: "/api/v1/context/{slug}", operationId: "getContextDocument" },
+      cli: { command: ["context", "get"], summary: "Get a context document", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_context_get", title: "Get a context document", description: "Get a context document including its markdown content." } }
+    },
+    {
+      id: "context.raw",
+      kind: "operation",
+      domain: "context",
+      safety: "read",
+      auth: true,
+      title: "Get a context document's raw markdown",
+      description: "Get exactly the document's markdown text, with no JSON envelope.",
+      input: [idField("slug", "The document slug.")],
+      http: { method: "GET", path: "/api/v1/context/{slug}/raw", operationId: "getContextDocumentRaw", responseType: "markdown" },
+      cli: { command: ["context", "raw"], summary: "Print raw markdown", defaultOutput: "raw" },
+      mcp: { tool: { name: "khotan_context_raw", title: "Get raw markdown", description: "Get exactly the document's markdown text." } }
+    },
+    {
+      id: "context.create",
+      kind: "operation",
+      domain: "context",
+      safety: "write",
+      auth: true,
+      title: "Create a context document",
+      description: "Create a markdown context document.",
+      input: [
+        { name: "title", location: "body", type: "string", required: true, description: "Document title." },
+        { name: "kind", location: "body", type: "string", required: true, description: "instructions, knowledge, or record." },
+        { name: "content", location: "body", type: "string", required: true, description: "Canonical markdown content." },
+        { name: "slug", location: "body", type: "string", description: "Optional slug; derived from the title when omitted." },
+        { name: "description", location: "body", type: "string", description: "One-line purpose statement." },
+        { name: "tags", location: "body", type: "string[]", description: "Flat tag list." }
+      ],
+      http: { method: "POST", path: "/api/v1/context", operationId: "createContextDocument", bodyMode: "json" },
+      cli: { command: ["context", "create"], summary: "Create a context document", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_context_create", title: "Create a context document", description: "Create a markdown context document." } }
+    },
+    {
+      id: "context.update",
+      kind: "operation",
+      domain: "context",
+      safety: "write",
+      auth: true,
+      title: "Update a context document",
+      description: "Update a context document with compare-and-swap on expectedRevision.",
+      input: [
+        idField("slug", "The document slug."),
+        { name: "expectedRevision", location: "body", type: "number", required: true, description: "Revision this edit is based on; a mismatch returns 409." },
+        { name: "title", location: "body", type: "string", description: "New title." },
+        { name: "kind", location: "body", type: "string", description: "New kind." },
+        { name: "content", location: "body", type: "string", description: "New markdown content." },
+        { name: "description", location: "body", type: "string", description: "New description (null clears it)." },
+        { name: "tags", location: "body", type: "string[]", description: "New tag list." },
+        { name: "changeSummary", location: "body", type: "string", description: "Optional revision-history note." }
+      ],
+      http: { method: "PATCH", path: "/api/v1/context/{slug}", operationId: "updateContextDocument", bodyMode: "json" },
+      cli: { command: ["context", "update"], summary: "Update a context document", defaultOutput: "detail" },
+      mcp: { tool: { name: "khotan_context_update", title: "Update a context document", description: "Update a context document; pass expectedRevision for compare-and-swap." } }
+    },
+    {
+      id: "context.delete",
+      kind: "operation",
+      domain: "context",
+      safety: "destructive",
+      auth: true,
+      title: "Delete a context document",
+      description: "Soft-delete a context document.",
+      input: [idField("slug", "The document slug.")],
+      http: { method: "DELETE", path: "/api/v1/context/{slug}", operationId: "deleteContextDocument" },
+      cli: { command: ["context", "delete"], summary: "Delete a context document" },
+      mcp: { tool: { name: "khotan_context_delete", title: "Delete a context document", description: "Soft-delete a context document. Requires confirmation." } }
+    },
+    {
+      id: "context.resource",
+      kind: "resource",
+      domain: "context",
+      safety: "read",
+      auth: true,
+      title: "Context document markdown",
+      description: "Context document markdown addressed by slug.",
+      input: [idField("slug", "The document slug.")],
+      readsVia: "context.raw",
+      http: { method: "GET", path: "/api/v1/context/{slug}/raw", operationId: "getContextDocumentRaw", responseType: "markdown" },
+      mcp: {
+        resource: {
+          uriTemplate: "khotan://context/{slug}",
+          name: "context-document",
+          title: "Context document markdown",
+          description: "The document's canonical markdown.",
+          mimeType: "text/markdown"
+        }
+      }
+    }
+  ];
+  appsCapabilities = platformDomain({
+    domain: "apps",
+    noun: "app",
+    resourceParam: "appId",
+    resourceField: "appId",
+    operationIds: {
+      list: "listApps",
+      get: "getApp",
+      create: "createApp",
+      delete: "deleteApp",
+      redeploy: "redeployApp",
+      envList: "listAppEnvVars",
+      envBulkSet: "bulkUpsertAppEnvVars",
+      envReveal: "revealAppEnvVar",
+      envSet: "upsertAppEnvVar",
+      envDelete: "deleteAppEnvVar"
+    }
+  });
+  pipelinesCapabilities = platformDomain({
+    domain: "pipelines",
+    noun: "pipeline",
+    resourceParam: "pipelineId",
+    resourceField: "pipelineId",
+    operationIds: {
+      list: "listPipelines",
+      get: "getPipeline",
+      create: "createPipeline",
+      delete: "deletePipeline",
+      redeploy: "redeployPipeline",
+      envList: "listPipelineEnvVars",
+      envBulkSet: "bulkUpsertPipelineEnvVars",
+      envReveal: "revealPipelineEnvVar",
+      envSet: "upsertPipelineEnvVar",
+      envDelete: "deletePipelineEnvVar"
+    }
+  });
+  capabilities = [
+    ...identityCapabilities,
+    ...appsCapabilities,
+    ...pipelinesCapabilities,
+    ...databaseCapabilities,
+    ...fileCapabilities,
+    ...folderCapabilities,
+    ...contextCapabilities
+  ];
+  khotanCatalog = {
+    schemaVersion: CATALOG_SCHEMA_VERSION,
+    catalogVersion: CATALOG_VERSION,
+    capabilities
+  };
+  capabilitiesById = new Map(capabilities.map((capability) => [capability.id, capability]));
+});
+
+// ../khotan-core/src/catalog/validate.ts
+function assertSupportedCatalogSchemaVersion(catalog = khotanCatalog, options = {}) {
+  const supported = options.supportedSchemaVersions ?? SUPPORTED_CATALOG_SCHEMA_VERSIONS;
+  if (!supported.includes(catalog.schemaVersion)) {
+    throw new KhotanCatalogVersionError({
+      catalogSchemaVersion: catalog.schemaVersion,
+      supportedSchemaVersions: supported,
+      adapterVersion: options.adapterVersion ?? KHOTAN_ADAPTER_VERSION
+    });
+  }
+}
+function pathPlaceholders(path) {
+  return [...path.matchAll(/\{([^}]+)\}/g)].map((match) => match[1]);
+}
+function validateCatalogStructure(catalog = khotanCatalog) {
+  const errors = [];
+  const seenIds = new Set;
+  const seenToolNames = new Map;
+  const seenResourceUris = new Map;
+  for (const capability of catalog.capabilities) {
+    if (seenIds.has(capability.id)) {
+      errors.push({ capabilityId: capability.id, message: "Duplicate capability id." });
+    }
+    seenIds.add(capability.id);
+    const placeholders = pathPlaceholders(capability.http.path);
+    const pathInputs = capability.input.filter((field) => field.location === "path").map((field) => field.name);
+    for (const placeholder of placeholders) {
+      if (!pathInputs.includes(placeholder)) {
+        errors.push({
+          capabilityId: capability.id,
+          message: `Path placeholder {${placeholder}} has no matching path input.`
+        });
+      }
+    }
+    for (const pathInput of pathInputs) {
+      if (!placeholders.includes(pathInput)) {
+        errors.push({
+          capabilityId: capability.id,
+          message: `Path input "${pathInput}" is not present in path template ${capability.http.path}.`
+        });
+      }
+    }
+    if (isResourceCapability(capability)) {
+      if (!isResourceEligible(capability.safety)) {
+        errors.push({
+          capabilityId: capability.id,
+          message: `Resource capability must be read-safe; got "${capability.safety}".`
+        });
+      }
+      if (isSecret(capability.safety)) {
+        errors.push({
+          capabilityId: capability.id,
+          message: "Resource capability must not expose secret material."
+        });
+      }
+      const uri = capability.mcp.resource.uriTemplate;
+      const owner = seenResourceUris.get(uri);
+      if (owner) {
+        errors.push({
+          capabilityId: capability.id,
+          message: `Resource URI template ${uri} is already used by ${owner}.`
+        });
+      }
+      seenResourceUris.set(uri, capability.id);
+      const target = catalog.capabilities.find((c) => c.id === capability.readsVia);
+      if (!target) {
+        errors.push({
+          capabilityId: capability.id,
+          message: `readsVia references unknown capability "${capability.readsVia}".`
+        });
+      }
+    } else {
+      const toolName = capability.mcp.tool.name;
+      const owner = seenToolNames.get(toolName);
+      if (owner) {
+        errors.push({
+          capabilityId: capability.id,
+          message: `Tool name ${toolName} is already used by ${owner}.`
+        });
+      }
+      seenToolNames.set(toolName, capability.id);
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
+function indexOpenApiOperations(doc) {
+  const index = new Map;
+  for (const [path, item] of Object.entries(doc.paths ?? {})) {
+    if (!item) {
+      continue;
+    }
+    for (const method of HTTP_METHODS) {
+      const operation = item[method.toLowerCase()];
+      if (operation) {
+        index.set(`${method} ${path}`, operation.operationId);
+      }
+    }
+  }
+  return index;
+}
+function validateCatalogAgainstOpenApi(doc, catalog = khotanCatalog) {
+  const index = indexOpenApiOperations(doc);
+  const errors = [];
+  for (const capability of catalog.capabilities) {
+    const { method, path, operationId } = capability.http;
+    const key = `${method} ${path}`;
+    if (!index.has(key)) {
+      errors.push({
+        capabilityId: capability.id,
+        message: `No OpenAPI operation for ${key}.`
+      });
+      continue;
+    }
+    const docOperationId = index.get(key);
+    if (docOperationId !== operationId) {
+      errors.push({
+        capabilityId: capability.id,
+        message: `OpenAPI operationId mismatch for ${key}: catalog="${operationId}", openapi="${docOperationId ?? "(none)"}".`
+      });
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
+function capabilitiesByOperationId(catalog = khotanCatalog) {
+  const byOperation = new Map;
+  for (const capability of catalog.capabilities) {
+    const list = byOperation.get(capability.http.operationId) ?? [];
+    list.push(capability);
+    byOperation.set(capability.http.operationId, list);
+  }
+  return byOperation;
+}
+var HTTP_METHODS;
+var init_validate = __esm(() => {
+  init_errors();
+  init_safety();
+  init_version();
+  init_catalog();
+  HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+});
+
+// ../khotan-core/src/client/api-client.ts
+function resolveCapability(capabilityOrId) {
+  if (typeof capabilityOrId !== "string") {
+    return capabilityOrId;
+  }
+  const capability = getCapability(capabilityOrId);
+  if (!capability) {
+    throw new KhotanUnknownCapabilityError(capabilityOrId);
+  }
+  return capability;
+}
+function normalizeApiUrl(apiUrl) {
+  return apiUrl.replace(/\/+$/, "");
+}
+function buildHttpRequest(capabilityOrId, input, context) {
+  const capability = resolveCapability(capabilityOrId);
+  const { http } = capability;
+  let path = http.path;
+  const query = new URLSearchParams;
+  const body = {};
+  for (const field of capability.input) {
+    const value = input[field.name];
+    const provided = value !== undefined && value !== null;
+    if (field.location === "path") {
+      if (!provided) {
+        throw new KhotanClientError("missing_argument", `Missing required path argument "${field.name}" for ${capability.id}.`);
+      }
+      path = path.replace(`{${field.name}}`, encodeURIComponent(String(value)));
+      continue;
+    }
+    if (field.location === "query") {
+      const effective = provided ? value : field.default;
+      if (effective !== undefined && effective !== null) {
+        query.set(field.name, String(effective));
+      }
+      continue;
+    }
+    if (provided) {
+      body[field.name] = value;
+    } else if (field.required) {
+      throw new KhotanClientError("missing_argument", `Missing required argument "${field.name}" for ${capability.id}.`);
+    }
+  }
+  const queryString = query.toString();
+  const url = `${normalizeApiUrl(context.apiUrl)}${path}${queryString ? `?${queryString}` : ""}`;
+  const headers = { accept: "application/json" };
+  if (capability.auth) {
+    if (!context.apiKey) {
+      throw new KhotanClientError("not_authenticated", `Capability ${capability.id} requires authentication but no API key is configured.`);
+    }
+    headers["x-api-key"] = context.apiKey;
+  }
+  const request = { url, method: http.method, headers };
+  if (http.bodyMode === "json" && Object.keys(body).length > 0) {
+    headers["content-type"] = "application/json";
+    request.body = JSON.stringify(body);
+  }
+  return request;
+}
+function toApiError(status, rawBody) {
+  try {
+    const parsed = JSON.parse(rawBody);
+    if (parsed?.error?.code && parsed.error.message) {
+      return new KhotanApiError({
+        status,
+        code: parsed.error.code,
+        message: parsed.error.message,
+        details: parsed.error.details
+      });
+    }
+  } catch {}
+  return new KhotanApiError({
+    status,
+    code: "http_error",
+    message: rawBody.trim() || `Request failed with status ${status}.`
+  });
+}
+function createApiClient(context) {
+  const doFetch = context.fetch ?? fetch;
+  return {
+    context,
+    buildRequest(capabilityOrId, input = {}) {
+      return buildHttpRequest(capabilityOrId, input, context);
+    },
+    async execute(capabilityOrId, input = {}) {
+      const capability = resolveCapability(capabilityOrId);
+      const request = buildHttpRequest(capability, input, context);
+      let response;
+      try {
+        response = await doFetch(request.url, {
+          method: request.method,
+          headers: request.headers,
+          body: request.body
+        });
+      } catch (error) {
+        throw new KhotanClientError("network_error", `Could not reach the Khotan API at ${context.apiUrl}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      const rawBody = await response.text();
+      if (!response.ok) {
+        throw toApiError(response.status, rawBody);
+      }
+      if (capability.http.responseType === "markdown") {
+        return rawBody;
+      }
+      if (!rawBody) {
+        return null;
+      }
+      try {
+        return JSON.parse(rawBody);
+      } catch {
+        throw new KhotanClientError("invalid_response", `The Khotan API returned a non-JSON success response for ${capability.id}.`);
+      }
+    }
+  };
+}
+var init_api_client = __esm(() => {
+  init_catalog();
+  init_errors();
+});
+
+// ../khotan-core/src/profiles/profiles.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function emptyStore() {
+  return { version: 1, current: "default", profiles: {} };
+}
+function getProfileStorePath(options = {}) {
+  if (options.storePath) {
+    return options.storePath;
+  }
+  const env = options.env ?? process.env;
+  const xdg = env.XDG_CONFIG_HOME;
+  const base = xdg && xdg.trim() ? xdg : join(homedir(), ".config");
+  return join(base, "khotan", "profiles.json");
+}
+function loadProfileStore(options = {}) {
+  const path = getProfileStorePath(options);
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return emptyStore();
+    }
+    throw new KhotanClientError("profile_read_failed", `Could not read Khotan profiles at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      version: 1,
+      current: parsed.current ?? "default",
+      profiles: parsed.profiles ?? {}
+    };
+  } catch {
+    throw new KhotanClientError("profile_parse_failed", `Khotan profiles at ${path} are not valid JSON.`);
+  }
+}
+function saveProfileStore(store, options = {}) {
+  const path = getProfileStorePath(options);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  writeFileSync(path, `${JSON.stringify(store, null, 2)}
+`, { mode: FILE_MODE });
+  try {
+    chmodSync(path, FILE_MODE);
+  } catch {}
+}
+function setProfile(name, profile, options = {}) {
+  const store = loadProfileStore(options);
+  store.profiles[name] = profile;
+  if (!store.profiles[store.current]) {
+    store.current = name;
+  }
+  saveProfileStore(store, options);
+  return store;
+}
+function selectProfile(name, options = {}) {
+  const store = loadProfileStore(options);
+  if (!store.profiles[name]) {
+    throw new KhotanClientError("unknown_profile", `No Khotan profile named "${name}". Run \`khotan auth set-key\` to create one.`);
+  }
+  store.current = name;
+  saveProfileStore(store, options);
+  return store;
+}
+function resolveProfile(options = {}) {
+  const env = options.env ?? process.env;
+  const store = loadProfileStore(options);
+  const name = options.profileName ?? env[ENV_PROFILE] ?? store.current;
+  const stored = store.profiles[name];
+  const envApiUrl = env[ENV_API_URL]?.trim() || undefined;
+  const envApiKey = env[ENV_API_KEY]?.trim() || undefined;
+  const apiUrl = envApiUrl ?? stored?.apiUrl;
+  const apiKey = envApiKey ?? stored?.apiKey;
+  return {
+    name,
+    apiUrl,
+    apiKey,
+    defaultOutput: stored?.defaultOutput ?? "human",
+    source: {
+      apiUrl: envApiUrl ? "env" : stored?.apiUrl ? "profile" : "none",
+      apiKey: envApiKey ? "env" : stored?.apiKey ? "profile" : "none"
+    }
+  };
+}
+var ENV_API_KEY = "KHOTAN_API_KEY", ENV_API_URL = "KHOTAN_API_URL", ENV_PROFILE = "KHOTAN_PROFILE", FILE_MODE = 384, DIR_MODE = 448;
+var init_profiles = __esm(() => {
+  init_errors();
+});
+
+// ../khotan-core/src/index.ts
+var exports_src = {};
+__export(exports_src, {
+  validateCatalogStructure: () => validateCatalogStructure,
+  validateCatalogAgainstOpenApi: () => validateCatalogAgainstOpenApi,
+  setProfile: () => setProfile,
+  selectProfile: () => selectProfile,
+  saveProfileStore: () => saveProfileStore,
+  resolveProfile: () => resolveProfile,
+  requiresConfirmation: () => requiresConfirmation,
+  loadProfileStore: () => loadProfileStore,
+  listDomains: () => listDomains,
+  listCapabilities: () => listCapabilities,
+  khotanCatalog: () => khotanCatalog,
+  isSecret: () => isSecret,
+  isResourceEligible: () => isResourceEligible,
+  isResourceCapability: () => isResourceCapability,
+  isReadOnly: () => isReadOnly,
+  isOperationCapability: () => isOperationCapability,
+  isDestructive: () => isDestructive,
+  indexOpenApiOperations: () => indexOpenApiOperations,
+  getProfileStorePath: () => getProfileStorePath,
+  getCapability: () => getCapability,
+  createApiClient: () => createApiClient,
+  capabilitiesByOperationId: () => capabilitiesByOperationId,
+  buildHttpRequest: () => buildHttpRequest,
+  assertSupportedCatalogSchemaVersion: () => assertSupportedCatalogSchemaVersion,
+  SUPPORTED_CATALOG_SCHEMA_VERSIONS: () => SUPPORTED_CATALOG_SCHEMA_VERSIONS,
+  SAFETY_LEVELS: () => SAFETY_LEVELS,
+  KhotanUnknownCapabilityError: () => KhotanUnknownCapabilityError,
+  KhotanError: () => KhotanError,
+  KhotanConfirmationRequiredError: () => KhotanConfirmationRequiredError,
+  KhotanClientError: () => KhotanClientError,
+  KhotanCatalogVersionError: () => KhotanCatalogVersionError,
+  KhotanApiError: () => KhotanApiError,
+  KHOTAN_ADAPTER_VERSION: () => KHOTAN_ADAPTER_VERSION,
+  KHOTAN_ADAPTER_NAME: () => KHOTAN_ADAPTER_NAME,
+  ENV_PROFILE: () => ENV_PROFILE,
+  ENV_API_URL: () => ENV_API_URL,
+  ENV_API_KEY: () => ENV_API_KEY,
+  CATALOG_VERSION: () => CATALOG_VERSION,
+  CATALOG_SCHEMA_VERSION: () => CATALOG_SCHEMA_VERSION
+});
+var init_src = __esm(() => {
+  init_version();
+  init_errors();
+  init_safety();
+  init_catalog();
+  init_validate();
+  init_api_client();
+  init_profiles();
+});
+
+// src/cli/io.ts
+import { createInterface } from "node:readline";
+function createNodeIo() {
+  return {
+    out(text) {
+      process.stdout.write(text);
+    },
+    err(text) {
+      process.stderr.write(text);
+    },
+    isTty: Boolean(process.stdout.isTTY && process.stdin.isTTY),
+    env: process.env,
+    async prompt(question) {
+      const rl = createInterface({ input: process.stdin, output: process.stderr });
+      try {
+        return await new Promise((resolve) => {
+          rl.question(question, (answer) => resolve(answer));
+        });
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+function outLine(io, line = "") {
+  io.out(`${line}
+`);
+}
+function errLine(io, line = "") {
+  io.err(`${line}
+`);
+}
+var init_io = () => {};
+
+// src/cli/session.ts
+function resolveSession(options) {
+  const resolved = resolveProfile({
+    env: options.env,
+    profileName: options.profileName,
+    ...options.storeOptions
+  });
+  const apiUrl = options.apiUrlOverride ?? resolved.apiUrl;
+  const apiKey = options.apiKeyOverride ?? resolved.apiKey;
+  if (!apiUrl) {
+    throw new KhotanClientError("no_api_url", "No Khotan API URL configured. Set one with `khotan auth set-key --api-url <url> --api-key <key>`, or export KHOTAN_API_URL.");
+  }
+  return {
+    client: createApiClient({ apiUrl, apiKey, fetch: options.fetch }),
+    resolved,
+    apiUrl,
+    apiKey
+  };
+}
+var init_session = __esm(() => {
+  init_src();
+});
+
+// src/mcp/protocol.ts
+function fieldSchema(field) {
+  const base = field.description ? { description: field.description } : {};
+  switch (field.type) {
+    case "number":
+      return { ...base, type: "number" };
+    case "boolean":
+      return { ...base, type: "boolean" };
+    case "string[]":
+      return { ...base, type: "array", items: { type: "string" } };
+    case "json":
+      return { ...base, type: "array" };
+    default:
+      return { ...base, type: "string" };
+  }
+}
+function toolInputSchema(capability) {
+  const properties = {};
+  const required = [];
+  for (const field of capability.input) {
+    properties[field.name] = fieldSchema(field);
+    if (field.required) {
+      required.push(field.name);
+    }
+  }
+  if (isDestructive(capability.safety)) {
+    properties.confirm = {
+      type: "boolean",
+      description: "Must be true to perform this destructive action."
+    };
+    required.push("confirm");
+  }
+  return { type: "object", properties, required };
+}
+function describeForAgent(capability) {
+  const prefix = isSecret(capability.safety) ? "[secret] " : isDestructive(capability.safety) ? "[destructive] " : "";
+  return `${prefix}${capability.mcp.tool.description}`;
+}
+function listMcpTools() {
+  const tools = [];
+  for (const capability of listCapabilities()) {
+    if (!isOperationCapability(capability) || TOOL_DENYLIST.has(capability.id)) {
+      continue;
+    }
+    tools.push({
+      name: capability.mcp.tool.name,
+      title: capability.mcp.tool.title,
+      description: describeForAgent(capability),
+      inputSchema: toolInputSchema(capability)
+    });
+  }
+  return tools;
+}
+function findToolCapability(name) {
+  for (const capability of listCapabilities()) {
+    if (isOperationCapability(capability) && !TOOL_DENYLIST.has(capability.id) && capability.mcp.tool.name === name) {
+      return capability;
+    }
+  }
+  return;
+}
+function listMcpResourceTemplates() {
+  return listCapabilities().filter(isResourceCapability).map((capability) => ({
+    uriTemplate: capability.mcp.resource.uriTemplate,
+    name: capability.mcp.resource.name,
+    title: capability.mcp.resource.title,
+    description: capability.mcp.resource.description,
+    mimeType: capability.mcp.resource.mimeType
+  }));
+}
+function matchResourceUri(uri) {
+  for (const capability of listCapabilities()) {
+    if (!isResourceCapability(capability)) {
+      continue;
+    }
+    const template = capability.mcp.resource.uriTemplate;
+    const paramNames = [];
+    let source = "^";
+    for (const segment of template.match(/\{[^}]+\}|[^{]+/g) ?? []) {
+      if (segment.startsWith("{")) {
+        paramNames.push(segment.slice(1, -1));
+        source += "([^/]+)";
+      } else {
+        source += segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      }
+    }
+    source += "$";
+    const exec = new RegExp(source).exec(uri);
+    if (exec) {
+      const input = {};
+      paramNames.forEach((name, index) => {
+        input[name] = decodeURIComponent(exec[index + 1]);
+      });
+      return { capability, input };
+    }
+  }
+  return;
+}
+var MCP_PROTOCOL_VERSION = "2025-06-18", TOOL_DENYLIST;
+var init_protocol = __esm(() => {
+  init_src();
+  TOOL_DENYLIST = new Set(["api-keys.create-from-credentials"]);
+});
+
+// src/mcp/server.ts
+function ok(id, result) {
+  return { jsonrpc: "2.0", id: id ?? null, result };
+}
+function fail(id, code, message, data) {
+  return { jsonrpc: "2.0", id: id ?? null, error: { code, message, data } };
+}
+function textContent(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+  return { content: [{ type: "text", text }] };
+}
+function toolError(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+async function callTool(deps, params) {
+  const name = params.name;
+  if (typeof name !== "string") {
+    return toolError("tools/call requires a string `name`.");
+  }
+  const capability = findToolCapability(name);
+  if (!capability) {
+    return toolError(`Unknown tool "${name}".`);
+  }
+  const args = { ...params.arguments ?? {} };
+  if (isDestructive(capability.safety)) {
+    if (args.confirm !== true) {
+      return toolError(`Tool "${name}" is destructive and requires { "confirm": true } to proceed.`);
+    }
+    delete args.confirm;
+  }
+  try {
+    const result = await deps.client.execute(capability, args);
+    const content = textContent(result);
+    return {
+      ...content,
+      structuredContent: typeof result === "object" && result !== null ? result : { value: result }
+    };
+  } catch (error) {
+    if (error instanceof KhotanApiError) {
+      return toolError(`[${error.code}] ${error.message}`);
+    }
+    return toolError(error instanceof Error ? error.message : String(error));
+  }
+}
+function isResourceError(value) {
+  return typeof value === "object" && value !== null && "__error" in value;
+}
+async function readResource(deps, params) {
+  const uri = params.uri;
+  if (typeof uri !== "string") {
+    return { __error: "resources/read requires a string `uri`.", code: JSON_RPC_INVALID_PARAMS };
+  }
+  const match = matchResourceUri(uri);
+  if (!match) {
+    return { __error: `No Khotan resource matches "${uri}".`, code: JSON_RPC_INVALID_PARAMS };
+  }
+  if (isSecret(match.capability.safety)) {
+    return { __error: "Secret-bearing data is not exposed as a resource.", code: JSON_RPC_INVALID_PARAMS };
+  }
+  let value;
+  try {
+    value = await deps.client.execute(match.capability, match.input);
+  } catch (error) {
+    const message = error instanceof KhotanApiError ? `[${error.code}] ${error.message}` : error instanceof Error ? error.message : String(error);
+    return { __error: message, code: JSON_RPC_INTERNAL_ERROR };
+  }
+  const mimeType = match.capability.mcp.resource.mimeType ?? "application/json";
+  const text = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+  return { contents: [{ uri, mimeType, text }] };
+}
+async function handleRpc(message, deps) {
+  const isNotification = message.id === undefined || message.id === null;
+  const params = message.params ?? {};
+  switch (message.method) {
+    case "initialize":
+      return ok(message.id, {
+        protocolVersion: typeof params.protocolVersion === "string" ? params.protocolVersion : MCP_PROTOCOL_VERSION,
+        capabilities: { tools: {}, resources: {} },
+        serverInfo: { name: KHOTAN_ADAPTER_NAME, version: KHOTAN_ADAPTER_VERSION }
+      });
+    case "notifications/initialized":
+      return null;
+    case "ping":
+      return ok(message.id, {});
+    case "tools/list":
+      return ok(message.id, { tools: listMcpTools() });
+    case "tools/call":
+      return ok(message.id, await callTool(deps, params));
+    case "resources/list":
+      return ok(message.id, { resources: [] });
+    case "resources/templates/list":
+      return ok(message.id, { resourceTemplates: listMcpResourceTemplates() });
+    case "resources/read": {
+      const result = await readResource(deps, params);
+      if (isResourceError(result)) {
+        return fail(message.id, result.code, result.__error);
+      }
+      return ok(message.id, result);
+    }
+    default:
+      if (isNotification) {
+        return null;
+      }
+      return fail(message.id, JSON_RPC_METHOD_NOT_FOUND, `Unknown method "${message.method}".`);
+  }
+}
+var JSON_RPC_METHOD_NOT_FOUND = -32601, JSON_RPC_INVALID_PARAMS = -32602, JSON_RPC_INTERNAL_ERROR = -32603;
+var init_server = __esm(() => {
+  init_src();
+  init_protocol();
+});
+
+// src/mcp/transport.ts
+async function dispatchLine(line, deps) {
+  const trimmed = line.trim();
+  if (!trimmed) {
+    return null;
+  }
+  let message;
+  try {
+    message = JSON.parse(trimmed);
+  } catch {
+    return JSON.stringify({
+      jsonrpc: "2.0",
+      id: null,
+      error: { code: JSON_RPC_PARSE_ERROR, message: "Parse error: invalid JSON." }
+    });
+  }
+  const response = await handleRpc(message, deps);
+  return response ? JSON.stringify(response) : null;
+}
+var JSON_RPC_PARSE_ERROR = -32700;
+var init_transport = __esm(() => {
+  init_server();
+});
+
+// src/mcp/serve.ts
+var exports_serve = {};
+__export(exports_serve, {
+  serveMcp: () => serveMcp
+});
+import { createInterface as createInterface2 } from "node:readline";
+async function serveMcp(deps) {
+  assertSupportedCatalogSchemaVersion();
+  const session = resolveSession({
+    env: deps.env,
+    storeOptions: deps.storeOptions,
+    profileName: deps.profileName,
+    apiUrlOverride: deps.apiUrlOverride,
+    apiKeyOverride: deps.apiKeyOverride,
+    fetch: deps.fetch
+  });
+  if (!session.apiKey) {
+    throw new KhotanClientError("not_authenticated", "The MCP server needs an API key. Run `khotan auth set-key` or set KHOTAN_API_KEY.");
+  }
+  const serverDeps = { client: session.client };
+  errLine(deps.io, `khotan MCP server ready on stdio (origin: ${session.apiUrl}).`);
+  const input = deps.input ?? process.stdin;
+  const rl = createInterface2({ input });
+  for await (const line of rl) {
+    let response;
+    try {
+      response = await dispatchLine(line, serverDeps);
+    } catch (error) {
+      errLine(deps.io, `MCP handler error: ${error instanceof Error ? error.message : String(error)}`);
+      continue;
+    }
+    if (response !== null) {
+      deps.io.out(`${response}
+`);
+    }
+  }
+  return 0;
+}
+var init_serve = __esm(() => {
+  init_src();
+  init_io();
+  init_session();
+  init_transport();
+});
+
+// src/cli/run.ts
+init_src();
+
+// src/cli/args.ts
+var KNOWN_BOOLEANS = new Set([
+  "json",
+  "yes",
+  "help",
+  "h",
+  "version",
+  "no-input",
+  "force"
+]);
+function parseArgs(argv) {
+  const positionals = [];
+  const flags = new Map;
+  const addFlag = (name, value) => {
+    const existing = flags.get(name);
+    if (existing) {
+      existing.push(value);
+    } else {
+      flags.set(name, [value]);
+    }
+  };
+  for (let i = 0;i < argv.length; i++) {
+    const token = argv[i];
+    if (token === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (token.startsWith("--")) {
+      const body = token.slice(2);
+      const eq = body.indexOf("=");
+      if (eq >= 0) {
+        addFlag(body.slice(0, eq), body.slice(eq + 1));
+        continue;
+      }
+      if (KNOWN_BOOLEANS.has(body)) {
+        addFlag(body, "true");
+        continue;
+      }
+      const next = argv[i + 1];
+      if (next !== undefined && !next.startsWith("-")) {
+        addFlag(body, next);
+        i++;
+      } else {
+        addFlag(body, "true");
+      }
+      continue;
+    }
+    if (token.startsWith("-") && token.length > 1) {
+      const body = token.slice(1);
+      addFlag(body === "h" ? "help" : body, "true");
+      continue;
+    }
+    positionals.push(token);
+  }
+  return { positionals, flags };
+}
+function flagValue(args, name) {
+  return args.flags.get(name)?.[0];
+}
+function flagValues(args, name) {
+  return args.flags.get(name) ?? [];
+}
+function flagBool(args, name) {
+  const values = args.flags.get(name);
+  if (!values || values.length === 0) {
+    return false;
+  }
+  const last = values[values.length - 1];
+  return last !== "false" && last !== "0";
+}
+
+// src/cli/commands/auth.ts
+init_src();
+init_io();
+
+// src/cli/render.ts
+init_io();
+function isScalar(value) {
+  return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function scalar(value) {
+  if (value === null || value === undefined) {
+    return "";
+  }
+  if (isScalar(value)) {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function renderTable(io, rows) {
+  if (rows.length === 0) {
+    outLine(io, "(none)");
+    return;
+  }
+  const objectRows = rows.filter((row) => typeof row === "object" && row !== null && !Array.isArray(row));
+  if (objectRows.length !== rows.length) {
+    for (const row of rows) {
+      outLine(io, scalar(row));
+    }
+    return;
+  }
+  const columns = [];
+  for (const row of objectRows) {
+    for (const key of Object.keys(row)) {
+      if (!columns.includes(key) && isScalar(row[key])) {
+        columns.push(key);
+      }
+    }
+  }
+  const widths = columns.map((column) => Math.max(column.length, ...objectRows.map((row) => scalar(row[column]).length)));
+  const formatRow = (cells) => cells.map((cell, index) => cell.padEnd(widths[index] ?? 0)).join("  ").trimEnd();
+  outLine(io, formatRow(columns));
+  outLine(io, formatRow(widths.map((width) => "-".repeat(width))));
+  for (const row of objectRows) {
+    outLine(io, formatRow(columns.map((column) => scalar(row[column]))));
+  }
+}
+function renderDetail(io, record) {
+  const keys = Object.keys(record);
+  if (keys.length === 0) {
+    outLine(io, "(empty)");
+    return;
+  }
+  const width = Math.max(...keys.map((key) => key.length));
+  for (const key of keys) {
+    const value = record[key];
+    const rendered = isScalar(value) || value === null || value === undefined ? scalar(value) : JSON.stringify(value, null, 2);
+    outLine(io, `${key.padEnd(width)}  ${rendered}`);
+  }
+}
+function singleArrayProperty(record) {
+  const arrayKeys = Object.keys(record).filter((key) => Array.isArray(record[key]));
+  if (arrayKeys.length === 1) {
+    return record[arrayKeys[0]];
+  }
+  return;
+}
+function renderResult(io, result, options) {
+  if (options.json) {
+    outLine(io, JSON.stringify(result, null, 2));
+    return;
+  }
+  if (typeof result === "string") {
+    io.out(result.endsWith(`
+`) ? result : `${result}
+`);
+    return;
+  }
+  if (result === null || result === undefined) {
+    outLine(io, "(no content)");
+    return;
+  }
+  if (Array.isArray(result)) {
+    renderTable(io, result);
+    return;
+  }
+  if (typeof result === "object") {
+    const record = result;
+    const list = singleArrayProperty(record);
+    if (list) {
+      renderTable(io, list);
+      return;
+    }
+    renderDetail(io, record);
+    return;
+  }
+  outLine(io, scalar(result));
+}
+
+// src/cli/commands/auth.ts
+async function promptIfMissing(io, value, question) {
+  if (value !== undefined) {
+    return value;
+  }
+  if (!io.isTty) {
+    return;
+  }
+  const answer = (await io.prompt(question)).trim();
+  return answer.length > 0 ? answer : undefined;
+}
+async function authSetKey(ctx) {
+  const { io, args, env, storeOptions, json } = ctx;
+  const profileName = flagValue(args, "profile") ?? "default";
+  const apiUrl = flagValue(args, "api-url") ?? env.KHOTAN_API_URL ?? await promptIfMissing(io, undefined, "Khotan API URL: ");
+  if (!apiUrl) {
+    throw new KhotanClientError("missing_argument", "Provide --api-url (the Khotan API origin).");
+  }
+  const apiKey = flagValue(args, "api-key") ?? env.KHOTAN_API_KEY ?? await promptIfMissing(io, undefined, "Khotan API key: ");
+  if (!apiKey) {
+    throw new KhotanClientError("missing_argument", "Provide --api-key (an organization API key).");
+  }
+  const client = createApiClient({ apiUrl, apiKey, fetch: ctx.fetch });
+  const principal = await client.execute("identity.whoami");
+  setProfile(profileName, { apiUrl, apiKey, defaultOutput: json ? "json" : "human" }, storeOptions);
+  selectProfile(profileName, storeOptions);
+  errLine(io, `Saved API key to profile "${profileName}" and verified it.`);
+  renderResult(io, principal, { json });
+  return 0;
+}
+async function authLogin(ctx) {
+  const { io, args, env, storeOptions, json } = ctx;
+  const profileName = flagValue(args, "profile") ?? "default";
+  const apiUrl = flagValue(args, "api-url") ?? env.KHOTAN_API_URL;
+  if (!apiUrl) {
+    throw new KhotanClientError("missing_argument", "Provide --api-url (the Khotan API origin).");
+  }
+  const email = await promptIfMissing(io, flagValue(args, "email"), "Email: ");
+  const password = await promptIfMissing(io, flagValue(args, "password"), "Password: ");
+  const organizationId = await promptIfMissing(io, flagValue(args, "organization-id"), "Organization id: ");
+  if (!email || !password || !organizationId) {
+    throw new KhotanClientError("missing_argument", "login requires --email, --password, and --organization-id (or an interactive terminal to prompt).");
+  }
+  const expiresInRaw = flagValue(args, "expires-in-days");
+  const input = { email, password, organizationId };
+  const name = flagValue(args, "name");
+  const role = flagValue(args, "role");
+  if (name)
+    input.name = name;
+  if (role)
+    input.role = role;
+  if (expiresInRaw)
+    input.expiresInDays = Number(expiresInRaw);
+  const bootstrapClient = createApiClient({ apiUrl, fetch: ctx.fetch });
+  const minted = await bootstrapClient.execute("api-keys.create-from-credentials", input);
+  setProfile(profileName, { apiUrl, apiKey: minted.key, defaultOutput: json ? "json" : "human" }, storeOptions);
+  selectProfile(profileName, storeOptions);
+  const client = createApiClient({ apiUrl, apiKey: minted.key, fetch: ctx.fetch });
+  const principal = await client.execute("identity.whoami");
+  errLine(io, `Minted an API key (id ${minted.id}) and saved it to profile "${profileName}".`);
+  renderResult(io, principal, { json });
+  return 0;
+}
+function authUse(ctx, profileName) {
+  selectProfile(profileName, ctx.storeOptions);
+  errLine(ctx.io, `Active profile is now "${profileName}".`);
+  return 0;
+}
+function authList(ctx) {
+  const store = loadProfileStore(ctx.storeOptions);
+  const rows = Object.entries(store.profiles).map(([name, profile]) => ({
+    profile: name,
+    current: name === store.current,
+    apiUrl: profile.apiUrl,
+    hasKey: Boolean(profile.apiKey)
+  }));
+  renderResult(ctx.io, { profiles: rows }, { json: ctx.json });
+  return 0;
+}
+async function whoami(ctx) {
+  const resolved = resolveProfile({
+    env: ctx.env,
+    profileName: flagValue(ctx.args, "profile"),
+    ...ctx.storeOptions
+  });
+  const apiUrl = flagValue(ctx.args, "api-url") ?? resolved.apiUrl;
+  const apiKey = flagValue(ctx.args, "api-key") ?? resolved.apiKey;
+  if (!apiUrl || !apiKey) {
+    throw new KhotanClientError("not_authenticated", "No credentials configured. Run `khotan auth set-key` or set KHOTAN_API_URL and KHOTAN_API_KEY.");
+  }
+  const client = createApiClient({ apiUrl, apiKey, fetch: ctx.fetch });
+  const principal = await client.execute("identity.whoami");
+  renderResult(ctx.io, principal, { json: ctx.json });
+  return 0;
+}
+
+// src/cli/commands/files-transfer.ts
+init_src();
+init_io();
+import { basename } from "node:path";
+async function defaultReadFile(path) {
+  const { readFile } = await import("node:fs/promises");
+  return readFile(path);
+}
+async function defaultWriteFile(path, data) {
+  const { writeFile } = await import("node:fs/promises");
+  await writeFile(path, data);
+}
+async function uploadFile(deps, options) {
+  const { session, io, json } = deps;
+  const httpFetch = deps.httpFetch ?? fetch;
+  const readFile = deps.readFile ?? defaultReadFile;
+  const bytes = await readFile(options.localPath);
+  const name = options.name ?? basename(options.localPath);
+  const prepareInput = {
+    files: [
+      {
+        name,
+        size: bytes.byteLength,
+        ...options.contentType ? { type: options.contentType } : {}
+      }
+    ]
+  };
+  if (options.folderId)
+    prepareInput.folderId = options.folderId;
+  if (options.folderPath)
+    prepareInput.folderPath = options.folderPath;
+  const prepared = await session.client.execute("files.uploads.prepare", prepareInput);
+  const upload = prepared.uploads[0];
+  if (!upload) {
+    throw new KhotanClientError("upload_failed", "The API returned no presigned upload.");
+  }
+  errLine(io, `Uploading ${name} (${bytes.byteLength} bytes)…`);
+  const putResponse = await httpFetch(upload.uploadUrl, {
+    method: "PUT",
+    headers: upload.headers,
+    body: bytes
+  });
+  if (!putResponse.ok) {
+    throw new KhotanClientError("upload_failed", `Object storage rejected the upload (status ${putResponse.status}).`);
+  }
+  const completed = await session.client.execute("files.uploads.complete", {
+    files: [{ fileId: upload.fileId }]
+  });
+  const result = completed.results[0];
+  if (result && result.status === "failed") {
+    throw new KhotanClientError("upload_failed", result.error);
+  }
+  renderResult(io, result?.status === "ready" ? result.file : completed, { json });
+  return 0;
+}
+async function downloadFile(deps, options) {
+  const { session, io, json } = deps;
+  const httpFetch = deps.httpFetch ?? fetch;
+  const writeFile = deps.writeFile ?? defaultWriteFile;
+  const signed = await session.client.execute("files.download", {
+    fileId: options.fileId
+  });
+  const response = await httpFetch(signed.url, { method: "GET" });
+  if (!response.ok) {
+    throw new KhotanClientError("download_failed", `Object storage rejected the download (status ${response.status}).`);
+  }
+  const data = new Uint8Array(await response.arrayBuffer());
+  await writeFile(options.outputPath, data);
+  errLine(io, `Wrote ${data.byteLength} bytes to ${options.outputPath}.`);
+  renderResult(io, { fileId: options.fileId, output: options.outputPath, bytes: data.byteLength }, { json });
+  return 0;
+}
+
+// src/cli/commands/init.ts
+init_io();
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join2, relative } from "node:path";
+var MCP_SERVER_KEY = "khotan";
+function mcpServerEntry() {
+  return {
+    command: "khotan",
+    args: ["mcp", "serve"],
+    env: {
+      KHOTAN_API_URL: "<your-khotan-api-url>",
+      KHOTAN_API_KEY: "<your-khotan-api-key>"
+    }
+  };
+}
+var GUIDE_BODY = `This workspace is wired to Khotan through the \`khotan\` CLI and its MCP server.
+Use them to inspect and configure apps, pipelines, databases, files, folders, and
+context documents through the Khotan \`/api/v1\` surface.
+
+## Authentication (do this once — never commit secrets)
+
+Khotan reads an organization-scoped API key from a stored profile or the
+environment:
+
+- Profile (recommended): \`khotan auth set-key --api-url <url> --api-key <key>\`
+  stores the key in an owner-only file outside the repository.
+- Environment: export \`KHOTAN_API_URL\` and \`KHOTAN_API_KEY\` in your shell or
+  agent sandbox.
+
+Never put an API key in a file committed to the repository. The generated MCP
+config contains only placeholders.
+
+## CLI surface
+
+- \`khotan apps list|get|create|delete|redeploy\` and \`khotan apps env …\`
+- \`khotan pipelines …\`, \`khotan databases …\`
+- \`khotan files list|upload|download|…\`, \`khotan folders …\`
+- \`khotan context list|get|create|update|delete\`
+- Add \`--json\` to any command for machine-readable output.
+
+Run \`khotan help\` or \`khotan <command> --help\` for the full, catalog-derived
+surface.
+
+## Safety
+
+- Destructive commands (deletes, env unset) require confirmation; pass \`--yes\`
+  only when you intend it.
+- Secret values (env reveal, database connection strings, credential rotation)
+  are only available through explicit commands and are never printed in lists.
+
+## MCP
+
+\`khotan mcp serve\` exposes the same operations as MCP tools and durable reads as
+MCP resources, reusing your stored profile or environment credentials.
+`;
+var CURSOR_RULES = `---
+description: Use the Khotan CLI and MCP tools to configure and operate this workspace's Khotan resources
+alwaysApply: false
+---
+
+# Khotan
+
+${GUIDE_BODY}`;
+var GENERIC_GUIDE = `# Khotan agent guide
+
+${GUIDE_BODY}`;
+function toRelative(cwd, absolutePath) {
+  return relative(cwd, absolutePath) || absolutePath;
+}
+function writeTextAsset(ctx, absolutePath, content) {
+  const path = toRelative(ctx.cwd, absolutePath);
+  const existed = existsSync(absolutePath);
+  if (existed && !ctx.force) {
+    ctx.results.push({ path, action: "skipped" });
+    return;
+  }
+  mkdirSync2(dirname2(absolutePath), { recursive: true });
+  writeFileSync2(absolutePath, content);
+  ctx.results.push({ path, action: existed ? "forced" : "created" });
+}
+function writeMcpConfig(ctx, absolutePath) {
+  const path = toRelative(ctx.cwd, absolutePath);
+  let config = {};
+  const existed = existsSync(absolutePath);
+  if (existed) {
+    try {
+      config = JSON.parse(readFileSync2(absolutePath, "utf8"));
+    } catch {
+      ctx.results.push({ path, action: "skipped" });
+      return;
+    }
+  }
+  if (!config.mcpServers || typeof config.mcpServers !== "object") {
+    config.mcpServers = {};
+  }
+  const servers = config.mcpServers;
+  const hasKhotan = Object.prototype.hasOwnProperty.call(servers, MCP_SERVER_KEY);
+  if (hasKhotan && !ctx.force) {
+    ctx.results.push({ path, action: "skipped" });
+    return;
+  }
+  servers[MCP_SERVER_KEY] = mcpServerEntry();
+  mkdirSync2(dirname2(absolutePath), { recursive: true });
+  writeFileSync2(absolutePath, `${JSON.stringify(config, null, 2)}
+`);
+  ctx.results.push({
+    path,
+    action: existed ? hasKhotan ? "forced" : "updated" : "created"
+  });
+}
+function runInit(options) {
+  const { io, cwd, client, force, json } = options;
+  const ctx = { cwd, force, results: [] };
+  if (client === "cursor") {
+    writeMcpConfig(ctx, join2(cwd, ".cursor", "mcp.json"));
+    writeTextAsset(ctx, join2(cwd, ".cursor", "rules", "khotan.mdc"), CURSOR_RULES);
+  } else {
+    writeMcpConfig(ctx, join2(cwd, "mcp.json"));
+    writeTextAsset(ctx, join2(cwd, "khotan-agents.md"), GENERIC_GUIDE);
+  }
+  if (json) {
+    io.out(`${JSON.stringify({ client, actions: ctx.results }, null, 2)}
+`);
+    return 0;
+  }
+  errLine(io, `Khotan workspace integration (${client}):`);
+  for (const result of ctx.results) {
+    errLine(io, `  ${result.action.padEnd(8)} ${result.path}`);
+  }
+  errLine(io);
+  errLine(io, "Next steps:");
+  errLine(io, "  1. Authenticate: khotan auth set-key --api-url <url> --api-key <key>");
+  errLine(io, "  2. Open this workspace in your agent and ask it to configure Khotan.");
+  return 0;
+}
+
+// src/cli/confirm.ts
+init_src();
+init_io();
+async function ensureConfirmed(options) {
+  const { io, yes, summary } = options;
+  if (yes) {
+    return;
+  }
+  if (!io.isTty) {
+    throw new KhotanConfirmationRequiredError(`${summary} This is a destructive action; re-run with --yes to confirm in a non-interactive session.`);
+  }
+  errLine(io, summary);
+  const answer = (await io.prompt("Type 'yes' to confirm: ")).trim().toLowerCase();
+  if (answer !== "yes" && answer !== "y") {
+    throw new KhotanConfirmationRequiredError("Aborted; no changes were made.");
+  }
+}
+
+// src/cli/help.ts
+init_src();
+
+// src/cli/input.ts
+init_src();
+function camelToKebab(name) {
+  return name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+}
+function fieldFlag(field) {
+  return camelToKebab(field.name);
+}
+function parseKeyValueList(pairs) {
+  return pairs.map((pair) => {
+    const eq = pair.indexOf("=");
+    if (eq < 0) {
+      throw new KhotanClientError("invalid_argument", `Expected KEY=VALUE but received "${pair}".`);
+    }
+    return { key: pair.slice(0, eq), value: pair.slice(eq + 1) };
+  });
+}
+function coerceScalar(field, raw) {
+  if (field.type === "number") {
+    const value = Number(raw);
+    if (Number.isNaN(value)) {
+      throw new KhotanClientError("invalid_argument", `--${fieldFlag(field)} expects a number, received "${raw}".`);
+    }
+    return value;
+  }
+  if (field.type === "boolean") {
+    return raw !== "false" && raw !== "0";
+  }
+  return raw;
+}
+function buildCapabilityInput(capability, positionals, args) {
+  const input = {};
+  const pathFields = capability.input.filter((field) => field.location === "path");
+  pathFields.forEach((field, index) => {
+    const value = positionals[index];
+    if (value !== undefined) {
+      input[field.name] = value;
+    }
+  });
+  for (const field of capability.input) {
+    if (field.location === "path") {
+      continue;
+    }
+    if (field.name === "environmentVariables") {
+      const pairs = flagValues(args, "env");
+      if (pairs.length > 0) {
+        input[field.name] = parseKeyValueList(pairs);
+      }
+      continue;
+    }
+    if (field.name === "variables") {
+      const pairs = flagValues(args, "var");
+      if (pairs.length > 0) {
+        input[field.name] = parseKeyValueList(pairs);
+      }
+      continue;
+    }
+    if (field.type === "json") {
+      const raw2 = flagValue(args, fieldFlag(field));
+      if (raw2 !== undefined) {
+        try {
+          input[field.name] = JSON.parse(raw2);
+        } catch {
+          throw new KhotanClientError("invalid_argument", `--${fieldFlag(field)} expects JSON, received "${raw2}".`);
+        }
+      }
+      continue;
+    }
+    if (field.type === "string[]") {
+      const repeated = flagValues(args, fieldFlag(field));
+      if (repeated.length === 1) {
+        input[field.name] = repeated[0].split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+      } else if (repeated.length > 1) {
+        input[field.name] = repeated;
+      }
+      continue;
+    }
+    if (field.type === "boolean") {
+      if (args.flags.has(fieldFlag(field))) {
+        input[field.name] = flagBool(args, fieldFlag(field));
+      }
+      continue;
+    }
+    const raw = flagValue(args, fieldFlag(field));
+    if (raw !== undefined) {
+      input[field.name] = coerceScalar(field, raw);
+    }
+  }
+  return input;
+}
+
+// src/cli/help.ts
+init_io();
+var DOMAIN_TITLES = {
+  identity: "Identity",
+  "api-keys": "API keys",
+  apps: "Apps",
+  pipelines: "Pipelines",
+  databases: "Databases",
+  files: "Files",
+  folders: "Folders",
+  context: "Context documents"
+};
+function commandWords(capability) {
+  return capability.cli?.command.join(" ");
+}
+function argUsage(field) {
+  return field.required ? `<${field.name}>` : `[${field.name}]`;
+}
+function flagUsage(field) {
+  if (field.name === "environmentVariables" || field.name === "variables") {
+    return field.name === "variables" ? "[--var KEY=VALUE]..." : "[--env KEY=VALUE]...";
+  }
+  const placeholder = field.type === "boolean" ? "" : ` <${field.type === "string[]" ? "a,b" : field.type}>`;
+  const flag = `--${fieldFlag(field)}${placeholder}`;
+  return field.required ? flag : `[${flag}]`;
+}
+function commandUsage(capability) {
+  const words = commandWords(capability) ?? capability.id;
+  const pathArgs = capability.input.filter((field) => field.location === "path").map(argUsage);
+  const flags = capability.input.filter((field) => field.location !== "path").map(flagUsage);
+  return ["khotan", words, ...pathArgs, ...flags].join(" ");
+}
+function printTopLevelHelp(io) {
+  outLine(io, "khotan — first-party CLI and MCP server for the Khotan API");
+  outLine(io);
+  outLine(io, "Usage: khotan <command> [arguments] [options]");
+  outLine(io);
+  outLine(io, "Authentication & profiles:");
+  outLine(io, "  auth login                  Exchange email/password for an API key");
+  outLine(io, "  auth set-key                Store an existing API key in a profile");
+  outLine(io, "  auth use <profile>          Switch the active profile");
+  outLine(io, "  auth list                   List stored profiles");
+  outLine(io, "  whoami                      Show the authenticated principal");
+  outLine(io);
+  const byDomain = new Map;
+  for (const capability of listCapabilities()) {
+    if (!isOperationCapability(capability)) {
+      continue;
+    }
+    if (capability.id === "api-keys.create-from-credentials") {
+      continue;
+    }
+    const list = byDomain.get(capability.domain) ?? [];
+    list.push(capability);
+    byDomain.set(capability.domain, list);
+  }
+  for (const domain of listDomains()) {
+    const capabilities2 = byDomain.get(domain);
+    if (!capabilities2 || capabilities2.length === 0) {
+      continue;
+    }
+    if (domain === "identity") {
+      continue;
+    }
+    outLine(io, `${DOMAIN_TITLES[domain] ?? domain}:`);
+    for (const capability of capabilities2) {
+      const words = commandWords(capability) ?? capability.id;
+      outLine(io, `  ${words.padEnd(30)} ${capability.cli?.summary ?? capability.title}`);
+    }
+    outLine(io);
+  }
+  outLine(io, "File transfer:");
+  outLine(io, "  files upload <path>         Upload a local file (presigned flow)");
+  outLine(io, "  files download <fileId>     Download a file to --output (presigned flow)");
+  outLine(io);
+  outLine(io, "Workspace:");
+  outLine(io, "  init                        Scaffold MCP config + agent guidance into this workspace");
+  outLine(io);
+  outLine(io, "Agent:");
+  outLine(io, "  mcp serve                   Start the Khotan MCP server over stdio");
+  outLine(io);
+  outLine(io, "Global options:");
+  outLine(io, "  --json                      Emit machine-readable JSON to stdout");
+  outLine(io, "  --yes                       Confirm destructive actions non-interactively");
+  outLine(io, "  --profile <name>            Use a specific stored profile");
+  outLine(io, "  --api-url <url>             Override the API origin");
+  outLine(io, "  --api-key <key>             Override the API key");
+  outLine(io, "  --help                      Show help for a command");
+  outLine(io);
+  outLine(io, `khotan v${KHOTAN_ADAPTER_VERSION}`);
+}
+function printCommandHelp(io, capability) {
+  outLine(io, capability.title);
+  outLine(io);
+  outLine(io, `Usage: ${commandUsage(capability)}`);
+  outLine(io);
+  outLine(io, capability.description);
+  const args = capability.input;
+  if (args.length > 0) {
+    outLine(io);
+    outLine(io, "Arguments & options:");
+    for (const field of args) {
+      const label = field.location === "path" ? `<${field.name}>` : `--${fieldFlag(field)}`;
+      const flags = [
+        field.required ? "required" : "optional",
+        field.location,
+        field.secret ? "secret" : null
+      ].filter(Boolean).join(", ");
+      outLine(io, `  ${label.padEnd(24)}${field.description ?? ""} (${flags})`);
+    }
+  }
+}
+
+// src/cli/run.ts
+init_io();
+init_session();
+function buildCommandIndex() {
+  const index = new Map;
+  for (const capability of listCapabilities()) {
+    if (capability.cli) {
+      index.set(capability.cli.command.join(" "), capability);
+    }
+  }
+  return index;
+}
+var commandIndex = buildCommandIndex();
+function matchCommand(positionals) {
+  for (let n = Math.min(3, positionals.length);n >= 1; n--) {
+    const key = positionals.slice(0, n).join(" ");
+    const capability = commandIndex.get(key);
+    if (capability) {
+      return { capability, rest: positionals.slice(n) };
+    }
+  }
+  return;
+}
+function describeTarget(capability, input) {
+  const pathField = capability.input.find((field) => field.location === "path");
+  const id = pathField ? input[pathField.name] : undefined;
+  return id ? `${capability.title}: ${String(id)}` : capability.title;
+}
+async function runCapability(match, args, options) {
+  const { capability } = match;
+  if (!isOperationCapability(capability)) {
+    throw new KhotanClientError("not_a_command", `${capability.id} is not an executable command.`);
+  }
+  if (flagBool(args, "help")) {
+    printCommandHelp(options.io, capability);
+    return 0;
+  }
+  const session = resolveSession({
+    env: options.env,
+    storeOptions: options.storeOptions,
+    profileName: options.profileName,
+    apiUrlOverride: options.apiUrlOverride,
+    apiKeyOverride: options.apiKeyOverride,
+    fetch: options.fetch
+  });
+  const input = buildCapabilityInput(capability, match.rest, args);
+  const json = options.jsonFlag || session.resolved.defaultOutput === "json";
+  if (isDestructive(capability.safety)) {
+    await ensureConfirmed({
+      io: options.io,
+      yes: options.yes,
+      summary: `About to ${capability.title.toLowerCase()} — ${describeTarget(capability, input)}.`
+    });
+  }
+  const result = await session.client.execute(capability, input);
+  renderResult(options.io, result, { json, capability });
+  return 0;
+}
+async function run(argv, options = {}) {
+  const io = options.io ?? createNodeIo();
+  const env = options.env ?? io.env;
+  const args = parseArgs(argv);
+  const { positionals } = args;
+  const jsonFlag = flagBool(args, "json");
+  const yes = flagBool(args, "yes");
+  const helpFlag = flagBool(args, "help");
+  const profileName = flagValue(args, "profile");
+  const apiUrlOverride = flagValue(args, "api-url");
+  const apiKeyOverride = flagValue(args, "api-key");
+  if (flagBool(args, "version")) {
+    const { KHOTAN_ADAPTER_VERSION: KHOTAN_ADAPTER_VERSION2 } = await Promise.resolve().then(() => (init_src(), exports_src));
+    io.out(`${KHOTAN_ADAPTER_VERSION2}
+`);
+    return 0;
+  }
+  const authCtx = {
+    io,
+    args,
+    env,
+    storeOptions: options.storeOptions,
+    json: jsonFlag,
+    fetch: options.fetch
+  };
+  try {
+    assertSupportedCatalogSchemaVersion();
+    const first = positionals[0];
+    if (!first || first === "help") {
+      const topic = positionals.slice(first === "help" ? 1 : 0);
+      const match2 = topic.length > 0 ? matchCommand(topic) : undefined;
+      if (match2 && isOperationCapability(match2.capability)) {
+        printCommandHelp(io, match2.capability);
+      } else {
+        printTopLevelHelp(io);
+      }
+      return 0;
+    }
+    if (first === "init") {
+      if (helpFlag) {
+        errLine(io, "Usage: khotan init [--client cursor|generic] [--dir <path>] [--force] [--json]");
+        return 0;
+      }
+      const clientRaw = flagValue(args, "client") ?? "cursor";
+      if (clientRaw !== "cursor" && clientRaw !== "generic") {
+        throw new KhotanClientError("invalid_argument", `Unknown --client "${clientRaw}". Use "cursor" or "generic".`);
+      }
+      const cwd = flagValue(args, "dir") ?? process.cwd();
+      return runInit({ io, cwd, client: clientRaw, force: flagBool(args, "force"), json: jsonFlag });
+    }
+    if (first === "mcp" && positionals[1] === "serve") {
+      const launcher = options.startMcpServer ?? (async (deps) => {
+        const { serveMcp: serveMcp2 } = await Promise.resolve().then(() => (init_serve(), exports_serve));
+        return serveMcp2(deps);
+      });
+      return await launcher({
+        io,
+        env,
+        storeOptions: options.storeOptions,
+        fetch: options.fetch,
+        profileName,
+        apiUrlOverride,
+        apiKeyOverride
+      });
+    }
+    if (first === "login") {
+      return await authLogin(authCtx);
+    }
+    if (first === "whoami" && !matchCommand(positionals)) {
+      return await whoami(authCtx);
+    }
+    if (first === "auth") {
+      const sub = positionals[1];
+      if (sub === "set-key")
+        return await authSetKey(authCtx);
+      if (sub === "login")
+        return await authLogin(authCtx);
+      if (sub === "use") {
+        const name = positionals[2];
+        if (!name)
+          throw new KhotanClientError("missing_argument", "Usage: khotan auth use <profile>.");
+        return authUse(authCtx, name);
+      }
+      if (sub === "list")
+        return authList(authCtx);
+      if (sub === "whoami")
+        return await whoami(authCtx);
+      errLine(io, `Unknown auth command "${sub ?? ""}". Try: set-key, login, use, list.`);
+      return 1;
+    }
+    if (first === "files" && (positionals[1] === "upload" || positionals[1] === "download")) {
+      if (helpFlag) {
+        errLine(io, positionals[1] === "upload" ? "Usage: khotan files upload <localPath> [--name <n>] [--folder-id <id>] [--folder-path <p>] [--content-type <t>]" : "Usage: khotan files download <fileId> --output <path>");
+        return 0;
+      }
+      const session = resolveSession({
+        env,
+        storeOptions: options.storeOptions,
+        profileName,
+        apiUrlOverride,
+        apiKeyOverride,
+        fetch: options.fetch
+      });
+      const json = jsonFlag || session.resolved.defaultOutput === "json";
+      if (positionals[1] === "upload") {
+        const localPath = positionals[2];
+        if (!localPath)
+          throw new KhotanClientError("missing_argument", "Usage: khotan files upload <localPath>.");
+        return await uploadFile({ session, io, json, httpFetch: options.fetch }, {
+          localPath,
+          name: flagValue(args, "name"),
+          folderId: flagValue(args, "folder-id"),
+          folderPath: flagValue(args, "folder-path"),
+          contentType: flagValue(args, "content-type")
+        });
+      }
+      const fileId = positionals[2];
+      const output = flagValue(args, "output");
+      if (!fileId || !output) {
+        throw new KhotanClientError("missing_argument", "Usage: khotan files download <fileId> --output <path>.");
+      }
+      return await downloadFile({ session, io, json, httpFetch: options.fetch }, { fileId, outputPath: output });
+    }
+    const match = matchCommand(positionals);
+    if (match) {
+      return await runCapability(match, args, {
+        io,
+        env,
+        storeOptions: options.storeOptions,
+        fetch: options.fetch,
+        jsonFlag,
+        yes,
+        profileName,
+        apiUrlOverride,
+        apiKeyOverride
+      });
+    }
+    errLine(io, `Unknown command "${positionals.join(" ")}". Run \`khotan help\` for usage.`);
+    return 1;
+  } catch (error) {
+    return handleError(io, error, jsonFlag);
+  }
+}
+function handleError(io, error, json) {
+  if (error instanceof KhotanApiError) {
+    if (json) {
+      io.out(`${JSON.stringify({ error: { code: error.code, message: error.message, details: error.details } }, null, 2)}
+`);
+    } else {
+      errLine(io, `Error [${error.code}]: ${error.message}`);
+    }
+    return 1;
+  }
+  if (error instanceof KhotanConfirmationRequiredError) {
+    errLine(io, error.message);
+    return 2;
+  }
+  if (error instanceof KhotanClientError) {
+    errLine(io, `Error [${error.code}]: ${error.message}`);
+    return 1;
+  }
+  errLine(io, `Error: ${error instanceof Error ? error.message : String(error)}`);
+  return 1;
+}
+
+// src/bin/khotan.ts
+run(process.argv.slice(2)).then((code) => {
+  process.exitCode = code;
+}).catch((error) => {
+  process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exitCode = 1;
+});