@lumoai/cli 1.55.0 → 1.57.0

package/dist/cli/src/commands/idea-slack-add.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaSlackAdd = ideaSlackAdd;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo idea slack add <LUM-I1> <permalink>`
+ *
+ * Attaches a Slack thread to an idea by POSTing the permalink to
+ * `/api/ideas/:id/slack-contexts`. Mirrors the task-side flow (LUM-681).
+ */
+async function ideaSlackAdd(identifier, permalink) {
+    if (!identifier || !permalink) {
+        console.error('Error: usage: lumo idea slack add <LUM-I1> <permalink>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/slack-contexts`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ permalink }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: slack add failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { context } = (await res.json());
+    console.log(`Linked Slack thread to ${identifier} (context ${context.id})`);
+}

package/dist/cli/src/commands/idea-slack-rm.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaSlackRm = ideaSlackRm;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo idea slack rm <LUM-I1> <context-id>`
+ *
+ * Removes a Slack context from an idea via
+ * `DELETE /api/ideas/:id/slack-contexts/:contextId`. Mirrors the task-side
+ * shape (LUM-681); no task-side `rm` equivalent exists yet, so this follows
+ * the DELETE route contract directly.
+ */
+async function ideaSlackRm(identifier, contextId) {
+    if (!identifier || !contextId) {
+        console.error('Error: usage: lumo idea slack rm <LUM-I1> <context-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/slack-contexts/${encodeURIComponent(contextId)}`, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} or slack context ${contextId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok && res.status !== 204) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: slack rm failed (HTTP ${res.status})`);
+        return 1;
+    }
+    console.log(`Removed Slack context ${contextId} from ${identifier}`);
+}

package/dist/cli/src/commands/idea-slack-show.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaSlackShow = ideaSlackShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
+/**
+ * `lumo idea slack show <LUM-I1> <context-id>`
+ *
+ * Tier-2 retrieval for the cheap inline Slack card on an idea. Fetches the
+ * stored thread snapshot (no live Slack call) from
+ * `/api/ideas/:id/slack-contexts/:contextId/snapshot` and prints one line per
+ * message as `author: text`, falling back to `@<userId>` when the display
+ * name is missing. Mirrors `taskSlackShow` (LUM-681).
+ */
+async function ideaSlackShow(identifier, contextId) {
+    if (!identifier || !contextId) {
+        console.error('Error: usage: lumo idea slack show <LUM-I1> <context-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/slack-contexts/${encodeURIComponent(contextId)}/snapshot`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} or slack context ${contextId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: slack show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { snapshot } = (await res.json());
+    const messages = snapshot?.messages ?? [];
+    if (messages.length === 0) {
+        console.log('(no messages in stored snapshot)');
+    }
+    else {
+        for (const m of messages) {
+            const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
+            console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+        }
+    }
+    // LUM-681: mirrors LUM-500 disclosure-funnel stamping for idea fragments.
+    // The contextId arg == lineage SLACK_CONTEXT fragmentId. Fire-and-forget —
+    // never blocks, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'SLACK_CONTEXT', fragmentId: contextId });
+}

package/dist/cli/src/commands/idea-web-add.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaWebAdd = ideaWebAdd;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo idea web add <LUM-I1> <url>`
+ *
+ * Attaches a web link to an idea by POSTing the url to
+ * `/api/ideas/:id/web-links`. Mirrors the task-side flow (LUM-681).
+ */
+async function ideaWebAdd(identifier, url) {
+    if (!identifier || !url) {
+        console.error('Error: usage: lumo idea web add <LUM-I1> <url>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/web-links`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ url }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: web add failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { webLink } = (await res.json());
+    console.log(`Linked web page to ${identifier} (link ${webLink.id})`);
+}

package/dist/cli/src/commands/idea-web-rm.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaWebRm = ideaWebRm;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo idea web rm <LUM-I1> <link-id>`
+ *
+ * Removes a web link from an idea via
+ * `DELETE /api/ideas/:id/web-links/:linkId`. Mirrors the task-side shape
+ * (LUM-681); no task-side `rm` equivalent exists yet, so this follows the
+ * DELETE route contract directly.
+ */
+async function ideaWebRm(identifier, linkId) {
+    if (!identifier || !linkId) {
+        console.error('Error: usage: lumo idea web rm <LUM-I1> <link-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/web-links/${encodeURIComponent(linkId)}`, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} or web link ${linkId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok && res.status !== 204) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: web rm failed (HTTP ${res.status})`);
+        return 1;
+    }
+    console.log(`Removed web link ${linkId} from ${identifier}`);
+}

package/dist/cli/src/commands/idea-web-show.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaWebShow = ideaWebShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
+/**
+ * `lumo idea web show <LUM-I1> <link-id>`
+ *
+ * Tier-2 retrieval for the cheap inline WebLink card on an idea. Fetches the
+ * page body (cached, or fetched behind the SSRF guard on first read) from
+ * `/api/ideas/:id/web-links/:linkId/body` and prints it as plain text.
+ * Mirrors `taskWebShow` (LUM-681).
+ */
+async function ideaWebShow(identifier, linkId) {
+    if (!identifier || !linkId) {
+        console.error('Error: usage: lumo idea web show <LUM-I1> <link-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/web-links/${encodeURIComponent(linkId)}/body`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} or web link ${linkId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: web show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { body } = (await res.json());
+    if (!body || body.trim().length === 0) {
+        console.log('(empty body)');
+    }
+    else {
+        console.log((0, sanitize_1.sanitizeField)(body));
+    }
+    // LUM-681: mirrors LUM-500 disclosure-funnel stamping for idea fragments.
+    // The linkId arg == lineage WEB_LINK fragmentId. Fire-and-forget — never
+    // blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'WEB_LINK', fragmentId: linkId });
+}

package/dist/cli/src/commands/idea.js

@@ -1,11 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatIdeaList = formatIdeaList;
 exports.formatCapturedIdeaLine = formatCapturedIdeaLine;
 exports.ideaCapture = ideaCapture;
+exports.ideaList = ideaList;
+exports.ideaUpdate = ideaUpdate;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const resolve_bound_task_1 = require("../lib/resolve-bound-task");
 const sanitize_1 = require("../lib/sanitize");
+/**
+ * The four Idea lifecycle states (LUM-679), lower-cased for CLI input. The
+ * command normalizes case before sending, so `--status Developing` and
+ * `--status developing` both resolve. Mirrors `lib/validation/idea.ts`.
+ */
+const IDEA_STATUS_VALUES = [
+    'captured',
+    'developing',
+    'planned',
+    'dropped',
+];
+/**
+ * Render the idea pool as aligned `<id>  <status>  <statement>` lines. The
+ * server already returns the pool newest-first, so this preserves order.
+ * Empty pool → a friendly one-liner.
+ */
+function formatIdeaList(ideas) {
+    if (ideas.length === 0)
+        return 'No ideas.\n';
+    const idWidth = Math.max(...ideas.map(i => i.identifier.length));
+    const statusWidth = Math.max(...ideas.map(i => i.status.length));
+    return (ideas
+        .map(i => {
+        const id = i.identifier.padEnd(idWidth);
+        const status = i.status.padEnd(statusWidth);
+        return `${id}  ${status}  ${(0, sanitize_1.sanitizeField)(i.statement)}`;
+    })
+        .join('\n') + '\n');
+}
 /**
  * Success line for a captured idea. Echoes the human-referenceable id
  * (`<TEAM>-I<n>`, e.g. `LUM-I42`) — the `I` prefix keeps it visibly distinct
@@ -87,3 +119,111 @@ async function ideaCapture(statement, opts) {
     }
     return 1;
 }
+/**
+ * `lumo idea list` — print the team's idea pool newest-first, each line
+ * showing the `<TEAM>-I<n>` id, status (CAPTURED|PLANNED) and statement.
+ * Reads `GET /api/ideas`, which returns the whole pool already ordered
+ * newest-first.
+ */
+async function ideaList() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const url = `${base}/api/ideas`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: idea list failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const data = (await res.json());
+    process.stdout.write(formatIdeaList(data.ideas));
+}
+/**
+ * `lumo idea update <id> --status <STATUS>` — move an idea through its
+ * lifecycle (LUM-679). `<id>` is the `<TEAM>-I<n>` identifier (a bare `<n>`
+ * also resolves). The status is case-insensitive; the server enforces the
+ * allowed transitions (CAPTURED↔DEVELOPING→PLANNED, any→DROPPED, DROPPED
+ * terminal) and rejects an illegal move with a clear error.
+ */
+async function ideaUpdate(idRef, opts) {
+    if (!idRef || idRef.trim().length === 0) {
+        console.error('Error: missing <id>. Usage: lumo idea update <LUM-I42> --status <captured|developing|planned|dropped>');
+        return 1;
+    }
+    const status = opts.status?.trim().toLowerCase();
+    if (!status) {
+        console.error('Error: --status is required. One of: captured | developing | planned | dropped');
+        return 1;
+    }
+    if (!IDEA_STATUS_VALUES.includes(status)) {
+        console.error(`Error: invalid status "${(0, sanitize_1.sanitizeField)(opts.status ?? '')}". One of: captured | developing | planned | dropped`);
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const url = `${base}/api/ideas/${encodeURIComponent(idRef.trim())}`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'PATCH',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ status: status.toUpperCase() }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.ok) {
+        const data = (await res.json());
+        process.stdout.write(`✓ 想法 ${data.idea.identifier} → ${data.idea.status}\n`);
+        return;
+    }
+    let serverMsg = null;
+    try {
+        const errBody = (await res.json());
+        if (typeof errBody.error === 'string')
+            serverMsg = errBody.error;
+    }
+    catch {
+        // Body wasn't JSON; fall through to status-only message
+    }
+    if (serverMsg) {
+        console.error(`Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`);
+    }
+    else {
+        console.error(`Error: idea update failed (HTTP ${res.status})`);
+    }
+    return 1;
+}

package/dist/cli/src/commands/initiative.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatCreatedInitiativeLine = formatCreatedInitiativeLine;
+exports.formatInitiativeList = formatInitiativeList;
+exports.initiativeCreate = initiativeCreate;
+exports.initiativeList = initiativeList;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * Success line for a created initiative. Echoes the human-referenceable id
+ * (`<TEAM>-INIT-<n>`, e.g. `LUM-INIT-3`) — the `INIT` infix keeps it visibly
+ * distinct from task (`LUM-3`) and idea (`LUM-I3`) ids.
+ */
+function formatCreatedInitiativeLine(init) {
+    return `✓ Initiative ${init.identifier} created`;
+}
+/**
+ * Render the initiatives as aligned `<id>  <status>  <goal>` lines. The server
+ * returns them newest-first, so this preserves order. Empty → a friendly line.
+ */
+function formatInitiativeList(initiatives) {
+    if (initiatives.length === 0)
+        return 'No initiatives.\n';
+    const idWidth = Math.max(...initiatives.map(i => i.identifier.length));
+    const statusWidth = Math.max(...initiatives.map(i => i.status.length));
+    return (initiatives
+        .map(i => {
+        const id = i.identifier.padEnd(idWidth);
+        const status = i.status.padEnd(statusWidth);
+        return `${id}  ${status}  ${(0, sanitize_1.sanitizeField)(i.name)}`;
+    })
+        .join('\n') + '\n');
+}
+/**
+ * `lumo initiative create "<goal>" [--assumption <text>]` — create a
+ * team-level Initiative directly, without a converter plan run. Prints the
+ * created `<TEAM>-INIT-<n>` id.
+ */
+async function initiativeCreate(goal, opts) {
+    if (!goal || goal.trim().length === 0) {
+        console.error('Error: missing <goal>. Usage: lumo initiative create "<goal>" [--assumption <text>]');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const url = `${base}/api/initiatives`;
+    const body = { name: goal.trim() };
+    if (opts.assumption !== undefined)
+        body.assumptionNote = opts.assumption;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 201) {
+        const data = (await res.json());
+        process.stdout.write(formatCreatedInitiativeLine(data.initiative) + '\n');
+        return;
+    }
+    let serverMsg = null;
+    try {
+        const errBody = (await res.json());
+        if (typeof errBody.error === 'string')
+            serverMsg = errBody.error;
+    }
+    catch {
+        // Body wasn't JSON; fall through to status-only message
+    }
+    if (serverMsg) {
+        console.error(`Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`);
+    }
+    else {
+        console.error(`Error: initiative create failed (HTTP ${res.status})`);
+    }
+    return 1;
+}
+/**
+ * `lumo initiative list` — print the team's initiatives newest-first, each
+ * line showing the `<TEAM>-INIT-<n>` id, status (ACTIVE|DONE|DROPPED) and goal.
+ */
+async function initiativeList() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const url = `${base}/api/initiatives`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: initiative list failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const data = (await res.json());
+    process.stdout.write(formatInitiativeList(data.initiatives));
+}