@meistrari/tela-cli 1.10.1 → 1.11.0

package/README.md

@@ -1,7 +1,8 @@
 # Tela CLI
 
 `@meistrari/tela-cli` owns the local `tela` binary for scriptable access to
-Tela Local state and agent workflows.
+Tela Local state, Pantry services and skills, agent repositories, and Workflow
+Code projects.
 
 The CLI reads and writes the same `~/.tela/config.json` state as Tela Dock
 through `@meistrari/tela-local-config`. It should not parse local config files
@@ -9,7 +10,10 @@ directly, and normal output must not print token material.
 
 ## Commands
 
-Canonical commands:
+Run `tela help`, `tela agent --help`, `tela skills --help`, or
+`tela workflow --help` for the authoritative flag list.
+
+Local state, auth, and Pantry services:
 
 ```bash
 tela auth login --no-interactive
@@ -32,14 +36,51 @@ tela service docs guide <slug> [path]
 tela service env list <slug> --pretty
 tela service env use <slug> <environment>
 tela doctor auth --json
+```
+
+Managed Pantry skills:
+
+```bash
+tela skills list --json
+tela skills search <query> --json
+tela skills files <slug> --json
+tela skills cat <slug> [path]
+tela skills install <slug...> --force --no-symlink --ignore-scripts --json
+tela skills upgrade [slug...] --ignore-scripts --json
+tela skills uninstall <slug...> --ignore-scripts --json
+```
+
+Agent repository workflows:
+
+```bash
+tela agent setup --list-options --context <context-id> --organization <id-or-name> --clone-root <path> --dry-run --json
 tela agent sync [repo] --current --all --dry-run --json --verbose
-tela agent run --input <name=path>... --plain --json --verbose
+tela agent run --input <name=path>... --mode <one-shot|chat> --input-conflict <fail|overwrite|rename> --plain --json --verbose
 tela agent push --message <text> --claude --manual --dry-run --json --verbose
-tela agent feedback --list --apply <all|select> --json --verbose
+tela agent merge [branch] --base <branch> --strategy <squash|merge> --keep-branch --yes --dry-run --json --verbose
+tela agent feedback --list --apply <all|select> --feedback-id <id>... --json --verbose
 ```
 
+Workflow Code:
+
+```bash
+tela workflow init --directory <path> --workflow <key>... --package-manager <bun|pnpm|npm|yarn> --yes --json
+tela workflow create <target> --project <project-id> --json
+tela workflow compile [target] --config <path> --env <path> --json
+tela workflow sync [target] --yes --json
+tela workflow publish [target] --environment <name> --create-environment-if-missing --yes --json
+tela workflow watch [target] --json
+tela workflow codegen --json
+tela workflow docs [page]
+```
+
+`tela workflow` is routed into `@meistrari/workflow-code`; see
+[`docs/workflow-code/`](../../docs/workflow-code/README.md) for its authoring
+API, compiler, and state model. `tela workflow docs [page]` prints the
+user-facing Workflow Code Page documentation bundled with the CLI.
+
 `auth login` uses device flow and creates or updates a context backed by the
-same Keychain credential adapter as Dock. `auth token` may refresh that session
+same OS keychain credential adapter as Dock. `auth token` may refresh that session
 before returning metadata or printing a raw token. On macOS, renewing a Keychain
 session is delegated to Tela Dock, so sandboxed agents only read the saved
 credential. The CLI opens the installed Dock in the background if needed;

package/dist/commands/auth.js

@@ -48,10 +48,11 @@ async function authLogin(args, options, io) {
         const environment = config.environments[environmentId];
         if (!environment)
             throw new Error(`Unknown Tela environment: ${environmentId}`);
+        // The CLI signs in to its own application; a configured
+        // targetApplicationId (older configs) is ignored.
         const requesterApplicationId = environment.authApplication?.requesterApplicationId;
-        const targetApplicationId = environment.authApplication?.targetApplicationId;
-        if (!requesterApplicationId || !targetApplicationId) {
-            throw new Error(`Environment '${environmentId}' does not define auth application IDs. Configure them before logging in.`);
+        if (!requesterApplicationId) {
+            throw new Error(`Environment '${environmentId}' does not define an auth application ID. Configure it before logging in.`);
         }
         // auth-cli is ESM-only with no `require` export condition, so this
         // CJS bundle can only reach it through a dynamic import.
@@ -60,7 +61,6 @@ async function authLogin(args, options, io) {
         const flowOptions = {
             apiUrl: parsed.authUrl ?? environment.authApiUrl,
             requesterApplicationId,
-            targetApplicationId,
             storage,
         };
         const loginContext = {

package/dist/index.js

@@ -1790,6 +1790,8 @@ var require_auth = __commonJS({
     exports2.refreshUserSessionCredential = refreshUserSessionCredential2;
     exports2.createStoredUserSession = createStoredUserSession;
     exports2.getJwtExpiresAt = getJwtExpiresAt;
+    exports2.listApplicationOrganizations = listApplicationOrganizations;
+    exports2.switchApplicationOrganization = switchApplicationOrganization;
     var node_buffer_1 = require("node:buffer");
     var credential_mutations_1 = require_credential_mutations();
     var credentials_1 = require_credentials();
@@ -1876,6 +1878,62 @@ var require_auth = __commonJS({
         return void 0;
       }
     }
+    async function listApplicationOrganizations(environment, accessToken) {
+      const applicationId = getJwtAudience(accessToken);
+      if (!applicationId)
+        throw new Error("The Tela session does not name its application. Sign in again.");
+      const data = await authApiRequest(environment.authApiUrl, `/applications/candidate-organizations?applicationId=${encodeURIComponent(applicationId)}`, {
+        headers: { authorization: `Bearer ${accessToken}` }
+      });
+      const organizations = Array.isArray(data.organizations) ? data.organizations : [];
+      return organizations.flatMap((organization) => {
+        if (!isPlainObject5(organization))
+          return [];
+        const id = stringField(organization.id);
+        if (!id)
+          return [];
+        const slug = stringField(organization.slug);
+        const logo = httpsUrlField(organization.logo);
+        return [{
+          id,
+          name: stringField(organization.name) ?? stringField(organization.title) ?? slug ?? id,
+          ...slug ? { slug } : {},
+          ...logo ? { logo } : {}
+        }];
+      });
+    }
+    function httpsUrlField(value) {
+      const text2 = stringField(value);
+      if (!text2)
+        return void 0;
+      try {
+        return new URL(text2).protocol === "https:" ? text2 : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    async function switchApplicationOrganization(environment, accessToken, organizationId) {
+      return await authApiRequest(environment.authApiUrl, "/applications/switch-organization", {
+        method: "POST",
+        headers: {
+          "authorization": `Bearer ${accessToken}`,
+          "x-tela-access-token": accessToken
+        },
+        body: { organizationId }
+      });
+    }
+    function getJwtAudience(token) {
+      try {
+        const [, payload] = token.split(".");
+        if (!payload)
+          return void 0;
+        const decoded = JSON.parse(node_buffer_1.Buffer.from(payload, "base64url").toString("utf8"));
+        const audience = Array.isArray(decoded.aud) ? decoded.aud[0] : decoded.aud;
+        return typeof audience === "string" && audience ? audience : void 0;
+      } catch {
+        return void 0;
+      }
+    }
     async function refreshApplicationToken(authApiUrl, refreshToken) {
       return await authApiRequest(authApiUrl, "/applications/token/refresh", {
         method: "POST",
@@ -1968,8 +2026,7 @@ var require_defaults = __commonJS({
             authApiUrl: "https://auth.tela.com",
             defaultApiUrl: "https://api.tela.com",
             authApplication: {
-              requesterApplicationId: "860d5506-cab2-4b8b-b08b-fb4222b65bb2",
-              targetApplicationId: "fe9fa028-4d34-407c-b27a-2ecc4779ae69"
+              requesterApplicationId: "860d5506-cab2-4b8b-b08b-fb4222b65bb2"
             },
             services: {
               pantry: "https://pantry-api.tela.tools",
@@ -1984,8 +2041,7 @@ var require_defaults = __commonJS({
             authApiUrl: "https://auth-api.telastaging.com",
             defaultApiUrl: "https://api.telastaging.com",
             authApplication: {
-              requesterApplicationId: "2d2785a9-f79b-442c-a00c-5e41b25538ff",
-              targetApplicationId: "1c021ec1-b7d1-4d72-8733-ac69d930b2df"
+              requesterApplicationId: "2d2785a9-f79b-442c-a00c-5e41b25538ff"
             },
             services: {
               agent: "https://agent-api.telastaging.com",
@@ -1998,8 +2054,7 @@ var require_defaults = __commonJS({
             authApiUrl: "http://127.0.0.1:3003",
             defaultApiUrl: "http://127.0.0.1:4000",
             authApplication: {
-              requesterApplicationId: "297ad7a7-d003-4097-b27a-f31498226f6e",
-              targetApplicationId: "4a727eb5-3933-4c4d-aa0e-620727c25181"
+              requesterApplicationId: "297ad7a7-d003-4097-b27a-f31498226f6e"
             },
             services: {
               vault: "http://127.0.0.1:8443/_services/vault/"
@@ -18083,6 +18138,8 @@ var require_schema = __commonJS({
     }).strict();
     var authApplicationSchema = zod_1.z.object({
       requesterApplicationId: optionalNonEmptyString,
+      // Written by older releases, which signed in to a second (target) app.
+      // Logins now sign in to the requester alone, so it is read and ignored.
       targetApplicationId: optionalNonEmptyString
     }).strict();
     var environmentSchema = zod_1.z.object({
@@ -36886,7 +36943,7 @@ var init_zod = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/@meistrari+auth-core@1.39.3_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_5390ce4efcf7171453cb5c87c666430d/node_modules/@meistrari/auth-core/dist/index.mjs
+// ../../node_modules/.pnpm/@meistrari+auth-core@2.8.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fe_c2707dc7f0525f2bbdb85ba87f9e4cbd/node_modules/@meistrari/auth-core/dist/index.mjs
 function parsedEnumValues(schema) {
   return Object.fromEntries(
     Object.entries(schema.enum).map(([key, value]) => [
@@ -36895,6 +36952,9 @@ function parsedEnumValues(schema) {
     ])
   );
 }
+function normalizeAmr(amr) {
+  return amr === AMRs.Saml ? AMRs.Sso : amr;
+}
 function normalizeOrganizationsResponse(response) {
   if (Array.isArray(response)) {
     return {
@@ -37053,8 +37113,8 @@ function customEndpointsPluginClient() {
     getActions: ($fetch) => ({
       customEndpoints: {
         organizations: {
-          apiKeys: async () => {
-            return await $fetch("/custom-endpoints/organizations/api-keys");
+          apiKeys: async (organizationId) => {
+            return await $fetch("/custom-endpoints/organizations/api-keys", organizationId === void 0 ? void 0 : { query: { organizationId } });
           }
         },
         teams: {
@@ -37080,6 +37140,26 @@ function handshakePluginClient() {
     })
   };
 }
+function invitationSignupPluginClient() {
+  return {
+    id: "invitation-signup",
+    getActions: ($fetch) => ({
+      invitationSignup: {
+        status: async (invitationId) => {
+          return await $fetch("/invitation/signup-status", {
+            query: { invitationId }
+          });
+        },
+        setupPassword: async (invitationId, password2) => {
+          return await $fetch("/invitation/setup-password", {
+            method: "POST",
+            body: { invitationId, password: password2 }
+          });
+        }
+      }
+    })
+  };
+}
 function sessionAssurancePluginClient() {
   return {
     id: "session-assurance",
@@ -37107,6 +37187,20 @@ function sessionAssurancePluginClient() {
     })
   };
 }
+function loginMethodsPluginClient() {
+  return {
+    id: "login-methods",
+    getActions: ($fetch) => {
+      return {
+        loginMethods: {
+          get: async () => {
+            return await $fetch("/login-methods", { method: "GET" });
+          }
+        }
+      };
+    }
+  };
+}
 function createAPIClient(apiUrl, fetchOptions = {}) {
   const serviceName2 = typeof process !== "undefined" ? process.env.SERVICE_NAME : "";
   const userAgent2 = `auth-sdk:core:${version3}${serviceName2 ? `@${serviceName2}` : ""}`;
@@ -37123,6 +37217,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       customEndpointsPluginClient(),
       handshakePluginClient(),
+      invitationSignupPluginClient(),
       ssoClient(),
       twoFactorClient(),
       jwtClient(),
@@ -37133,6 +37228,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       applicationsPluginClient(),
       sessionAssurancePluginClient(),
+      loginMethodsPluginClient(),
       emailOTPClient()
     ],
     fetchOptions: {
@@ -37249,7 +37345,7 @@ function extractTokenPayload(token) {
 }
 var version3, AMRBrand, AALBrand, ACRBrand, AuthMethodBrand, AMR, AAL, ACR, AuthMethod, AMRs, AALs, ACRs, AuthMethods, statements, ac, Roles, rolesAccessControl, userAdditionalFields, JWTPayloadUser, JWTPayloadWorkspace, JWTPayloadAssurance, DEFAULT_JWT_ASSURANCE, JWTPayload, DEVICE_CODE_GRANT, CLIENT_CREDENTIALS_GRANT, ApplicationRouteError, AdminService, BaseError, ApplicationError, RefreshTokenExpiredError, ApplicationSessionAssuranceError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceAccessDeniedError, DeviceCodeExpiredError, DeviceTransientServerError, OAuthStepUpProvider, StepUpOption, SessionAssurancePolicy, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssuranceRequiredCode, SessionAssurancePayloadAssurance, SessionAssuranceRequiredPayload, SessionAssuranceRequiredError, DEFAULT_SESSION_ASSURANCE_CONFIG, ApplicationSessionAssuranceConfig, ApplicationConfig, ApplicationService, OrganizationService, InvalidSocialProvider, InvalidCallbackURL, EmailRequired, SessionService, ApiKeyService, EmailOTPService, ClientJWTPayloadAssurance, SessionAssuranceResponse, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, SendOtpResponse, SessionAssuranceService, UserService, ApiKeyMetadata, AuthClient;
 var init_dist2 = __esm({
-  "../../node_modules/.pnpm/@meistrari+auth-core@1.39.3_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_5390ce4efcf7171453cb5c87c666430d/node_modules/@meistrari/auth-core/dist/index.mjs"() {
+  "../../node_modules/.pnpm/@meistrari+auth-core@2.8.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fe_c2707dc7f0525f2bbdb85ba87f9e4cbd/node_modules/@meistrari/auth-core/dist/index.mjs"() {
     init_webapi();
     init_client();
     init_client2();
@@ -37258,7 +37354,7 @@ var init_dist2 = __esm({
     init_access2();
     init_access3();
     init_zod();
-    version3 = "1.39.3";
+    version3 = "2.8.0";
     AMRBrand = /* @__PURE__ */ Symbol("amr");
     AALBrand = /* @__PURE__ */ Symbol("aal");
     ACRBrand = /* @__PURE__ */ Symbol("acr");
@@ -37268,6 +37364,11 @@ var init_dist2 = __esm({
       Otp: "otp",
       Oauth: "oauth",
       Sso: "sso",
+      /**
+       * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+       * under `sso`. Still parsed so existing sessions and application policies
+       * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+       */
       Saml: "saml"
     }).brand(AMRBrand);
     AAL = zod_default.enum({
@@ -37282,6 +37383,11 @@ var init_dist2 = __esm({
       Password: "password",
       EmailOTP: "email_otp",
       OAuth: "oauth",
+      SSO: "sso",
+      /**
+       * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+       * under `sso`. Kept so existing sessions still parse; never recorded.
+       */
       SAML: "saml",
       Unknown: "unknown"
     }).brand(AuthMethodBrand);
@@ -37402,6 +37508,8 @@ var init_dist2 = __esm({
         this.client = client;
         this.apiUrl = apiUrl;
       }
+      client;
+      apiUrl;
       /**
        * Requests an application management route.
        *
@@ -37683,6 +37791,47 @@ var init_dist2 = __esm({
         });
         return data;
       }
+      /**
+       * Lists applications with their entitlements as a global admin. Unlike
+       * {@link listApplications}, which goes through the session-only application
+       * routes, this uses the admin endpoint and so also works with a bearer token.
+       *
+       * @param options - Pagination, ordering, organization filter, search, and member preview options
+       * @returns The application listing with entitlement details
+       */
+      async listAdminApplications(options2 = {}) {
+        return await this.client.$fetch("/admin/applications", {
+          method: "GET",
+          query: {
+            ...options2.limit !== void 0 ? { limit: options2.limit } : {},
+            ...options2.offset !== void 0 ? { offset: options2.offset } : {},
+            ...options2.search ? { search: options2.search } : {},
+            ...options2.organizationId ? { organization_id: options2.organizationId } : {},
+            ...options2.membersPreview !== void 0 ? { members_preview: options2.membersPreview } : {},
+            ...options2.orderBy ? { sortBy: options2.orderBy } : {},
+            ...options2.orderDirection ? { sortDirection: options2.orderDirection } : {}
+          }
+        });
+      }
+      /**
+       * Lists the users with access to an application as a global admin, one row
+       * per user with every organization that grants them access and the role it
+       * grants.
+       *
+       * @param options - Application ID, organization filter, pagination, and search options
+       * @returns The paginated application member listing
+       */
+      async listApplicationMembers(options2) {
+        return await this.client.$fetch(`/admin/applications/${encodeURIComponent(options2.applicationId)}/members`, {
+          method: "GET",
+          query: {
+            ...options2.limit !== void 0 ? { limit: options2.limit } : {},
+            ...options2.offset !== void 0 ? { offset: options2.offset } : {},
+            ...options2.query ? { query: options2.query } : {},
+            ...options2.organizationId ? { organization_id: options2.organizationId } : {}
+          }
+        });
+      }
       /**
        * Lists active members for one organization as a global admin.
        *
@@ -37740,6 +37889,36 @@ var init_dist2 = __esm({
         });
         return data;
       }
+      /**
+       * Updates a team for one organization. Global admins may update any
+       * organization; an organization admin only their own.
+       *
+       * @param options - Organization ID, team ID, new name, and optional replacement member IDs
+       * @returns The updated team
+       */
+      async updateOrganizationTeam(options2) {
+        const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options2.organizationId)}/teams/update`, {
+          method: "POST",
+          body: {
+            teamId: options2.teamId,
+            name: options2.name,
+            ...options2.memberIds !== void 0 ? { memberIds: options2.memberIds } : {}
+          }
+        });
+        return data;
+      }
+      /**
+       * Deletes a team for one organization, detaching its members with it.
+       * Global admins may delete from any organization; an organization admin
+       * only from their own.
+       *
+       * @param options - Organization ID and team ID
+       */
+      async deleteOrganizationTeam(options2) {
+        await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options2.organizationId)}/teams/${encodeURIComponent(options2.teamId)}`, {
+          method: "DELETE"
+        });
+      }
       /**
        * Fetches a single entitlement together with its ordered access rules.
        *
@@ -37889,6 +38068,22 @@ var init_dist2 = __esm({
       async unbanUser(userId) {
         await this.client.$fetch("/admin/unban-user", { method: "POST", body: { userId } });
       }
+      /**
+       * Sets a user's password directly, without sending any email. Requires the
+       * global admin role.
+       * @param options - The user and their new password
+       */
+      async setUserPassword(options2) {
+        await this.client.$fetch("/admin/set-user-password", { method: "POST", body: options2 });
+      }
+      /**
+       * Signs a user out everywhere by revoking all of their sessions. Requires
+       * the global admin role.
+       * @param userId - The ID of the user whose sessions are revoked
+       */
+      async revokeUserSessions(userId) {
+        await this.client.$fetch("/admin/revoke-user-sessions", { method: "POST", body: { userId } });
+      }
       /**
        * Permanently removes a user from the auth system.
        * @param userId - The ID of the user to remove
@@ -38062,12 +38257,12 @@ var init_dist2 = __esm({
       acceptedAmr: [
         AMRs.Pwd,
         AMRs.Oauth,
-        AMRs.Saml
+        AMRs.Sso
       ],
       minAal: AALs.Aal1
     };
     ApplicationSessionAssuranceConfig = zod_default.object({
-      acceptedAmr: AMR.array().optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
+      acceptedAmr: AMR.array().overwrite((amrs) => [...new Set(amrs.map(normalizeAmr))]).optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
       minAal: AAL.refine(
         (aal) => aal !== AALs.Aal3,
         "Application session assurance currently supports aal1 and aal2 policies"
@@ -38086,6 +38281,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Gets public display context for an application auth redirect.
        *
@@ -38103,7 +38299,9 @@ var init_dist2 = __esm({
        * Lists candidate organizations for a specific application.
        *
        * Returns organizations where the authenticated user is a member and
-       * the application has been enabled with appropriate entitlement rules.
+       * the effective entitlement grants access through its rules. An enabled global
+       * entitlement is selected first; organization entitlements are considered only
+       * when no global entitlement is enabled.
        *
        * @param applicationId - The application ID to get candidate organizations for
        * @returns The list of candidate organizations
@@ -38152,7 +38350,7 @@ var init_dist2 = __esm({
        * on the verification URI to authorize the device.
        *
        * @param requesterApplicationId - The application requesting authorization
-       * @param targetApplicationId - The target application to gain access to
+       * @param targetApplicationId - The target application to gain access to. Omit it to sign the user in to the requester application itself.
        * @returns Device authorization details including codes and verification URI
        */
       async startDeviceAuthorizationFlow(requesterApplicationId, targetApplicationId) {
@@ -38313,11 +38511,13 @@ var init_dist2 = __esm({
        * Switches the active organization for the authenticated user.
        *
        * Issues new access and refresh tokens scoped to the specified organization.
-       * The target organization must be entitled to the application and the entitlement's
-       * access rules must allow the current user.
+       * Requires active membership in the target organization and an enabled entitlement
+       * whose rules allow the user. The global entitlement is selected first, and its
+       * denial never falls back to an organization entitlement. Organization entitlements
+       * are considered only when no global entitlement is enabled.
        *
        * @param organizationId - The ID of the organization to switch to
-       * @param accessToken - Optional access token for authentication (uses cookie if not provided)
+       * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
        * @returns New authentication tokens and user/organization details
        */
       async switchOrganization(organizationId, accessToken) {
@@ -38348,6 +38548,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Retrieves a single organization by ID with optional related data.
        *
@@ -38465,6 +38666,33 @@ var init_dist2 = __esm({
           member: response.member
         };
       }
+      /**
+       * Gets the pre-login signup status for an invitation.
+       *
+       * Public endpoint keyed by the invitation id from the emailed invite link.
+       * While the invitation is pending, the result includes the invited email
+       * and whether the invited user still needs to set up their account.
+       *
+       * @param id - The invitation ID from the invite link
+       * @returns The invitation status with account-setup information
+       */
+      async getInvitationSignupStatus(id) {
+        return await this.client.invitationSignup.status(id);
+      }
+      /**
+       * Creates a password for an invited user who has no account yet.
+       *
+       * Only available once per invitation, while the invitation is pending and
+       * the invited user has never signed in. The user is signed in as part of
+       * the call; the session cookie is set on the response.
+       *
+       * @param id - The invitation ID from the invite link
+       * @param password - The password to create (minimum 8 characters)
+       * @returns The session token and signed-in user
+       */
+      async setupInvitationPassword(id, password2) {
+        return await this.client.invitationSignup.setupPassword(id, password2);
+      }
       /**
        * Removes a user from the active organization.
        *
@@ -38595,6 +38823,8 @@ var init_dist2 = __esm({
         this.client = client;
         this.apiUrl = apiUrl;
       }
+      client;
+      apiUrl;
       /**
        * Retrieves the current user session.
        *
@@ -38619,6 +38849,19 @@ var init_dist2 = __esm({
       async getToken() {
         return await this.client.token();
       }
+      /**
+       * Lists the login methods enabled in the environment. Public; safe to call
+       * before authentication to decide which sign-in options to render.
+       *
+       * @returns The enabled login methods
+       */
+      async getLoginMethods() {
+        const response = await this.client.loginMethods.get();
+        if (!response.data) {
+          throw new Error("No data returned from the API", { cause: response.error });
+        }
+        return response.data.loginMethods;
+      }
       /**
        * Initiates social authentication flow with Google or Microsoft.
        *
@@ -38626,6 +38869,7 @@ var init_dist2 = __esm({
        * @param options.provider - The social provider
        * @param options.callbackURL - URL to redirect to after successful authentication
        * @param options.errorCallbackURL - URL to redirect to on error
+       * @param options.loginHint - Email to preselect at the provider
        *
        * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
        * @throws {InvalidCallbackURL} When callback URLs are malformed
@@ -38633,7 +38877,8 @@ var init_dist2 = __esm({
       async signInWithSocialProvider({
         provider,
         callbackURL,
-        errorCallbackURL
+        errorCallbackURL,
+        loginHint
       }) {
         if (provider !== "google" && provider !== "microsoft") {
           throw new InvalidSocialProvider("Invalid social provider");
@@ -38648,21 +38893,23 @@ var init_dist2 = __esm({
         await this.client.signIn.social({
           provider,
           callbackURL,
-          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
+          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
+          ...loginHint && { loginHint }
         });
       }
       /**
-       * Initiates SAML-based Single Sign-On authentication flow.
+       * Initiates the Single Sign-On authentication flow. The provider resolved
+       * from the email's domain determines whether SAML or OIDC is used.
        *
-       * @param options - SAML sign-in configuration
-       * @param options.email - User's email to determine the SAML provider
+       * @param options - SSO sign-in configuration
+       * @param options.email - User's email to determine the SSO provider
        * @param options.callbackURL - URL to redirect to after successful authentication
        * @param options.errorCallbackURL - URL to redirect to on error
        *
        * @throws {EmailRequired} When email is not provided
        * @throws {InvalidCallbackURL} When callback URLs are malformed
        */
-      async signInWithSaml({
+      async signInWithSso({
         email: email3,
         callbackURL,
         errorCallbackURL
@@ -38680,8 +38927,7 @@ var init_dist2 = __esm({
         await this.client.signIn.sso({
           email: email3,
           callbackURL,
-          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
-          providerType: "saml"
+          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
         });
       }
       /**
@@ -38758,6 +39004,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Creates a new API key.
        *
@@ -38797,12 +39044,13 @@ var init_dist2 = __esm({
         return await this.client.apiKey.list();
       }
       /**
-       * Lists all API keys belonging to the active organization.
+       * Lists all API keys belonging to an organization.
        *
+       * @param organizationId - Defaults to the active organization. Only global admins may select another organization.
        * @returns An array of API keys (without secret key values)
        */
-      async listOrganizationApiKeys() {
-        return await this.client.customEndpoints.organizations.apiKeys();
+      async listOrganizationApiKeys(organizationId) {
+        return await this.client.customEndpoints.organizations.apiKeys(organizationId);
       }
       /**
        * Updates an existing API key.
@@ -38836,6 +39084,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Sends a sign-in verification OTP to an email address.
        *
@@ -38881,6 +39130,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       async get() {
         return parseResponse(SessionAssuranceResponse, await this.client.sessionAssurance.getSessionAssurance());
       }
@@ -38904,6 +39154,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       async changePassword(currentPassword, newPassword) {
         return await this.client.changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
       }
@@ -39876,7 +40127,7 @@ var init_emittery = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/@meistrari+auth-cli@1.6.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_0bf65f4b8ffb95a65428638518b6161c/node_modules/@meistrari/auth-cli/dist/index.mjs
+// ../../node_modules/.pnpm/@meistrari+auth-cli@1.7.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_7a4cef6c29c6b591a268b55d655638b9/node_modules/@meistrari/auth-cli/dist/index.mjs
 var dist_exports = {};
 __export(dist_exports, {
   ApplicationSessionAssuranceError: () => ApplicationSessionAssuranceError,
@@ -39895,7 +40146,7 @@ function isNotFound(err) {
 }
 var import_promises2, import_promises3, import_node_path, DeviceFlowAbortedError, DEFAULT_POLL_INTERVAL, DeviceFlow, JsonFileStorage;
 var init_dist3 = __esm({
-  "../../node_modules/.pnpm/@meistrari+auth-cli@1.6.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_0bf65f4b8ffb95a65428638518b6161c/node_modules/@meistrari/auth-cli/dist/index.mjs"() {
+  "../../node_modules/.pnpm/@meistrari+auth-cli@1.7.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_7a4cef6c29c6b591a268b55d655638b9/node_modules/@meistrari/auth-cli/dist/index.mjs"() {
     import_promises2 = require("node:timers/promises");
     init_dist2();
     init_dist2();
@@ -39911,6 +40162,7 @@ var init_dist3 = __esm({
         super("Device flow was aborted");
         this.reason = reason;
       }
+      reason;
       name = "DeviceFlowAbortedError";
     };
     DEFAULT_POLL_INTERVAL = 5;
@@ -40231,6 +40483,7 @@ var init_dist3 = __esm({
         this.#indent = options2.indent ?? 2;
         this.#mode = options2.mode ?? 384;
       }
+      path;
       #indent;
       #mode;
       /**
@@ -387685,10 +387938,9 @@ async function authLogin(args, options2, io) {
     if (!environment)
       throw new Error(`Unknown Tela environment: ${environmentId}`);
     const requesterApplicationId = environment.authApplication?.requesterApplicationId;
-    const targetApplicationId = environment.authApplication?.targetApplicationId;
-    if (!requesterApplicationId || !targetApplicationId) {
+    if (!requesterApplicationId) {
       throw new Error(
-        `Environment '${environmentId}' does not define auth application IDs. Configure them before logging in.`
+        `Environment '${environmentId}' does not define an auth application ID. Configure it before logging in.`
       );
     }
     const { DeviceFlow: DeviceFlow2 } = await Promise.resolve().then(() => (init_dist3(), dist_exports));
@@ -387696,7 +387948,6 @@ async function authLogin(args, options2, io) {
     const flowOptions = {
       apiUrl: parsed.authUrl ?? environment.authApiUrl,
       requesterApplicationId,
-      targetApplicationId,
       storage
     };
     const loginContext = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/tela-cli",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "Tela command line tools for local state and agent workflows.",
   "engines": {
     "node": ">=22"

package/skills/tela-cli/SKILL.md

@@ -1,17 +1,18 @@
 ---
 name: tela-cli
-description: Use when a coding agent needs to operate Tela Agent repositories or Tela Pantry/service ingredients through the local `tela` CLI with non-interactive, flag-driven commands and JSON output.
+description: Use when a coding agent needs to operate Tela Agent repositories, Tela Pantry/service ingredients, managed Pantry skills, or Workflow Code projects through the local `tela` CLI with non-interactive, flag-driven commands and JSON output.
 ---
 
 # Tela CLI
 
-Use the local `tela` binary for Tela Agent repository workflows and Pantry-backed
-service/library discovery. Prefer explicit flags and `--json` so commands are
+Use the local `tela` binary for Tela Agent repository workflows, Pantry-backed
+service/library discovery, managed skills, and Workflow Code projects. Prefer explicit flags and `--json` so commands are
 safe in non-interactive agent sessions.
 
 ## Subpaths
 
 - Agent workflows: read `references/agent.md` before running `tela agent ...`.
+- Workflow Code: read `tela workflow docs` before authoring or changing workflows.
 
 ## Core Rules
 
@@ -21,6 +22,7 @@ safe in non-interactive agent sessions.
 - Read endpoint or library docs before calling a service: `tela service docs endpoints <slug>` then `tela service docs reference <slug> <METHOD> <PATH>`.
 - Prefer `--json` for machine-readable output and errors.
 - Do not rely on prompts in coding-agent sessions; pass every required value by flag.
+- Pass `--yes` to `tela workflow init`, `sync`, and `publish` in agent sessions; without it they prompt in a terminal or stop with a diagnostic when confirmation is needed.
 - Do not print token material. Use `tela auth token --json` for metadata and `--raw` only when a shell command explicitly needs the token.
 
 ## Pantry and Service Commands
@@ -44,6 +46,43 @@ HTTPie-style args for `tela service api`:
 - `name==value` sends a query parameter.
 - `Header:value` sends a request header.
 
+## Managed Skills
+
+```bash
+tela skills list --json
+tela skills search <query> --json
+tela skills files <slug> --json
+tela skills cat <slug> [path]
+tela skills install <slug...> --json
+tela skills upgrade [slug...] --json
+tela skills uninstall <slug...> --json
+```
+
+Use `search`, `files`, and `cat` to inspect a skill before installing it.
+`install` places the skill under `~/.agents/skills` and links it into the
+configured provider directories; `--no-symlink` skips the links. `--force`
+replaces a directory Tela did not install, so only use it when the error asks
+for it. `--ignore-scripts` skips a skill's install/uninstall scripts; use it
+only when a script failed and the error suggests it. `upgrade` without slugs
+upgrades every installed skill.
+
+## Workflow Code
+
+```bash
+tela workflow docs --json
+tela workflow docs <page>
+tela workflow init --directory <path> --workflow <key> --yes --json
+tela workflow create <target> --project <project-id> --json
+tela workflow compile [target] --json
+tela workflow sync [target] --yes --json
+tela workflow publish [target] --environment <name> --yes --json
+```
+
+`tela workflow docs` lists the bundled documentation pages; read the relevant
+page (for example `api-reference` or `cli`) before writing workflow code.
+Compile locally before `sync`, and `sync` before `publish`. Run
+`tela workflow --help` for every flag.
+
 ## Authentication
 
 Use `tela auth login --no-interactive` in an agent session. Open the URL it

package/skills/tela-cli/references/agent.md

@@ -81,6 +81,46 @@ tela agent push --message "feat: update agent behavior" --json
 Use `--message` for agent sessions. `--claude` asks the local Claude CLI to
 write a message, and `--manual` relies on fallback behavior.
 
+## Merge
+
+Preview merging an agent branch into the repository's default branch:
+
+```bash
+tela agent merge --dry-run --json
+tela agent merge feature/my-branch --dry-run --json
+```
+
+Merge after checking the dry run. JSON or non-interactive sessions must pass
+`--yes`:
+
+```bash
+tela agent merge feature/my-branch --yes --json
+```
+
+The branch defaults to the current checkout's branch, and the base defaults to
+the repository's default branch; override it with `--base <branch>`. Passing a
+different branch checks it out, even with `--dry-run`. `--strategy squash`
+(default) or `--strategy merge` selects how the Agent API merges, and the
+remote branch is deleted unless `--keep-branch` is passed.
+
+Merge stops before any remote merge call when the worktree is dirty
+(`merge_dirty_worktree`), a merge is already in progress (`merge_in_progress`),
+the branch is not on origin (`merge_branch_not_pushed`), or it has unpushed
+commits (`merge_unpushed_commits`). Follow the error's `fixes`; most of these
+are cleared by `tela agent push`.
+
+When the Agent API reports conflicts, the command merges `origin/<base>` into
+the branch locally and returns `status: "conflicts"`. Read `localMergeClean`:
+
+- `true`: the local merge applied cleanly. Run `tela agent push`, then rerun
+  `tela agent merge <branch>`.
+- `false`: conflict markers are left in the checkout. Resolve them, run
+  `tela agent push` to commit and upload the resolution, then rerun
+  `tela agent merge <branch>`.
+
+Use `tela agent push` rather than raw git to commit the resolution, so the
+branch is uploaded in the same step.
+
 ## Feedback
 
 List feedback for the current commit: