@meistrari/tela-cli 1.10.1 → 1.12.0

package/README.md

@@ -1,7 +1,8 @@
 # Tela CLI
 
 `@meistrari/tela-cli` owns the local `tela` binary for scriptable access to
-Tela Local state and agent workflows.
+Tela Local state, Pantry services and skills, agent repositories, and Workflow
+Code projects.
 
 The CLI reads and writes the same `~/.tela/config.json` state as Tela Dock
 through `@meistrari/tela-local-config`. It should not parse local config files
@@ -9,7 +10,10 @@ directly, and normal output must not print token material.
 
 ## Commands
 
-Canonical commands:
+Run `tela help`, `tela agent --help`, `tela skills --help`, or
+`tela workflow --help` for the authoritative flag list.
+
+Local state, auth, and Pantry services:
 
 ```bash
 tela auth login --no-interactive
@@ -32,14 +36,51 @@ tela service docs guide <slug> [path]
 tela service env list <slug> --pretty
 tela service env use <slug> <environment>
 tela doctor auth --json
+```
+
+Managed Pantry skills:
+
+```bash
+tela skills list --json
+tela skills search <query> --json
+tela skills files <slug> --json
+tela skills cat <slug> [path]
+tela skills install <slug...> --force --no-symlink --ignore-scripts --json
+tela skills upgrade [slug...] --ignore-scripts --json
+tela skills uninstall <slug...> --ignore-scripts --json
+```
+
+Agent repository workflows:
+
+```bash
+tela agent setup --list-options --context <context-id> --organization <id-or-name> --clone-root <path> --dry-run --json
 tela agent sync [repo] --current --all --dry-run --json --verbose
-tela agent run --input <name=path>... --plain --json --verbose
+tela agent run --input <name=path>... --mode <one-shot|chat> --input-conflict <fail|overwrite|rename> --plain --json --verbose
 tela agent push --message <text> --claude --manual --dry-run --json --verbose
-tela agent feedback --list --apply <all|select> --json --verbose
+tela agent merge [branch] --base <branch> --strategy <squash|merge> --keep-branch --yes --dry-run --json --verbose
+tela agent feedback --list --apply <all|select> --feedback-id <id>... --json --verbose
 ```
 
+Workflow Code:
+
+```bash
+tela workflow init --directory <path> --workflow <key>... --package-manager <bun|pnpm|npm|yarn> --yes --json
+tela workflow create <target> --project <project-id> --json
+tela workflow compile [target] --config <path> --env <path> --json
+tela workflow sync [target] --yes --json
+tela workflow publish [target] --environment <name> --create-environment-if-missing --yes --json
+tela workflow watch [target] --json
+tela workflow codegen --json
+tela workflow docs [page]
+```
+
+`tela workflow` is routed into `@meistrari/workflow-code`; see
+[`docs/workflow-code/`](../../docs/workflow-code/README.md) for its authoring
+API, compiler, and state model. `tela workflow docs [page]` prints the
+user-facing Workflow Code Page documentation bundled with the CLI.
+
 `auth login` uses device flow and creates or updates a context backed by the
-same Keychain credential adapter as Dock. `auth token` may refresh that session
+same OS keychain credential adapter as Dock. `auth token` may refresh that session
 before returning metadata or printing a raw token. On macOS, renewing a Keychain
 session is delegated to Tela Dock, so sandboxed agents only read the saved
 credential. The CLI opens the installed Dock in the background if needed;

package/dist/commands/auth.js

@@ -48,10 +48,11 @@ async function authLogin(args, options, io) {
         const environment = config.environments[environmentId];
         if (!environment)
             throw new Error(`Unknown Tela environment: ${environmentId}`);
+        // The CLI signs in to its own application; a configured
+        // targetApplicationId (older configs) is ignored.
         const requesterApplicationId = environment.authApplication?.requesterApplicationId;
-        const targetApplicationId = environment.authApplication?.targetApplicationId;
-        if (!requesterApplicationId || !targetApplicationId) {
-            throw new Error(`Environment '${environmentId}' does not define auth application IDs. Configure them before logging in.`);
+        if (!requesterApplicationId) {
+            throw new Error(`Environment '${environmentId}' does not define an auth application ID. Configure it before logging in.`);
         }
         // auth-cli is ESM-only with no `require` export condition, so this
         // CJS bundle can only reach it through a dynamic import.
@@ -60,7 +61,6 @@ async function authLogin(args, options, io) {
         const flowOptions = {
             apiUrl: parsed.authUrl ?? environment.authApiUrl,
             requesterApplicationId,
-            targetApplicationId,
             storage,
         };
         const loginContext = {

package/dist/commands/skills.js

@@ -177,15 +177,21 @@ async function installSkills(args, options, io) {
         ignoreScripts: flags.ignoreScripts,
         ...(flags.symlink ? {} : { targets: [] }),
     });
+    // A failed install script rolls back only its own skill, so report the rest and still fail.
+    const installedSlugs = new Set(installed.map(entry => entry.slug));
+    const failed = flags.rest.filter(slug => !installedSlugs.has(slug));
     if (options.json) {
-        (0, output_1.writeJson)(io, { installed });
-        return 0;
+        (0, output_1.writeJson)(io, failed.length > 0 ? { installed, failed } : { installed });
+        return failed.length > 0 ? 1 : 0;
     }
     for (const entry of installed)
         (0, output_1.writeLine)(io, `Installed ${entry.slug}@${entry.sha.slice(0, 7)} to ${entry.dir}`);
-    return 0;
+    return failed.length > 0 ? 1 : 0;
 }
 function writeSkillManagerDiagnostic(io, diagnostic) {
+    // A failed uninstall script throws, and the command prints that error.
+    if (diagnostic.type === 'lifecycle-failed' && diagnostic.phase === 'uninstall')
+        return;
     (0, output_1.writeError)(io, diagnostic.message);
 }
 async function upgradeSkills(args, options, io) {

package/dist/index.js

@@ -1790,6 +1790,8 @@ var require_auth = __commonJS({
     exports2.refreshUserSessionCredential = refreshUserSessionCredential2;
     exports2.createStoredUserSession = createStoredUserSession;
     exports2.getJwtExpiresAt = getJwtExpiresAt;
+    exports2.listApplicationOrganizations = listApplicationOrganizations;
+    exports2.switchApplicationOrganization = switchApplicationOrganization;
     var node_buffer_1 = require("node:buffer");
     var credential_mutations_1 = require_credential_mutations();
     var credentials_1 = require_credentials();
@@ -1876,6 +1878,62 @@ var require_auth = __commonJS({
         return void 0;
       }
     }
+    async function listApplicationOrganizations(environment, accessToken) {
+      const applicationId = getJwtAudience(accessToken);
+      if (!applicationId)
+        throw new Error("The Tela session does not name its application. Sign in again.");
+      const data = await authApiRequest(environment.authApiUrl, `/applications/candidate-organizations?applicationId=${encodeURIComponent(applicationId)}`, {
+        headers: { authorization: `Bearer ${accessToken}` }
+      });
+      const organizations = Array.isArray(data.organizations) ? data.organizations : [];
+      return organizations.flatMap((organization) => {
+        if (!isPlainObject5(organization))
+          return [];
+        const id = stringField(organization.id);
+        if (!id)
+          return [];
+        const slug = stringField(organization.slug);
+        const logo = httpsUrlField(organization.logo);
+        return [{
+          id,
+          name: stringField(organization.name) ?? stringField(organization.title) ?? slug ?? id,
+          ...slug ? { slug } : {},
+          ...logo ? { logo } : {}
+        }];
+      });
+    }
+    function httpsUrlField(value) {
+      const text2 = stringField(value);
+      if (!text2)
+        return void 0;
+      try {
+        return new URL(text2).protocol === "https:" ? text2 : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    async function switchApplicationOrganization(environment, accessToken, organizationId) {
+      return await authApiRequest(environment.authApiUrl, "/applications/switch-organization", {
+        method: "POST",
+        headers: {
+          "authorization": `Bearer ${accessToken}`,
+          "x-tela-access-token": accessToken
+        },
+        body: { organizationId }
+      });
+    }
+    function getJwtAudience(token) {
+      try {
+        const [, payload] = token.split(".");
+        if (!payload)
+          return void 0;
+        const decoded = JSON.parse(node_buffer_1.Buffer.from(payload, "base64url").toString("utf8"));
+        const audience = Array.isArray(decoded.aud) ? decoded.aud[0] : decoded.aud;
+        return typeof audience === "string" && audience ? audience : void 0;
+      } catch {
+        return void 0;
+      }
+    }
     async function refreshApplicationToken(authApiUrl, refreshToken) {
       return await authApiRequest(authApiUrl, "/applications/token/refresh", {
         method: "POST",
@@ -1968,8 +2026,7 @@ var require_defaults = __commonJS({
             authApiUrl: "https://auth.tela.com",
             defaultApiUrl: "https://api.tela.com",
             authApplication: {
-              requesterApplicationId: "860d5506-cab2-4b8b-b08b-fb4222b65bb2",
-              targetApplicationId: "fe9fa028-4d34-407c-b27a-2ecc4779ae69"
+              requesterApplicationId: "860d5506-cab2-4b8b-b08b-fb4222b65bb2"
             },
             services: {
               pantry: "https://pantry-api.tela.tools",
@@ -1984,8 +2041,7 @@ var require_defaults = __commonJS({
             authApiUrl: "https://auth-api.telastaging.com",
             defaultApiUrl: "https://api.telastaging.com",
             authApplication: {
-              requesterApplicationId: "2d2785a9-f79b-442c-a00c-5e41b25538ff",
-              targetApplicationId: "1c021ec1-b7d1-4d72-8733-ac69d930b2df"
+              requesterApplicationId: "2d2785a9-f79b-442c-a00c-5e41b25538ff"
             },
             services: {
               agent: "https://agent-api.telastaging.com",
@@ -1998,8 +2054,7 @@ var require_defaults = __commonJS({
             authApiUrl: "http://127.0.0.1:3003",
             defaultApiUrl: "http://127.0.0.1:4000",
             authApplication: {
-              requesterApplicationId: "297ad7a7-d003-4097-b27a-f31498226f6e",
-              targetApplicationId: "4a727eb5-3933-4c4d-aa0e-620727c25181"
+              requesterApplicationId: "297ad7a7-d003-4097-b27a-f31498226f6e"
             },
             services: {
               vault: "http://127.0.0.1:8443/_services/vault/"
@@ -18083,6 +18138,8 @@ var require_schema = __commonJS({
     }).strict();
     var authApplicationSchema = zod_1.z.object({
       requesterApplicationId: optionalNonEmptyString,
+      // Written by older releases, which signed in to a second (target) app.
+      // Logins now sign in to the requester alone, so it is read and ignored.
       targetApplicationId: optionalNonEmptyString
     }).strict();
     var environmentSchema = zod_1.z.object({
@@ -36886,7 +36943,7 @@ var init_zod = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/@meistrari+auth-core@1.39.3_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_5390ce4efcf7171453cb5c87c666430d/node_modules/@meistrari/auth-core/dist/index.mjs
+// ../../node_modules/.pnpm/@meistrari+auth-core@2.8.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fe_c2707dc7f0525f2bbdb85ba87f9e4cbd/node_modules/@meistrari/auth-core/dist/index.mjs
 function parsedEnumValues(schema) {
   return Object.fromEntries(
     Object.entries(schema.enum).map(([key, value]) => [
@@ -36895,6 +36952,9 @@ function parsedEnumValues(schema) {
     ])
   );
 }
+function normalizeAmr(amr) {
+  return amr === AMRs.Saml ? AMRs.Sso : amr;
+}
 function normalizeOrganizationsResponse(response) {
   if (Array.isArray(response)) {
     return {
@@ -37053,8 +37113,8 @@ function customEndpointsPluginClient() {
     getActions: ($fetch) => ({
       customEndpoints: {
         organizations: {
-          apiKeys: async () => {
-            return await $fetch("/custom-endpoints/organizations/api-keys");
+          apiKeys: async (organizationId) => {
+            return await $fetch("/custom-endpoints/organizations/api-keys", organizationId === void 0 ? void 0 : { query: { organizationId } });
           }
         },
         teams: {
@@ -37080,6 +37140,26 @@ function handshakePluginClient() {
     })
   };
 }
+function invitationSignupPluginClient() {
+  return {
+    id: "invitation-signup",
+    getActions: ($fetch) => ({
+      invitationSignup: {
+        status: async (invitationId) => {
+          return await $fetch("/invitation/signup-status", {
+            query: { invitationId }
+          });
+        },
+        setupPassword: async (invitationId, password2) => {
+          return await $fetch("/invitation/setup-password", {
+            method: "POST",
+            body: { invitationId, password: password2 }
+          });
+        }
+      }
+    })
+  };
+}
 function sessionAssurancePluginClient() {
   return {
     id: "session-assurance",
@@ -37107,6 +37187,20 @@ function sessionAssurancePluginClient() {
     })
   };
 }
+function loginMethodsPluginClient() {
+  return {
+    id: "login-methods",
+    getActions: ($fetch) => {
+      return {
+        loginMethods: {
+          get: async () => {
+            return await $fetch("/login-methods", { method: "GET" });
+          }
+        }
+      };
+    }
+  };
+}
 function createAPIClient(apiUrl, fetchOptions = {}) {
   const serviceName2 = typeof process !== "undefined" ? process.env.SERVICE_NAME : "";
   const userAgent2 = `auth-sdk:core:${version3}${serviceName2 ? `@${serviceName2}` : ""}`;
@@ -37123,6 +37217,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       customEndpointsPluginClient(),
       handshakePluginClient(),
+      invitationSignupPluginClient(),
       ssoClient(),
       twoFactorClient(),
       jwtClient(),
@@ -37133,6 +37228,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       applicationsPluginClient(),
       sessionAssurancePluginClient(),
+      loginMethodsPluginClient(),
       emailOTPClient()
     ],
     fetchOptions: {
@@ -37249,7 +37345,7 @@ function extractTokenPayload(token) {
 }
 var version3, AMRBrand, AALBrand, ACRBrand, AuthMethodBrand, AMR, AAL, ACR, AuthMethod, AMRs, AALs, ACRs, AuthMethods, statements, ac, Roles, rolesAccessControl, userAdditionalFields, JWTPayloadUser, JWTPayloadWorkspace, JWTPayloadAssurance, DEFAULT_JWT_ASSURANCE, JWTPayload, DEVICE_CODE_GRANT, CLIENT_CREDENTIALS_GRANT, ApplicationRouteError, AdminService, BaseError, ApplicationError, RefreshTokenExpiredError, ApplicationSessionAssuranceError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceAccessDeniedError, DeviceCodeExpiredError, DeviceTransientServerError, OAuthStepUpProvider, StepUpOption, SessionAssurancePolicy, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssuranceRequiredCode, SessionAssurancePayloadAssurance, SessionAssuranceRequiredPayload, SessionAssuranceRequiredError, DEFAULT_SESSION_ASSURANCE_CONFIG, ApplicationSessionAssuranceConfig, ApplicationConfig, ApplicationService, OrganizationService, InvalidSocialProvider, InvalidCallbackURL, EmailRequired, SessionService, ApiKeyService, EmailOTPService, ClientJWTPayloadAssurance, SessionAssuranceResponse, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, SendOtpResponse, SessionAssuranceService, UserService, ApiKeyMetadata, AuthClient;
 var init_dist2 = __esm({
-  "../../node_modules/.pnpm/@meistrari+auth-core@1.39.3_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-f_5390ce4efcf7171453cb5c87c666430d/node_modules/@meistrari/auth-core/dist/index.mjs"() {
+  "../../node_modules/.pnpm/@meistrari+auth-core@2.8.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fe_c2707dc7f0525f2bbdb85ba87f9e4cbd/node_modules/@meistrari/auth-core/dist/index.mjs"() {
     init_webapi();
     init_client();
     init_client2();
@@ -37258,7 +37354,7 @@ var init_dist2 = __esm({
     init_access2();
     init_access3();
     init_zod();
-    version3 = "1.39.3";
+    version3 = "2.8.0";
     AMRBrand = /* @__PURE__ */ Symbol("amr");
     AALBrand = /* @__PURE__ */ Symbol("aal");
     ACRBrand = /* @__PURE__ */ Symbol("acr");
@@ -37268,6 +37364,11 @@ var init_dist2 = __esm({
       Otp: "otp",
       Oauth: "oauth",
       Sso: "sso",
+      /**
+       * @deprecated Issued to SSO sessions before SAML and OIDC were unified
+       * under `sso`. Still parsed so existing sessions and application policies
+       * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
+       */
       Saml: "saml"
     }).brand(AMRBrand);
     AAL = zod_default.enum({
@@ -37282,6 +37383,11 @@ var init_dist2 = __esm({
       Password: "password",
       EmailOTP: "email_otp",
       OAuth: "oauth",
+      SSO: "sso",
+      /**
+       * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
+       * under `sso`. Kept so existing sessions still parse; never recorded.
+       */
       SAML: "saml",
       Unknown: "unknown"
     }).brand(AuthMethodBrand);
@@ -37402,6 +37508,8 @@ var init_dist2 = __esm({
         this.client = client;
         this.apiUrl = apiUrl;
       }
+      client;
+      apiUrl;
       /**
        * Requests an application management route.
        *
@@ -37683,6 +37791,47 @@ var init_dist2 = __esm({
         });
         return data;
       }
+      /**
+       * Lists applications with their entitlements as a global admin. Unlike
+       * {@link listApplications}, which goes through the session-only application
+       * routes, this uses the admin endpoint and so also works with a bearer token.
+       *
+       * @param options - Pagination, ordering, organization filter, search, and member preview options
+       * @returns The application listing with entitlement details
+       */
+      async listAdminApplications(options2 = {}) {
+        return await this.client.$fetch("/admin/applications", {
+          method: "GET",
+          query: {
+            ...options2.limit !== void 0 ? { limit: options2.limit } : {},
+            ...options2.offset !== void 0 ? { offset: options2.offset } : {},
+            ...options2.search ? { search: options2.search } : {},
+            ...options2.organizationId ? { organization_id: options2.organizationId } : {},
+            ...options2.membersPreview !== void 0 ? { members_preview: options2.membersPreview } : {},
+            ...options2.orderBy ? { sortBy: options2.orderBy } : {},
+            ...options2.orderDirection ? { sortDirection: options2.orderDirection } : {}
+          }
+        });
+      }
+      /**
+       * Lists the users with access to an application as a global admin, one row
+       * per user with every organization that grants them access and the role it
+       * grants.
+       *
+       * @param options - Application ID, organization filter, pagination, and search options
+       * @returns The paginated application member listing
+       */
+      async listApplicationMembers(options2) {
+        return await this.client.$fetch(`/admin/applications/${encodeURIComponent(options2.applicationId)}/members`, {
+          method: "GET",
+          query: {
+            ...options2.limit !== void 0 ? { limit: options2.limit } : {},
+            ...options2.offset !== void 0 ? { offset: options2.offset } : {},
+            ...options2.query ? { query: options2.query } : {},
+            ...options2.organizationId ? { organization_id: options2.organizationId } : {}
+          }
+        });
+      }
       /**
        * Lists active members for one organization as a global admin.
        *
@@ -37740,6 +37889,36 @@ var init_dist2 = __esm({
         });
         return data;
       }
+      /**
+       * Updates a team for one organization. Global admins may update any
+       * organization; an organization admin only their own.
+       *
+       * @param options - Organization ID, team ID, new name, and optional replacement member IDs
+       * @returns The updated team
+       */
+      async updateOrganizationTeam(options2) {
+        const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options2.organizationId)}/teams/update`, {
+          method: "POST",
+          body: {
+            teamId: options2.teamId,
+            name: options2.name,
+            ...options2.memberIds !== void 0 ? { memberIds: options2.memberIds } : {}
+          }
+        });
+        return data;
+      }
+      /**
+       * Deletes a team for one organization, detaching its members with it.
+       * Global admins may delete from any organization; an organization admin
+       * only from their own.
+       *
+       * @param options - Organization ID and team ID
+       */
+      async deleteOrganizationTeam(options2) {
+        await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options2.organizationId)}/teams/${encodeURIComponent(options2.teamId)}`, {
+          method: "DELETE"
+        });
+      }
       /**
        * Fetches a single entitlement together with its ordered access rules.
        *
@@ -37889,6 +38068,22 @@ var init_dist2 = __esm({
       async unbanUser(userId) {
         await this.client.$fetch("/admin/unban-user", { method: "POST", body: { userId } });
       }
+      /**
+       * Sets a user's password directly, without sending any email. Requires the
+       * global admin role.
+       * @param options - The user and their new password
+       */
+      async setUserPassword(options2) {
+        await this.client.$fetch("/admin/set-user-password", { method: "POST", body: options2 });
+      }
+      /**
+       * Signs a user out everywhere by revoking all of their sessions. Requires
+       * the global admin role.
+       * @param userId - The ID of the user whose sessions are revoked
+       */
+      async revokeUserSessions(userId) {
+        await this.client.$fetch("/admin/revoke-user-sessions", { method: "POST", body: { userId } });
+      }
       /**
        * Permanently removes a user from the auth system.
        * @param userId - The ID of the user to remove
@@ -38062,12 +38257,12 @@ var init_dist2 = __esm({
       acceptedAmr: [
         AMRs.Pwd,
         AMRs.Oauth,
-        AMRs.Saml
+        AMRs.Sso
       ],
       minAal: AALs.Aal1
     };
     ApplicationSessionAssuranceConfig = zod_default.object({
-      acceptedAmr: AMR.array().optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
+      acceptedAmr: AMR.array().overwrite((amrs) => [...new Set(amrs.map(normalizeAmr))]).optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
       minAal: AAL.refine(
         (aal) => aal !== AALs.Aal3,
         "Application session assurance currently supports aal1 and aal2 policies"
@@ -38086,6 +38281,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Gets public display context for an application auth redirect.
        *
@@ -38103,7 +38299,9 @@ var init_dist2 = __esm({
        * Lists candidate organizations for a specific application.
        *
        * Returns organizations where the authenticated user is a member and
-       * the application has been enabled with appropriate entitlement rules.
+       * the effective entitlement grants access through its rules. An enabled global
+       * entitlement is selected first; organization entitlements are considered only
+       * when no global entitlement is enabled.
        *
        * @param applicationId - The application ID to get candidate organizations for
        * @returns The list of candidate organizations
@@ -38152,7 +38350,7 @@ var init_dist2 = __esm({
        * on the verification URI to authorize the device.
        *
        * @param requesterApplicationId - The application requesting authorization
-       * @param targetApplicationId - The target application to gain access to
+       * @param targetApplicationId - The target application to gain access to. Omit it to sign the user in to the requester application itself.
        * @returns Device authorization details including codes and verification URI
        */
       async startDeviceAuthorizationFlow(requesterApplicationId, targetApplicationId) {
@@ -38313,11 +38511,13 @@ var init_dist2 = __esm({
        * Switches the active organization for the authenticated user.
        *
        * Issues new access and refresh tokens scoped to the specified organization.
-       * The target organization must be entitled to the application and the entitlement's
-       * access rules must allow the current user.
+       * Requires active membership in the target organization and an enabled entitlement
+       * whose rules allow the user. The global entitlement is selected first, and its
+       * denial never falls back to an organization entitlement. Organization entitlements
+       * are considered only when no global entitlement is enabled.
        *
        * @param organizationId - The ID of the organization to switch to
-       * @param accessToken - Optional access token for authentication (uses cookie if not provided)
+       * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
        * @returns New authentication tokens and user/organization details
        */
       async switchOrganization(organizationId, accessToken) {
@@ -38348,6 +38548,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Retrieves a single organization by ID with optional related data.
        *
@@ -38465,6 +38666,33 @@ var init_dist2 = __esm({
           member: response.member
         };
       }
+      /**
+       * Gets the pre-login signup status for an invitation.
+       *
+       * Public endpoint keyed by the invitation id from the emailed invite link.
+       * While the invitation is pending, the result includes the invited email
+       * and whether the invited user still needs to set up their account.
+       *
+       * @param id - The invitation ID from the invite link
+       * @returns The invitation status with account-setup information
+       */
+      async getInvitationSignupStatus(id) {
+        return await this.client.invitationSignup.status(id);
+      }
+      /**
+       * Creates a password for an invited user who has no account yet.
+       *
+       * Only available once per invitation, while the invitation is pending and
+       * the invited user has never signed in. The user is signed in as part of
+       * the call; the session cookie is set on the response.
+       *
+       * @param id - The invitation ID from the invite link
+       * @param password - The password to create (minimum 8 characters)
+       * @returns The session token and signed-in user
+       */
+      async setupInvitationPassword(id, password2) {
+        return await this.client.invitationSignup.setupPassword(id, password2);
+      }
       /**
        * Removes a user from the active organization.
        *
@@ -38595,6 +38823,8 @@ var init_dist2 = __esm({
         this.client = client;
         this.apiUrl = apiUrl;
       }
+      client;
+      apiUrl;
       /**
        * Retrieves the current user session.
        *
@@ -38619,6 +38849,19 @@ var init_dist2 = __esm({
       async getToken() {
         return await this.client.token();
       }
+      /**
+       * Lists the login methods enabled in the environment. Public; safe to call
+       * before authentication to decide which sign-in options to render.
+       *
+       * @returns The enabled login methods
+       */
+      async getLoginMethods() {
+        const response = await this.client.loginMethods.get();
+        if (!response.data) {
+          throw new Error("No data returned from the API", { cause: response.error });
+        }
+        return response.data.loginMethods;
+      }
       /**
        * Initiates social authentication flow with Google or Microsoft.
        *
@@ -38626,6 +38869,7 @@ var init_dist2 = __esm({
        * @param options.provider - The social provider
        * @param options.callbackURL - URL to redirect to after successful authentication
        * @param options.errorCallbackURL - URL to redirect to on error
+       * @param options.loginHint - Email to preselect at the provider
        *
        * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
        * @throws {InvalidCallbackURL} When callback URLs are malformed
@@ -38633,7 +38877,8 @@ var init_dist2 = __esm({
       async signInWithSocialProvider({
         provider,
         callbackURL,
-        errorCallbackURL
+        errorCallbackURL,
+        loginHint
       }) {
         if (provider !== "google" && provider !== "microsoft") {
           throw new InvalidSocialProvider("Invalid social provider");
@@ -38648,21 +38893,23 @@ var init_dist2 = __esm({
         await this.client.signIn.social({
           provider,
           callbackURL,
-          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
+          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
+          ...loginHint && { loginHint }
         });
       }
       /**
-       * Initiates SAML-based Single Sign-On authentication flow.
+       * Initiates the Single Sign-On authentication flow. The provider resolved
+       * from the email's domain determines whether SAML or OIDC is used.
        *
-       * @param options - SAML sign-in configuration
-       * @param options.email - User's email to determine the SAML provider
+       * @param options - SSO sign-in configuration
+       * @param options.email - User's email to determine the SSO provider
        * @param options.callbackURL - URL to redirect to after successful authentication
        * @param options.errorCallbackURL - URL to redirect to on error
        *
        * @throws {EmailRequired} When email is not provided
        * @throws {InvalidCallbackURL} When callback URLs are malformed
        */
-      async signInWithSaml({
+      async signInWithSso({
         email: email3,
         callbackURL,
         errorCallbackURL
@@ -38680,8 +38927,7 @@ var init_dist2 = __esm({
         await this.client.signIn.sso({
           email: email3,
           callbackURL,
-          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
-          providerType: "saml"
+          errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
         });
       }
       /**
@@ -38758,6 +39004,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Creates a new API key.
        *
@@ -38797,12 +39044,13 @@ var init_dist2 = __esm({
         return await this.client.apiKey.list();
       }
       /**
-       * Lists all API keys belonging to the active organization.
+       * Lists all API keys belonging to an organization.
        *
+       * @param organizationId - Defaults to the active organization. Only global admins may select another organization.
        * @returns An array of API keys (without secret key values)
        */
-      async listOrganizationApiKeys() {
-        return await this.client.customEndpoints.organizations.apiKeys();
+      async listOrganizationApiKeys(organizationId) {
+        return await this.client.customEndpoints.organizations.apiKeys(organizationId);
       }
       /**
        * Updates an existing API key.
@@ -38836,6 +39084,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       /**
        * Sends a sign-in verification OTP to an email address.
        *
@@ -38881,6 +39130,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       async get() {
         return parseResponse(SessionAssuranceResponse, await this.client.sessionAssurance.getSessionAssurance());
       }
@@ -38904,6 +39154,7 @@ var init_dist2 = __esm({
       constructor(client) {
         this.client = client;
       }
+      client;
       async changePassword(currentPassword, newPassword) {
         return await this.client.changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
       }
@@ -39876,7 +40127,7 @@ var init_emittery = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/@meistrari+auth-cli@1.6.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_0bf65f4b8ffb95a65428638518b6161c/node_modules/@meistrari/auth-cli/dist/index.mjs
+// ../../node_modules/.pnpm/@meistrari+auth-cli@1.7.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_7a4cef6c29c6b591a268b55d655638b9/node_modules/@meistrari/auth-cli/dist/index.mjs
 var dist_exports = {};
 __export(dist_exports, {
   ApplicationSessionAssuranceError: () => ApplicationSessionAssuranceError,
@@ -39895,7 +40146,7 @@ function isNotFound(err) {
 }
 var import_promises2, import_promises3, import_node_path, DeviceFlowAbortedError, DEFAULT_POLL_INTERVAL, DeviceFlow, JsonFileStorage;
 var init_dist3 = __esm({
-  "../../node_modules/.pnpm/@meistrari+auth-cli@1.6.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_0bf65f4b8ffb95a65428638518b6161c/node_modules/@meistrari/auth-cli/dist/index.mjs"() {
+  "../../node_modules/.pnpm/@meistrari+auth-cli@1.7.0_@better-auth+core@1.6.26_@better-auth+utils@0.4.2_@better-fet_7a4cef6c29c6b591a268b55d655638b9/node_modules/@meistrari/auth-cli/dist/index.mjs"() {
     import_promises2 = require("node:timers/promises");
     init_dist2();
     init_dist2();
@@ -39911,6 +40162,7 @@ var init_dist3 = __esm({
         super("Device flow was aborted");
         this.reason = reason;
       }
+      reason;
       name = "DeviceFlowAbortedError";
     };
     DEFAULT_POLL_INTERVAL = 5;
@@ -40231,6 +40483,7 @@ var init_dist3 = __esm({
         this.#indent = options2.indent ?? 2;
         this.#mode = options2.mode ?? 384;
       }
+      path;
       #indent;
       #mode;
       /**
@@ -76983,9 +77236,7 @@ var require_skill_filesystem = __commonJS({
     var node_os_1 = require("node:os");
     var node_path_1 = __importDefault(require("node:path"));
     var node_process_1 = __importDefault(require("node:process"));
-    var node_util_1 = require("node:util");
     var archive_1 = require_archive();
-    var run = (0, node_util_1.promisify)(node_child_process_1.execFile);
     function resolveDefaultSkillManagerPaths(home = (0, node_os_1.homedir)()) {
       return {
         installRoot: node_path_1.default.join(home, ".agents", "skills"),
@@ -77172,14 +77423,72 @@ There is now nothing at ${target}. The previous installation is intact at ${back
         return { removed: false, reason: `Skipped ${linkPath}: ${describeError(error48)}` };
       }
     }
-    async function runSkillScript(script, cwd) {
+    var SCRIPT_KILL_GRACE_MS = 3e3;
+    var SCRIPT_GROUP_POLL_MS = 50;
+    var MAX_SCRIPT_OUTPUT_LENGTH = 64 * 1024;
+    async function runSkillScript(script, cwd, onOutput, signal) {
+      if (signal?.aborted)
+        return { ok: false, cancelled: true, output: "" };
+      return await new Promise((resolve) => {
+        const child = (0, node_child_process_1.spawn)("sh", ["-c", script], { cwd, detached: node_process_1.default.platform !== "win32" });
+        let output = "";
+        let settled = false;
+        let cancelled = false;
+        const append2 = (chunk) => {
+          if (settled)
+            return;
+          const text2 = chunk.toString();
+          output = `${output}${text2}`.slice(-MAX_SCRIPT_OUTPUT_LENGTH);
+          onOutput?.(text2);
+        };
+        const finish = (ok) => {
+          if (settled)
+            return;
+          settled = true;
+          signal?.removeEventListener("abort", cancel2);
+          resolve({ ok: ok && !cancelled, cancelled, output: output.trimEnd() });
+        };
+        function cancel2() {
+          cancelled = true;
+          killProcessTree(child, "SIGTERM");
+          setTimeout(() => killProcessTree(child, "SIGKILL"), SCRIPT_KILL_GRACE_MS).unref();
+        }
+        signal?.addEventListener("abort", cancel2, { once: true });
+        child.stdout.on("data", append2);
+        child.stderr.on("data", append2);
+        child.on("error", (error48) => {
+          append2(`${describeError(error48)}
+`);
+          finish(false);
+        });
+        child.on("exit", () => {
+          if (cancelled)
+            void waitForProcessGroupExit(child).then(() => finish(false));
+        });
+        child.on("close", (code) => finish(code === 0));
+      });
+    }
+    async function waitForProcessGroupExit(child) {
+      if (child.pid === void 0 || node_process_1.default.platform === "win32")
+        return;
+      while (true) {
+        try {
+          node_process_1.default.kill(-child.pid, 0);
+        } catch {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, SCRIPT_GROUP_POLL_MS));
+      }
+    }
+    function killProcessTree(child, signal) {
+      if (child.pid === void 0)
+        return;
       try {
-        const { stdout: stdout2, stderr } = await run("sh", ["-c", script], { cwd });
-        return { ok: true, output: [stdout2, stderr].map((text2) => text2.trimEnd()).filter(Boolean).join("\n") };
-      } catch (error48) {
-        const shell = error48;
-        const output = [shell.stdout ?? "", shell.stderr ?? "", describeError(error48)].map((text2) => text2.trimEnd()).filter(Boolean).join("\n");
-        return { ok: false, output };
+        if (node_process_1.default.platform === "win32")
+          (0, node_child_process_1.spawn)("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+        else
+          node_process_1.default.kill(-child.pid, signal);
+      } catch {
       }
     }
     function describeError(error48) {
@@ -77236,8 +77545,8 @@ var require_skills = __commonJS({
         ...path2 ? { queries: { path: path2 } } : {}
       }));
     }
-    async function downloadSkillArchive(archiveUrl) {
-      const response = await fetch(archiveUrl);
+    async function downloadSkillArchive(archiveUrl, signal) {
+      const response = await fetch(archiveUrl, { signal });
       if (!response.ok) {
         (0, http_1.assertHttpOk)(response, await response.text().catch(() => ""), "Failed to download skill archive");
       }
@@ -77254,7 +77563,7 @@ var require_skill_manager = __commonJS({
       return mod && mod.__esModule ? mod : { "default": mod };
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SkillInstallDirectoryConflictError = exports2.SkillLifecycleError = exports2.resolveDefaultSkillManagerPaths = void 0;
+    exports2.SkillInstallDirectoryConflictError = exports2.SkillInstallCancelledError = exports2.SkillLifecycleError = exports2.resolveDefaultSkillManagerPaths = void 0;
     exports2.createSkillManager = createSkillManager2;
     var promises_1 = require("node:fs/promises");
     var node_path_1 = __importDefault(require("node:path"));
@@ -77276,10 +77585,22 @@ var require_skill_manager = __commonJS({
         this.phase = phase;
         this.name = "SkillLifecycleError";
         this.slug = entry.slug;
-        this.retainedState = phase === "install" ? "installed" : "unchanged";
+        this.retainedState = "unchanged";
       }
     };
     exports2.SkillLifecycleError = SkillLifecycleError;
+    var SkillInstallCancelledError = class extends Error {
+      slug;
+      installed;
+      code = "skill-install-cancelled";
+      constructor(slug, installed) {
+        super(`Installation was cancelled before ${slug} finished.`);
+        this.slug = slug;
+        this.installed = installed;
+        this.name = "SkillInstallCancelledError";
+      }
+    };
+    exports2.SkillInstallCancelledError = SkillInstallCancelledError;
     var SkillInstallDirectoryConflictError = class extends Error {
       code = "skill-install-directory-conflict";
       path;
@@ -77314,17 +77635,31 @@ Run \`tela skills install ${slug} --force\` to replace it, or remove it by hand.
           const diagnostics = [];
           const installed = [];
           const emit = createDiagnosticEmitter(options2, diagnostics);
+          const signal = installOptions.signal;
           for (const slug of slugs) {
-            const entry = await installOne({
-              client,
-              diagnostics: emit,
-              force: installOptions.force ?? false,
-              ignoreScripts: installOptions.ignoreScripts ?? false,
-              inventoryFile,
-              paths,
-              slug,
-              targets
-            });
+            if (signal?.aborted)
+              throw new SkillInstallCancelledError(slug, installed);
+            let entry;
+            try {
+              entry = await installOne({
+                client,
+                diagnostics: emit,
+                force: installOptions.force ?? false,
+                ignoreScripts: installOptions.ignoreScripts ?? false,
+                inventoryFile,
+                paths,
+                progress: options2.onInstallProgress,
+                signal,
+                slug,
+                targets
+              });
+            } catch (error48) {
+              if (signal?.aborted)
+                throw new SkillInstallCancelledError(slug, installed);
+              if (error48 instanceof SkillLifecycleError && error48.phase === "install")
+                continue;
+              throw error48;
+            }
             if (!entry)
               throw new Error(`Skill install for ${slug} did not produce an inventory entry.`);
             installed.push(entry);
@@ -77358,6 +77693,7 @@ Run \`tela skills install ${slug} --force\` to replace it, or remove it by hand.
                 ignoreScripts: upgradeOptions.ignoreScripts ?? false,
                 inventoryFile,
                 paths,
+                progress: options2.onInstallProgress,
                 slug: replacementSlug,
                 targets
               });
@@ -77388,6 +77724,7 @@ Run \`tela skills install ${slug} --force\` to replace it, or remove it by hand.
               inventoryFile,
               operation: "upgrade",
               paths,
+              progress: options2.onInstallProgress,
               slug: current.slug,
               targets
             });
@@ -77486,30 +77823,68 @@ Run \`tela skills install ${slug} --force\` to replace it, or remove it by hand.
       };
     }
     async function installOne(options2) {
+      options2.progress?.({
+        type: "phase",
+        slug: options2.slug,
+        phase: "fetching-metadata",
+        message: "Fetching skill metadata"
+      });
       const { ingredient, snapshot } = await (0, skills_1.fetchSkillFile)(options2.client, options2.slug);
-      const archive = await (0, skills_1.downloadSkillArchive)(snapshot.archiveUrl);
+      options2.progress?.({
+        type: "phase",
+        slug: options2.slug,
+        phase: "downloading",
+        message: "Downloading skill files"
+      });
+      const archive = await (0, skills_1.downloadSkillArchive)(snapshot.archiveUrl, options2.signal);
+      options2.signal?.throwIfAborted();
+      options2.progress?.({
+        type: "phase",
+        slug: options2.slug,
+        phase: "extracting",
+        message: "Verifying and extracting files"
+      });
       const files = (0, archive_1.verifySnapshotFiles)((0, archive_1.parseTarGz)(archive), snapshot.manifest);
       const target = (0, skill_filesystem_1.resolveInstallDir)(options2.paths, options2.slug);
-      const stagedInstalls = [];
+      const reportConcurrentChange = () => options2.diagnostics({
+        type: "concurrent-change",
+        slug: options2.slug,
+        operation: options2.operation ?? "install",
+        message: `Skipped ${options2.slug}: it was changed while this ${options2.operation ?? "install"} ran`
+      });
+      const before = (await (0, tela_local_config_1.listInstalledSkills)(options2.inventoryFile)).find((entry2) => entry2.slug === options2.slug) ?? null;
+      if (options2.expectedCurrent && !isSameRegistration(before, options2.expectedCurrent)) {
+        reportConcurrentChange();
+        return null;
+      }
+      if ((0, skill_filesystem_1.isUnownedInstallDir)(target, before?.dir ?? null) && !options2.force)
+        throw new SkillInstallDirectoryConflictError(options2.slug, target);
+      const staged = await (0, skill_filesystem_1.stageSkillFiles)(target, files);
       let concurrentChange = false;
       let entry = null;
       try {
+        const lifecycleEntry = {
+          slug: options2.slug,
+          dir: target,
+          sha: snapshot.sha,
+          bundle: ingredient.bundle,
+          symlinks: [],
+          scripts: ingredient.scripts,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        await runLifecycle(lifecycleEntry, "install", options2.ignoreScripts, options2.diagnostics, options2.progress, options2.signal);
+        options2.signal?.throwIfAborted();
+        options2.progress?.({
+          type: "phase",
+          slug: options2.slug,
+          phase: "finalizing",
+          message: "Linking and finalizing installation"
+        });
         entry = await (0, tela_local_config_1.updateInstalledSkill)(options2.slug, async (registered) => {
-          if (options2.expectedCurrent && (registered === null || !isSameInstall(registered, options2.expectedCurrent))) {
+          if (!isSameRegistration(registered, before)) {
             concurrentChange = true;
-            options2.diagnostics({
-              type: "concurrent-change",
-              slug: options2.slug,
-              operation: options2.operation ?? "install",
-              message: `Skipped ${options2.slug}: it was changed while this upgrade ran`
-            });
             return registered;
           }
-          if ((0, skill_filesystem_1.isUnownedInstallDir)(target, registered?.dir ?? null) && !options2.force) {
-            throw new SkillInstallDirectoryConflictError(options2.slug, target);
-          }
-          const staged = await (0, skill_filesystem_1.stageSkillFiles)(target, files);
-          stagedInstalls.push(staged);
           const desiredLinkPaths = new Set(options2.targets.map((linkTarget) => node_path_1.default.join(linkTarget.root, options2.slug)));
           for (const linkPath of registered?.symlinks ?? []) {
             if (desiredLinkPaths.has(linkPath))
@@ -77538,25 +77913,27 @@ Run \`tela skills install ${slug} --force\` to replace it, or remove it by hand.
             }
           }
           return {
-            slug: options2.slug,
-            dir: target,
-            sha: snapshot.sha,
-            bundle: ingredient.bundle,
-            symlinks,
-            scripts: ingredient.scripts,
-            installedAt: (/* @__PURE__ */ new Date()).toISOString()
+            ...lifecycleEntry,
+            symlinks
           };
         }, options2.inventoryFile);
       } catch (error48) {
-        await rollbackStagedInstall(stagedInstalls.at(-1) ?? null, error48);
+        options2.progress?.({
+          type: "phase",
+          slug: options2.slug,
+          phase: "rolling-back",
+          message: "Rolling back failed installation"
+        });
+        await rollbackStagedInstall(staged, error48);
       }
-      if (concurrentChange)
+      if (concurrentChange) {
+        await staged.rollback();
+        reportConcurrentChange();
         return null;
-      for (const staged of stagedInstalls)
-        await staged.commit();
+      }
+      await staged.commit();
       if (!entry)
         throw new Error(`Skill install for ${options2.slug} did not produce an inventory entry.`);
-      await runLifecycle(entry, "install", options2.ignoreScripts, options2.diagnostics);
       return entry;
     }
     function selectUpgradeTargets(installed, slugs) {
@@ -77575,6 +77952,11 @@ Run \`tela skills install ${slug} --force\` to replace it, or remove it by hand.
         throw new Error(`${missing.join(", ")} not installed by tela. Nothing to remove.`);
       return slugs.map((slug) => bySlug.get(slug));
     }
+    function isSameRegistration(left, right) {
+      if (left === null || right === null)
+        return left === right;
+      return isSameInstall(left, right);
+    }
     function isSameInstall(left, right) {
       return left.installedAt === right.installedAt && left.sha === right.sha && left.dir === right.dir;
     }
@@ -77595,7 +77977,7 @@ Cleanup failed: ${describeError(cleanupError)}`);
       }
       throw error48;
     }
-    async function runLifecycle(entry, phase, ignoreScripts, emit) {
+    async function runLifecycle(entry, phase, ignoreScripts, emit, progress2, signal) {
       const script = entry.scripts?.[phase];
       if (!script)
         return;
@@ -77616,7 +77998,17 @@ Cleanup failed: ${describeError(cleanupError)}`);
         script,
         message: `Running ${phase} script for ${entry.slug}: ${script}`
       });
-      const outcome = await (0, skill_filesystem_1.runSkillScript)(script, entry.dir);
+      if (phase === "install") {
+        progress2?.({
+          type: "phase",
+          slug: entry.slug,
+          phase: "running-install-script",
+          message: "Running install script"
+        });
+      }
+      const outcome = await (0, skill_filesystem_1.runSkillScript)(script, entry.dir, phase === "install" ? (output) => progress2?.({ type: "script-output", slug: entry.slug, output }) : void 0, signal);
+      if (outcome.cancelled)
+        signal?.throwIfAborted();
       if (outcome.output) {
         emit({
           type: "lifecycle-output",
@@ -77627,7 +78019,14 @@ Cleanup failed: ${describeError(cleanupError)}`);
         });
       }
       if (!outcome.ok) {
-        throw new SkillLifecycleError(entry, phase);
+        const error48 = new SkillLifecycleError(entry, phase);
+        emit({
+          type: "lifecycle-failed",
+          slug: entry.slug,
+          phase,
+          message: error48.message
+        });
+        throw error48;
       }
     }
     function lifecycleFailureMessage(entry, phase) {
@@ -77636,8 +78035,8 @@ Cleanup failed: ${describeError(cleanupError)}`);
         return `${opener}
 ${entry.slug} was left in place. Re-run with --ignore-scripts to remove it anyway.`;
       return `${opener}
-${entry.slug} was installed to ${entry.dir} and recorded, but its install script did not finish, so the skill may not work.
-Remove it with \`tela skills uninstall ${entry.slug}\`, or reinstall without the script: \`tela skills install ${entry.slug} --ignore-scripts\`.`;
+${entry.slug} was not installed because its files and inventory entry were rolled back.
+Retry without the script with \`tela skills install ${entry.slug} --ignore-scripts\`.`;
     }
     function normalizePaths(paths) {
       const installRoot = normalizeAbsolutePath(paths.installRoot, "installRoot");
@@ -387685,10 +388084,9 @@ async function authLogin(args, options2, io) {
     if (!environment)
       throw new Error(`Unknown Tela environment: ${environmentId}`);
     const requesterApplicationId = environment.authApplication?.requesterApplicationId;
-    const targetApplicationId = environment.authApplication?.targetApplicationId;
-    if (!requesterApplicationId || !targetApplicationId) {
+    if (!requesterApplicationId) {
       throw new Error(
-        `Environment '${environmentId}' does not define auth application IDs. Configure them before logging in.`
+        `Environment '${environmentId}' does not define an auth application ID. Configure it before logging in.`
       );
     }
     const { DeviceFlow: DeviceFlow2 } = await Promise.resolve().then(() => (init_dist3(), dist_exports));
@@ -387696,7 +388094,6 @@ async function authLogin(args, options2, io) {
     const flowOptions = {
       apiUrl: parsed.authUrl ?? environment.authApiUrl,
       requesterApplicationId,
-      targetApplicationId,
       storage
     };
     const loginContext = {
@@ -389081,15 +389478,19 @@ async function installSkills(args, options2, io) {
     ignoreScripts: flags.ignoreScripts,
     ...flags.symlink ? {} : { targets: [] }
   });
+  const installedSlugs = new Set(installed.map((entry) => entry.slug));
+  const failed = flags.rest.filter((slug) => !installedSlugs.has(slug));
   if (options2.json) {
-    writeJson(io, { installed });
-    return 0;
+    writeJson(io, failed.length > 0 ? { installed, failed } : { installed });
+    return failed.length > 0 ? 1 : 0;
   }
   for (const entry of installed)
     writeLine(io, `Installed ${entry.slug}@${entry.sha.slice(0, 7)} to ${entry.dir}`);
-  return 0;
+  return failed.length > 0 ? 1 : 0;
 }
 function writeSkillManagerDiagnostic(io, diagnostic) {
+  if (diagnostic.type === "lifecycle-failed" && diagnostic.phase === "uninstall")
+    return;
   writeError(io, diagnostic.message);
 }
 async function upgradeSkills(args, options2, io) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/tela-cli",
-  "version": "1.10.1",
+  "version": "1.12.0",
   "description": "Tela command line tools for local state and agent workflows.",
   "engines": {
     "node": ">=22"

package/skills/tela-cli/SKILL.md

@@ -1,17 +1,18 @@
 ---
 name: tela-cli
-description: Use when a coding agent needs to operate Tela Agent repositories or Tela Pantry/service ingredients through the local `tela` CLI with non-interactive, flag-driven commands and JSON output.
+description: Use when a coding agent needs to operate Tela Agent repositories, Tela Pantry/service ingredients, managed Pantry skills, or Workflow Code projects through the local `tela` CLI with non-interactive, flag-driven commands and JSON output.
 ---
 
 # Tela CLI
 
-Use the local `tela` binary for Tela Agent repository workflows and Pantry-backed
-service/library discovery. Prefer explicit flags and `--json` so commands are
+Use the local `tela` binary for Tela Agent repository workflows, Pantry-backed
+service/library discovery, managed skills, and Workflow Code projects. Prefer explicit flags and `--json` so commands are
 safe in non-interactive agent sessions.
 
 ## Subpaths
 
 - Agent workflows: read `references/agent.md` before running `tela agent ...`.
+- Workflow Code: read `tela workflow docs` before authoring or changing workflows.
 
 ## Core Rules
 
@@ -21,6 +22,7 @@ safe in non-interactive agent sessions.
 - Read endpoint or library docs before calling a service: `tela service docs endpoints <slug>` then `tela service docs reference <slug> <METHOD> <PATH>`.
 - Prefer `--json` for machine-readable output and errors.
 - Do not rely on prompts in coding-agent sessions; pass every required value by flag.
+- Pass `--yes` to `tela workflow init`, `sync`, and `publish` in agent sessions; without it they prompt in a terminal or stop with a diagnostic when confirmation is needed.
 - Do not print token material. Use `tela auth token --json` for metadata and `--raw` only when a shell command explicitly needs the token.
 
 ## Pantry and Service Commands
@@ -44,6 +46,43 @@ HTTPie-style args for `tela service api`:
 - `name==value` sends a query parameter.
 - `Header:value` sends a request header.
 
+## Managed Skills
+
+```bash
+tela skills list --json
+tela skills search <query> --json
+tela skills files <slug> --json
+tela skills cat <slug> [path]
+tela skills install <slug...> --json
+tela skills upgrade [slug...] --json
+tela skills uninstall <slug...> --json
+```
+
+Use `search`, `files`, and `cat` to inspect a skill before installing it.
+`install` places the skill under `~/.agents/skills` and links it into the
+configured provider directories; `--no-symlink` skips the links. `--force`
+replaces a directory Tela did not install, so only use it when the error asks
+for it. `--ignore-scripts` skips a skill's install/uninstall scripts; use it
+only when a script failed and the error suggests it. `upgrade` without slugs
+upgrades every installed skill.
+
+## Workflow Code
+
+```bash
+tela workflow docs --json
+tela workflow docs <page>
+tela workflow init --directory <path> --workflow <key> --yes --json
+tela workflow create <target> --project <project-id> --json
+tela workflow compile [target] --json
+tela workflow sync [target] --yes --json
+tela workflow publish [target] --environment <name> --yes --json
+```
+
+`tela workflow docs` lists the bundled documentation pages; read the relevant
+page (for example `api-reference` or `cli`) before writing workflow code.
+Compile locally before `sync`, and `sync` before `publish`. Run
+`tela workflow --help` for every flag.
+
 ## Authentication
 
 Use `tela auth login --no-interactive` in an agent session. Open the URL it

package/skills/tela-cli/references/agent.md

@@ -81,6 +81,46 @@ tela agent push --message "feat: update agent behavior" --json
 Use `--message` for agent sessions. `--claude` asks the local Claude CLI to
 write a message, and `--manual` relies on fallback behavior.
 
+## Merge
+
+Preview merging an agent branch into the repository's default branch:
+
+```bash
+tela agent merge --dry-run --json
+tela agent merge feature/my-branch --dry-run --json
+```
+
+Merge after checking the dry run. JSON or non-interactive sessions must pass
+`--yes`:
+
+```bash
+tela agent merge feature/my-branch --yes --json
+```
+
+The branch defaults to the current checkout's branch, and the base defaults to
+the repository's default branch; override it with `--base <branch>`. Passing a
+different branch checks it out, even with `--dry-run`. `--strategy squash`
+(default) or `--strategy merge` selects how the Agent API merges, and the
+remote branch is deleted unless `--keep-branch` is passed.
+
+Merge stops before any remote merge call when the worktree is dirty
+(`merge_dirty_worktree`), a merge is already in progress (`merge_in_progress`),
+the branch is not on origin (`merge_branch_not_pushed`), or it has unpushed
+commits (`merge_unpushed_commits`). Follow the error's `fixes`; most of these
+are cleared by `tela agent push`.
+
+When the Agent API reports conflicts, the command merges `origin/<base>` into
+the branch locally and returns `status: "conflicts"`. Read `localMergeClean`:
+
+- `true`: the local merge applied cleanly. Run `tela agent push`, then rerun
+  `tela agent merge <branch>`.
+- `false`: conflict markers are left in the checkout. Resolve them, run
+  `tela agent push` to commit and upload the resolution, then rerun
+  `tela agent merge <branch>`.
+
+Use `tela agent push` rather than raw git to commit the resolution, so the
+branch is uploaded in the same step.
+
 ## Feedback
 
 List feedback for the current commit: