@myna-sh/cli 0.2.0 → 0.4.0

package/dist/main.js

@@ -1,7 +1,7 @@
 // src/main.ts
 import { Command, CommanderError } from "commander";
 
-// ../sdk/dist/chunk-VAS24QPJ.js
+// ../sdk/dist/chunk-5WMWKWGV.js
 var MynaApiError = class _MynaApiError extends Error {
   /** HTTP status code. */
   status;
@@ -52,6 +52,15 @@ function problemFromResponse(status, body, fallbackTitle) {
     detail
   });
 }
+function inBrowser() {
+  return typeof globalThis === "object" && "document" in globalThis;
+}
+function defaultMaxRetries() {
+  return inBrowser() ? 1 : 3;
+}
+function defaultMaxNetworkRetries() {
+  return inBrowser() ? 0 : 1;
+}
 var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
 var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 function resolveFetch(custom) {
@@ -59,8 +68,8 @@ function resolveFetch(custom) {
   if (typeof globalThis.fetch === "function") return globalThis.fetch.bind(globalThis);
   throw new Error("No fetch implementation available. Pass `fetch` to the Myna client.");
 }
-function buildQuery(query2) {
-  if (!query2) return "";
+function buildQuery(query) {
+  if (!query) return "";
   const params = new URLSearchParams();
   const append = (key, value) => {
     if (value === void 0 || value === null) return;
@@ -76,7 +85,7 @@ function buildQuery(query2) {
     }
     params.set(key, String(value));
   };
-  for (const [key, value] of Object.entries(query2)) append(key, value);
+  for (const [key, value] of Object.entries(query)) append(key, value);
   const qs = params.toString();
   return qs ? `?${qs}` : "";
 }
@@ -106,10 +115,31 @@ var HttpClient = class {
     this.fetchImpl = resolveFetch(options.fetch);
     this.defaultHeaders = options.headers ?? {};
     this.retry = {
-      maxRetries: options.retry?.maxRetries ?? 3,
+      maxRetries: options.retry?.maxRetries ?? defaultMaxRetries(),
       baseDelayMs: options.retry?.baseDelayMs ?? 200,
-      maxDelayMs: options.retry?.maxDelayMs ?? 5e3
+      maxDelayMs: options.retry?.maxDelayMs ?? 5e3,
+      maxNetworkRetries: options.retry?.maxNetworkRetries ?? defaultMaxNetworkRetries()
+    };
+  }
+  /**
+   * Share one in-flight request between identical concurrent safe reads.
+   *
+   * Several components asking for the same collection on first paint is the
+   * normal shape of a page, not a mistake, and issuing N identical requests
+   * multiplies both latency and any failure. Only GET/HEAD are pooled, and only
+   * while in flight — this is request coalescing, not a cache.
+   */
+  inFlight = /* @__PURE__ */ new Map();
+  dedupe(key, run) {
+    const existing = this.inFlight.get(key);
+    if (existing) return existing.then((response) => response.clone());
+    const started = run();
+    this.inFlight.set(key, started);
+    const cleanup = () => {
+      if (this.inFlight.get(key) === started) this.inFlight.delete(key);
     };
+    started.then(cleanup, cleanup);
+    return started.then((response) => response.clone());
   }
   /** Perform a request and unwrap the `{ data }` envelope. */
   async request(method, path, options = {}) {
@@ -143,19 +173,30 @@ var HttpClient = class {
       }
     }
     if (options.idempotencyKey) headers["idempotency-key"] = options.idempotencyKey;
-    const idempotent = SAFE_METHODS.has(method.toUpperCase()) || Boolean(options.idempotencyKey);
+    const upper = method.toUpperCase();
+    const safe = SAFE_METHODS.has(upper);
+    const idempotent = safe || Boolean(options.idempotencyKey);
     const init = { method, headers };
     if (payload !== void 0) init.body = payload;
     if (options.signal) init.signal = options.signal;
+    if (safe && !options.signal && (upper === "GET" || upper === "HEAD")) {
+      const key = `${upper} ${url} ${token ?? ""}`;
+      return this.dedupe(key, () => this.attempt(url, init, idempotent, options));
+    }
+    return this.attempt(url, init, idempotent, options);
+  }
+  async attempt(url, init, idempotent, options) {
     let attempt = 0;
+    let networkAttempt = 0;
     for (; ; ) {
       let response;
       try {
         response = await this.fetchImpl(url, init);
       } catch (error) {
-        if (idempotent && attempt < this.retry.maxRetries && !isAbort(error)) {
+        if (idempotent && networkAttempt < this.retry.maxNetworkRetries && attempt < this.retry.maxRetries && !isAbort(error)) {
           await sleep(this.backoff(attempt), options.signal);
           attempt++;
+          networkAttempt++;
           continue;
         }
         throw error;
@@ -196,7 +237,7 @@ function generateTypes(collections) {
   for (const collection of sorted) {
     blocks.push(renderInterface(collection));
   }
-  const registry = sorted.map((c) => `  ${JSON.stringify(c.name)}: ${pascal(c.name)};`).join("\n");
+  const registry = sorted.map((c) => registryEntry(c)).join("\n");
   const header = [
     "// Generated by `myna types generate`. Do not edit by hand.",
     "// This file is safe to commit and regenerate.",
@@ -204,11 +245,33 @@ function generateTypes(collections) {
   ].join("\n");
   return `${header}${blocks.join("\n\n")}
 
+${REGISTRY_DOC}
 export interface MynaCollections {
 ${registry}
 }
 `;
 }
+var REGISTRY_DOC = [
+  "/**",
+  " * Collection registry consumed by `createMyna<MynaCollections>()`.",
+  " *",
+  " * `fields` types the entry payload; `sortable` and `reference` carry the",
+  " * distinctions the field types alone cannot express \u2014 a markdown body and a",
+  " * text title are both `string`, but only one of them can be ordered on.",
+  " */"
+].join("\n");
+var SORTABLE_TYPES = /* @__PURE__ */ new Set(["text", "number", "boolean", "date", "datetime", "slug"]);
+function registryEntry(collection) {
+  const sortable = collection.fields.filter((f) => SORTABLE_TYPES.has(f.type) && !f.localized).map((f) => JSON.stringify(f.key));
+  const references = collection.fields.filter((f) => f.type === "reference").map((f) => JSON.stringify(f.key));
+  return [
+    `  ${JSON.stringify(collection.name)}: {`,
+    `    fields: ${pascal(collection.name)};`,
+    `    sortable: ${sortable.length > 0 ? sortable.join(" | ") : "never"};`,
+    `    reference: ${references.length > 0 ? references.join(" | ") : "never"};`,
+    `  };`
+  ].join("\n");
+}
 function renderInterface(collection) {
   const name = pascal(collection.name);
   const lines = collection.fields.map((f) => renderField(f, 1));
@@ -348,19 +411,25 @@ var ManagementClient = class {
   idem() {
     return this.newIdempotencyKey();
   }
-  get(path, query2, signal) {
-    return this.http.request("GET", path, { query: query2, signal });
+  get(path, query, signal) {
+    return this.http.request("GET", path, { query, signal });
   }
-  async page(path, opts = {}) {
+  /**
+   * Paged GET. Extra filters are merged into the query rather than appended to
+   * the path: the client builds its own query string from `options.query`, so a
+   * path that already carries one produces `?a=1?limit=25` — a second `?` that
+   * silently becomes part of the previous value.
+   */
+  async page(path, opts = {}, filters = {}) {
     const body = await this.http.requestEnvelope(
       "GET",
       path,
-      { query: { limit: opts.limit, cursor: opts.cursor }, signal: opts.signal }
+      { query: { ...filters, limit: opts.limit, cursor: opts.cursor }, signal: opts.signal }
     );
     return { data: body.data, nextCursor: body.pagination?.nextCursor ?? null };
   }
-  mutate(method, path, body, query2) {
-    return this.http.request(method, path, { body, query: query2, idempotencyKey: this.idem() });
+  mutate(method, path, body, query) {
+    return this.http.request(method, path, { body, query, idempotencyKey: this.idem() });
   }
   // --- Organizations --------------------------------------------------------
   organizations = {
@@ -393,6 +462,12 @@ var ManagementClient = class {
     archive: (project) => this.mutate("POST", `/projects/${enc(project)}/archive`),
     /** Full project export: schemas, entries (draft + published), asset metadata. */
     export: (project, signal) => this.get(`/projects/${enc(project)}/export`, void 0, signal),
+    /** Why a browser at `origin` can or cannot read this project's content. */
+    corsCheck: (project, origin, collection, signal) => this.get(
+      `/projects/${enc(project)}/cors-check`,
+      collection ? { origin, collection } : { origin },
+      signal
+    ),
     views: (project, signal) => this.get(`/projects/${enc(project)}/views`, void 0, signal),
     createView: (project, body) => this.mutate("POST", `/projects/${enc(project)}/views`, body),
     deleteView: (project, view) => this.mutate("DELETE", `/projects/${enc(project)}/views/${enc(view)}`)
@@ -418,10 +493,10 @@ var ManagementClient = class {
   };
   // --- Entries & revisions --------------------------------------------------
   entries = {
-    list: (project, opts = {}) => this.page(
-      `/projects/${enc(project)}/entries` + query({ collection: opts.collection, status: opts.status }),
-      opts
-    ),
+    list: (project, opts = {}) => this.page(`/projects/${enc(project)}/entries`, opts, {
+      collection: opts.collection,
+      status: opts.status
+    }),
     create: (project, body) => this.mutate("POST", `/projects/${enc(project)}/entries`, body),
     get: (project, entry, signal) => this.get(`/projects/${enc(project)}/entries/${enc(entry)}`, void 0, signal),
     update: (project, entry, body) => this.mutate("PATCH", `/projects/${enc(project)}/entries/${enc(entry)}`, body),
@@ -432,6 +507,16 @@ var ManagementClient = class {
       changeSetId
     }),
     bulk: (project, body) => this.mutate("POST", `/projects/${enc(project)}/entries/bulk`, body),
+    /**
+     * Set a collection's editorial order. Not staged on a change set — ranks
+     * are arrangement rather than content and take effect immediately, which
+     * is why `confirm` is required.
+     */
+    reorder: (project, collection, body) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/collections/${enc(collection)}/reorder`,
+      { ...body, confirm: true }
+    ),
     import: (project, body) => this.mutate("POST", `/projects/${enc(project)}/entries/import`, body),
     references: (project, entry, signal) => this.get(`/projects/${enc(project)}/entries/${enc(entry)}/references`, void 0, signal),
     revisions: (project, entry, signal) => this.get(`/projects/${enc(project)}/entries/${enc(entry)}/revisions`, void 0, signal),
@@ -443,7 +528,7 @@ var ManagementClient = class {
   };
   // --- Change sets ----------------------------------------------------------
   changeSets = {
-    list: (project, opts = {}) => this.page(`/projects/${enc(project)}/change-sets` + query({ status: opts.status }), opts),
+    list: (project, opts = {}) => this.page(`/projects/${enc(project)}/change-sets`, opts, { status: opts.status }),
     create: (project, body) => this.mutate("POST", `/projects/${enc(project)}/change-sets`, body),
     get: (project, changeSet, signal) => this.get(`/projects/${enc(project)}/change-sets/${enc(changeSet)}`, void 0, signal),
     update: (project, changeSet, body) => this.mutate("PATCH", `/projects/${enc(project)}/change-sets/${enc(changeSet)}`, body),
@@ -533,16 +618,13 @@ var ManagementClient = class {
   };
   // --- Activity -------------------------------------------------------------
   activity(project, opts = {}) {
-    return this.page(
-      `/projects/${enc(project)}/activity` + query({
-        actorType: opts.actorType,
-        action: opts.action,
-        targetType: opts.targetType,
-        from: opts.from,
-        to: opts.to
-      }),
-      opts
-    );
+    return this.page(`/projects/${enc(project)}/activity`, opts, {
+      actorType: opts.actorType,
+      action: opts.action,
+      targetType: opts.targetType,
+      from: opts.from,
+      to: opts.to
+    });
   }
   // --- Billing --------------------------------------------------------------
   billing = {
@@ -604,15 +686,80 @@ function guessContentType(filename) {
 function enc(segment) {
   return encodeURIComponent(segment);
 }
-function query(params) {
-  const entries = Object.entries(params).filter(([, v]) => v !== void 0 && v !== "");
-  if (entries.length === 0) return "";
-  return "?" + entries.map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join("&");
-}
 function createManagementClient(options) {
   return new ManagementClient(options);
 }
 
+// src/auth-check.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+function timeoutSignal(ms) {
+  return AbortSignal.timeout(ms);
+}
+async function fetchMeta(apiUrl, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  try {
+    const res = await fetch(`${apiUrl}/v1/meta`, {
+      headers: { accept: "application/json" },
+      signal: timeoutSignal(timeoutMs)
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.data;
+  } catch {
+    return void 0;
+  }
+}
+async function checkCredential(apiUrl, token, source, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const base = {
+    apiUrl,
+    credentialPresent: Boolean(token),
+    credentialValid: false,
+    source,
+    identity: null,
+    error: null
+  };
+  if (!token) {
+    return { ...base, error: { code: "NO_CREDENTIAL", detail: "No credential found." } };
+  }
+  try {
+    const res = await fetch(`${apiUrl}/v1/auth/whoami`, {
+      headers: { authorization: `Bearer ${token}`, accept: "application/json" },
+      signal: timeoutSignal(timeoutMs)
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok || !body.data) {
+      return {
+        ...base,
+        error: {
+          code: body.code ?? `HTTP_${res.status}`,
+          detail: body.detail ?? body.title ?? `The API rejected the credential (${res.status}).`
+        }
+      };
+    }
+    return { ...base, credentialValid: true, identity: body.data };
+  } catch (error) {
+    return {
+      ...base,
+      error: {
+        code: "UNREACHABLE",
+        detail: `Could not reach ${apiUrl}: ${error instanceof Error ? error.message : String(error)}`
+      }
+    };
+  }
+}
+function describeIdentity(identity) {
+  switch (identity.credential) {
+    case "user":
+      return `user ${identity.user.username ?? identity.user.email}`;
+    case "api_key":
+      return `API key${identity.label ? ` "${identity.label}"` : ""} (${identity.scopes.length} scope(s))`;
+    case "preview":
+      return "preview token";
+  }
+}
+function scopesOf(identity) {
+  return identity?.credential === "api_key" ? identity.scopes : void 0;
+}
+
 // src/config.ts
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, rmSync } from "fs";
@@ -748,12 +895,15 @@ function resolveContext(flags) {
   const link = findLinkedProject();
   const user = readUserConfig();
   const apiUrl = flags.apiUrl ?? process.env.MYNA_API_URL ?? link?.linked.apiUrl ?? user.apiUrl ?? DEFAULT_API_URL2;
-  const token = flags.token ?? process.env.MYNA_TOKEN ?? loadToken(apiUrl);
+  const stored = loadToken(apiUrl);
+  const token = flags.token ?? process.env.MYNA_TOKEN ?? stored;
+  const tokenSource = flags.token ? "flag" : process.env.MYNA_TOKEN ? "environment" : stored ? "stored" : "none";
   const project = flags.project ?? process.env.MYNA_PROJECT ?? link?.linked.project ?? user.defaultProject;
   const organization = flags.organization ?? process.env.MYNA_ORGANIZATION ?? link?.linked.organization ?? user.defaultOrganization;
   return {
     apiUrl: apiUrl.replace(/\/+$/, ""),
     token,
+    tokenSource,
     project,
     organization,
     json: Boolean(flags.json),
@@ -981,10 +1131,16 @@ async function apiPost(apiUrl, path, body) {
   return json.data;
 }
 var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+function startDevice(apiUrl) {
+  return apiPost(apiUrl, "/auth/device", {});
+}
+function pollDevice(apiUrl, deviceCode) {
+  return apiPost(apiUrl, `/auth/device/${deviceCode}/token`, { deviceCode });
+}
 function registerAuth(program) {
-  program.command("login").description("Authenticate via the browser device-authorization flow").action(
+  const login = program.command("login").description("Authenticate via the browser device-authorization flow").action(
     handle(async (ctx) => {
-      const start = await apiPost(ctx.apiUrl, "/auth/device", {});
+      const start = await startDevice(ctx.apiUrl);
       diag(`
   To authenticate, open:
     ${start.verificationUri}
@@ -995,9 +1151,7 @@ function registerAuth(program) {
       let token;
       while (Date.now() < deadline) {
         await sleep2(Math.max(1, start.interval) * 1e3);
-        const poll = await apiPost(ctx.apiUrl, `/auth/device/${start.deviceCode}/token`, {
-          deviceCode: start.deviceCode
-        });
+        const poll = await pollDevice(ctx.apiUrl, start.deviceCode);
         if (poll.status === "approved" && poll.token) {
           token = poll.token;
           break;
@@ -1016,6 +1170,72 @@ function registerAuth(program) {
       );
     })
   );
+  login.command("start").description("Begin device authorization and print the code without waiting").action(
+    handle(async (ctx) => {
+      const start = await startDevice(ctx.apiUrl);
+      emit(
+        {
+          deviceCode: start.deviceCode,
+          userCode: start.userCode,
+          verificationUri: start.verificationUri,
+          expiresIn: start.expiresIn,
+          interval: start.interval,
+          apiUrl: ctx.apiUrl
+        },
+        () => {
+          process.stdout.write(`${start.verificationUri}
+`);
+          diag(`  Enter the code: ${start.userCode}`);
+          diag(`  Then run: myna login poll ${start.deviceCode}`);
+        }
+      );
+    })
+  );
+  login.command("poll").description("Check a pending device authorization once, or wait for it").argument("<device-code>", "device code from `myna login start`").option("--wait", "keep polling until approved, denied, or expired", false).option("--interval <seconds>", "seconds between attempts when waiting", "2").option("--timeout <seconds>", "give up after this long when waiting", "300").action(
+    handle(async (ctx, args, opts) => {
+      const deviceCode = args[0];
+      const wait = Boolean(opts.wait);
+      const interval = Math.max(1, Number(opts.interval)) * 1e3;
+      const deadline = Date.now() + Math.max(1, Number(opts.timeout)) * 1e3;
+      for (; ; ) {
+        const poll = await pollDevice(ctx.apiUrl, deviceCode);
+        if (poll.status === "approved" && poll.token) {
+          const location = storeToken(ctx.apiUrl, poll.token);
+          emit(
+            { status: "approved", stored: true, storage: location, apiUrl: ctx.apiUrl },
+            () => process.stdout.write(`Logged in to ${ctx.apiUrl} (stored in ${location})
+`)
+          );
+          return;
+        }
+        if (poll.status === "denied" || poll.status === "expired") {
+          emit(
+            { status: poll.status, stored: false, apiUrl: ctx.apiUrl },
+            () => process.stderr.write(`Authorization ${poll.status}.
+`)
+          );
+          process.exitCode = 1;
+          return;
+        }
+        if (!wait) {
+          emit(
+            { status: "pending", stored: false, apiUrl: ctx.apiUrl },
+            () => process.stdout.write("pending\n")
+          );
+          return;
+        }
+        if (Date.now() + interval > deadline) {
+          emit(
+            { status: "timeout", stored: false, apiUrl: ctx.apiUrl },
+            () => process.stderr.write("Timed out waiting for approval.\n")
+          );
+          process.exitCode = 1;
+          return;
+        }
+        await sleep2(interval);
+      }
+    })
+  );
   program.command("logout").description("Remove the stored credential for the current API URL").action(
     handle(async (ctx) => {
       clearToken(ctx.apiUrl);
@@ -1023,35 +1243,53 @@ function registerAuth(program) {
 `));
     })
   );
-  program.command("whoami").description("Show the authenticated identity").action(
+  const auth = program.command("auth").description("Inspect and verify credentials");
+  auth.command("verify").description("Check whether the current credential actually works").action(
     handle(async (ctx) => {
-      const token = ctx.token ?? loadToken(ctx.apiUrl);
-      if (!token) throw new CliError("Not authenticated. Run `myna login`.");
-      const identityResponse = await fetch(`${ctx.apiUrl}/v1/auth/whoami`, {
-        headers: { authorization: `Bearer ${token}`, accept: "application/json" }
+      const status = await checkCredential(ctx.apiUrl, ctx.token, ctx.tokenSource);
+      emit(status, () => {
+        keyValues([
+          ["API", status.apiUrl],
+          ["Credential present", status.credentialPresent ? "yes" : "no"],
+          ["Credential valid", status.credentialValid ? "yes" : "no"],
+          ["Source", status.source],
+          ["Identity", status.identity ? describeIdentity(status.identity) : "\u2014"]
+        ]);
+        if (status.error) process.stderr.write(`
+${status.error.code}: ${status.error.detail}
+`);
       });
-      const identityBody = await identityResponse.json().catch(() => ({}));
-      if (!identityResponse.ok || !identityBody.data) {
-        throw new CliError(identityBody.detail ?? "Stored credential is invalid. Run `myna login` again.");
-      }
-      const identity = identityBody.data;
+    })
+  );
+  program.command("whoami").description("Show the authenticated identity, validating it against the API").action(
+    handle(async (ctx) => {
+      const status = await checkCredential(ctx.apiUrl, ctx.token ?? loadToken(ctx.apiUrl), ctx.tokenSource);
       let organization;
-      if (ctx.organization) {
+      if (status.credentialValid && ctx.organization) {
         organization = await ctx.management().organizations.get(ctx.organization).then((o) => ({ name: o.name, role: o.role, slug: o.slug })).catch((e) => {
           if (isMynaApiError(e)) return void 0;
           throw e;
         });
       }
-      emit({ apiUrl: ctx.apiUrl, authenticated: true, identity, organization: organization ?? null }, () => {
-        const pairs = [["API", ctx.apiUrl], ["Authenticated", "yes"]];
-        if (identity.credential === "user") {
-          pairs.push(["User", identity.user?.username ?? "(unknown)"]);
-        } else {
-          pairs.push(["Credential", identity.credential === "api_key" ? "API key" : "Preview token"]);
-        }
+      emit({ ...status, organization: organization ?? null }, () => {
+        const pairs = [
+          ["API", status.apiUrl],
+          ["Credential present", status.credentialPresent ? "yes" : "no"],
+          ["Credential valid", status.credentialValid ? "yes" : "no"]
+        ];
+        if (status.identity) pairs.push(["Identity", describeIdentity(status.identity)]);
         if (organization) pairs.push(["Organization", `${organization.name} (${organization.role})`]);
         keyValues(pairs);
+        if (status.error) {
+          process.stderr.write(`
+${status.error.detail}
+`);
+          if (status.error.code !== "UNREACHABLE") {
+            process.stderr.write("Run `myna login` to authenticate again.\n");
+          }
+        }
       });
+      if (!status.credentialValid) process.exitCode = 1;
     })
   );
 }
@@ -1152,22 +1390,26 @@ function registerWorkspace(program) {
   );
   program.command("status").description("Show the resolved configuration and project link").action(
     handle(async (ctx) => {
-      const hasToken = Boolean(ctx.token ?? loadToken(ctx.apiUrl));
+      const credentialPresent = Boolean(ctx.token ?? loadToken(ctx.apiUrl));
       emit(
         {
           apiUrl: ctx.apiUrl,
-          authenticated: hasToken,
+          credentialPresent,
+          credentialSource: ctx.tokenSource,
           project: ctx.project ?? null,
           organization: ctx.organization ?? null,
           linkedRoot: ctx.linkedRoot ?? null
         },
-        () => keyValues([
-          ["API URL", ctx.apiUrl],
-          ["Authenticated", hasToken ? "yes" : "no"],
-          ["Project", ctx.project ?? "(none)"],
-          ["Organization", ctx.organization ?? "(none)"],
-          ["Linked at", ctx.linkedRoot ?? "(none)"]
-        ])
+        () => {
+          keyValues([
+            ["API URL", ctx.apiUrl],
+            ["Credential present", credentialPresent ? `yes (${ctx.tokenSource})` : "no"],
+            ["Project", ctx.project ?? "(none)"],
+            ["Organization", ctx.organization ?? "(none)"],
+            ["Linked at", ctx.linkedRoot ?? "(none)"]
+          ]);
+          if (credentialPresent) diag("\nNot verified against the API. Run `myna auth verify`.");
+        }
       );
     })
   );
@@ -1590,8 +1832,114 @@ function renderDiff(diff) {
   }
 }
 
+// src/content-files.ts
+import { readFile as readFile2, readdir, stat } from "fs/promises";
+import { basename as basename2, extname, join as join5 } from "path";
+async function detectFormat(path) {
+  const info = await stat(path).catch(() => void 0);
+  if (!info) throw new UsageError(`No such file or directory: ${path}`);
+  if (info.isDirectory()) return "markdown";
+  return extname(path).toLowerCase() === ".json" ? "json" : "markdown";
+}
+function parseFrontmatter(raw, source) {
+  if (!raw.startsWith("---")) return { meta: {}, body: raw };
+  const end = raw.indexOf("\n---", 3);
+  if (end === -1) throw new UsageError(`${source}: unterminated frontmatter block.`);
+  const block = raw.slice(raw.indexOf("\n") + 1, end);
+  const body = raw.slice(raw.indexOf("\n", end + 1) + 1);
+  const meta = {};
+  for (const [lineNumber, line] of block.split("\n").entries()) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const separator = line.indexOf(":");
+    if (separator === -1) {
+      throw new UsageError(`${source}:${lineNumber + 2}: expected "key: value" in frontmatter.`);
+    }
+    const key = line.slice(0, separator).trim();
+    meta[key] = parseScalar(line.slice(separator + 1).trim());
+  }
+  return { meta, body };
+}
+function parseScalar(value) {
+  if (value === "" || value === "null" || value === "~") return null;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (value.startsWith("[") && value.endsWith("]")) {
+    const inner = value.slice(1, -1).trim();
+    return inner === "" ? [] : inner.split(",").map((item) => parseScalar(item.trim()));
+  }
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  if (/^-?\d+(\.\d+)?$/.test(value)) return Number(value);
+  return value;
+}
+async function readJsonRows(file) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile2(file, "utf8"));
+  } catch (error) {
+    throw new UsageError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const toRow = (value, index) => {
+    if (typeof value !== "object" || value === null) {
+      throw new UsageError(`${file}: entry ${index} is not an object.`);
+    }
+    const record = value;
+    if (record.data && typeof record.data === "object") {
+      return {
+        slug: typeof record.slug === "string" ? record.slug : void 0,
+        data: record.data,
+        source: `${file}#${index}`
+      };
+    }
+    return {
+      slug: typeof record.slug === "string" ? record.slug : void 0,
+      data: record,
+      source: `${file}#${index}`
+    };
+  };
+  if (Array.isArray(parsed)) {
+    return { rows: parsed.map(toRow) };
+  }
+  const doc = parsed;
+  if (!Array.isArray(doc.entries)) {
+    throw new UsageError(`${file}: expected { "collection": "...", "entries": [...] } or a JSON array.`);
+  }
+  return {
+    collection: typeof doc.collection === "string" ? doc.collection : void 0,
+    rows: doc.entries.map(toRow)
+  };
+}
+async function readMarkdownRows(dir, bodyField) {
+  const info = await stat(dir).catch(() => void 0);
+  const files = info?.isDirectory() ? (await readdir(dir)).filter((name) => [".md", ".markdown"].includes(extname(name).toLowerCase())).sort().map((name) => join5(dir, name)) : [dir];
+  if (files.length === 0) throw new UsageError(`No .md files found in ${dir}`);
+  const rows = [];
+  for (const file of files) {
+    const raw = await readFile2(file, "utf8");
+    const { meta, body } = parseFrontmatter(raw, file);
+    const slug = typeof meta.slug === "string" ? meta.slug : basename2(file, extname(file));
+    rows.push({
+      slug,
+      data: { ...meta, slug, [bodyField]: body.trim() },
+      source: file
+    });
+  }
+  return rows;
+}
+async function readContentRows(path, opts) {
+  const format = opts.format ?? await detectFormat(path);
+  if (format === "json") return readJsonRows(path);
+  return { rows: await readMarkdownRows(path, opts.bodyField) };
+}
+
 // src/commands/entries.ts
-import { readFile as readFile2 } from "fs/promises";
+function parseFormat(value) {
+  if (!value) return void 0;
+  if (value === "json") return "json";
+  if (value === "markdown-frontmatter" || value === "markdown" || value === "md") return "markdown";
+  throw new UsageError("--format must be json or markdown-frontmatter.");
+}
 function registerEntries(program) {
   const entries = program.command("entries").description("Create, read, update, and manage entries");
   entries.command("list").description("List entries in a collection").argument("<collection>", "collection key").option("--status <status>", "filter by status").option("--limit <n>", "page size", "25").option("--cursor <cursor>", "pagination cursor").action(
@@ -1722,22 +2070,40 @@ function registerEntries(program) {
       if (result.results.some((r) => !r.ok)) process.exitCode = 1;
     })
   );
-  entries.command("import").description("Import entries from a JSON file, with dry-run validation").argument("<file>", 'JSON file: { "collection": "posts", "entries": [{ "slug"?, "data" }] }').option("--dry-run", "validate without creating anything", false).action(
+  entries.command("import").description("Import entries from JSON or a Markdown directory, with dry-run validation").argument("<path>", "JSON file, or a directory of Markdown files with frontmatter").option("--collection <key>", "target collection (required unless the JSON file names one)").option("--format <format>", "json or markdown-frontmatter (detected from the path by default)").option("--body-field <key>", "field that receives the Markdown body", "body").option("--change-set <id>", "stage onto an existing change set instead of a new one").option("--mode <mode>", "upsert (default) updates rows whose slug exists; create rejects them", "upsert").option("--dry-run", "validate without writing anything", false).action(
     handle(async (ctx, args, opts) => {
       const project = ctx.requireProject();
-      const raw = JSON.parse(await readFile2(args[0], "utf8"));
+      const format = parseFormat(opts.format);
+      const mode2 = opts.mode;
+      if (mode2 !== "upsert" && mode2 !== "create") {
+        throw new UsageError("--mode must be upsert or create.");
+      }
+      const source = await readContentRows(args[0], {
+        format,
+        bodyField: opts.bodyField
+      });
+      const collection = opts.collection ?? source.collection;
+      if (!collection) {
+        throw new UsageError("No collection. Pass --collection, or use a JSON file with a `collection` key.");
+      }
+      if (source.rows.length === 0) throw new UsageError("Nothing to import.");
       const result = await ctx.management().entries.import(project, {
-        collection: raw.collection,
-        entries: raw.entries,
-        dryRun: Boolean(opts.dryRun)
+        collection,
+        entries: source.rows.map((r) => r.slug ? { slug: r.slug, data: r.data } : { data: r.data }),
+        dryRun: Boolean(opts.dryRun),
+        changeSetId: opts.changeSet,
+        mode: mode2
       });
       emit(result, () => {
+        const s = result.summary;
+        const counts = `${s.created} created, ${s.updated} updated, ${s.unchanged} unchanged, ${s.invalid} invalid, ${s.skipped} skipped`;
         diag(
-          result.dryRun ? `Dry run: ${result.valid ? "all rows valid" : "validation failed"}.` : `Imported ${result.results.filter((r) => r.ok).length}/${result.results.length} into change set ${result.changeSetId}.`
+          result.dryRun ? `Dry run (${result.valid ? "would apply" : "blocked"}): ${counts}.` : `Imported into change set ${result.changeSetId}: ${counts}.`
         );
-        for (const row of result.results.filter((r) => !r.ok)) {
+        for (const row of result.results.filter((r) => r.outcome === "invalid")) {
+          const where = source.rows[row.index]?.source ?? `row ${row.index}`;
           for (const e of row.errors ?? []) {
-            process.stderr.write(`  row ${row.index}${row.slug ? ` (${row.slug})` : ""}: ${e.path} ${e.message}
+            process.stderr.write(`  ${where}: ${e.path || "(entry)"} ${e.message}
 `);
           }
         }
@@ -1745,6 +2111,37 @@ function registerEntries(program) {
       if (!result.valid) process.exitCode = 1;
     })
   );
+  entries.command("reorder").description("Set a collection's editorial order (applies immediately; not staged)").argument("<collection>", "collection key").option("--slugs <list>", "comma-separated slugs or ids, in the desired order").option("--move <ref>", "reposition a single entry").option("--before <ref>", "with --move: place immediately before this entry").option("--after <ref>", "with --move: place immediately after this entry").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const collection = args[0];
+      const slugs = opts.slugs;
+      const move = opts.move;
+      if (Boolean(slugs) === Boolean(move)) {
+        throw new UsageError("Provide either --slugs or --move.");
+      }
+      if (!move && (opts.before || opts.after)) {
+        throw new UsageError("--before and --after only apply with --move.");
+      }
+      const body = slugs ? { order: slugs.split(",").map((s) => s.trim()).filter(Boolean) } : {
+        move: {
+          entry: move,
+          ...opts.before ? { before: opts.before } : {},
+          ...opts.after ? { after: opts.after } : {}
+        }
+      };
+      const result = await ctx.management().entries.reorder(project, collection, body);
+      emit(result, () => {
+        diag(
+          `Reordered ${result.collection}: ${result.writes} row(s) written. Ordering is not staged \u2014 this is live for readers now.`
+        );
+        table(result.updated, [
+          { header: "ENTRY", value: (r) => r.slug ?? r.id },
+          { header: "RANK", value: (r) => r.rank }
+        ]);
+      });
+    })
+  );
   entries.command("references").description("Show which entries reference this one and what it references").argument("<ref>", "collection/slug or entry id").action(
     handle(async (ctx, args) => {
       const project = ctx.requireProject();
@@ -2093,6 +2490,137 @@ function registerAssets(program) {
   );
 }
 
+// ../shared/dist/ids.js
+var ID_PREFIXES = {
+  user: "usr",
+  oauthAccount: "oau",
+  session: "ses",
+  organization: "org",
+  organizationMember: "mem",
+  organizationInvitation: "inv",
+  project: "prj",
+  projectOrigin: "por",
+  apiKey: "key",
+  collection: "col",
+  collectionVersion: "clv",
+  entry: "ent",
+  entrySlugAlias: "als",
+  entryRevision: "rev",
+  changeSet: "chs",
+  changeSetItem: "csi",
+  changeSetReview: "csr",
+  changeSetComment: "csc",
+  changeSetCheck: "chk",
+  asset: "ast",
+  assetUpload: "upl",
+  savedView: "viw",
+  previewToken: "prv",
+  webhookEndpoint: "whk",
+  webhookEvent: "whe",
+  webhookDelivery: "whd",
+  auditEvent: "aud",
+  job: "job",
+  idempotencyKey: "idm",
+  billingCustomer: "bcu",
+  billingSubscription: "bsu",
+  billingProviderEvent: "evt",
+  usagePeriod: "usp",
+  mcpClient: "mcl",
+  mcpGrant: "mgr",
+  mcpAuthorizationCode: "mac",
+  mcpToken: "mtk"
+};
+var PREFIX_SET = new Set(Object.values(ID_PREFIXES));
+
+// ../shared/dist/dates.js
+var HOURS = 60 * 60;
+var DAYS = 24 * 60 * 60;
+
+// ../shared/dist/origins.js
+function normalizeOrigin(value) {
+  try {
+    const url = new URL(value.trim());
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+      return void 0;
+    return url.origin;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../shared/dist/plans.js
+var GB = 1024 ** 3;
+var MB = 1024 ** 2;
+var UNLIMITED = Number.MAX_SAFE_INTEGER;
+var PLANS = {
+  free: {
+    key: "free",
+    priceEurMonthly: 0,
+    priceEurYearly: 0,
+    maxProjects: 2,
+    maxMembers: 2,
+    storageBytes: 1 * GB,
+    monthlyBandwidthBytes: 25 * GB,
+    monthlyPublicApiRequests: 1e4,
+    maxWebhookEndpoints: 1,
+    revisionRetentionDays: 30,
+    maxUploadBytes: 50 * MB
+  },
+  pro: {
+    key: "pro",
+    priceEurMonthly: 9,
+    priceEurYearly: 90,
+    maxProjects: 10,
+    maxMembers: 5,
+    storageBytes: 10 * GB,
+    monthlyBandwidthBytes: 250 * GB,
+    monthlyPublicApiRequests: 5e5,
+    maxWebhookEndpoints: 10,
+    revisionRetentionDays: null,
+    maxUploadBytes: 250 * MB
+  },
+  /**
+   * Myna's own organizations — the changelog, and anything else we run on the
+   * product we sell. It is never sold, never offered at checkout, and cannot be
+   * reached through the API: `scripts/bootstrap-internal-org.mjs` writes it
+   * directly, and billing refuses to move an organization on or off it.
+   */
+  internal: {
+    key: "internal",
+    priceEurMonthly: 0,
+    priceEurYearly: null,
+    maxProjects: UNLIMITED,
+    maxMembers: UNLIMITED,
+    storageBytes: UNLIMITED,
+    monthlyBandwidthBytes: UNLIMITED,
+    monthlyPublicApiRequests: UNLIMITED,
+    maxWebhookEndpoints: UNLIMITED,
+    revisionRetentionDays: null,
+    maxUploadBytes: UNLIMITED
+  }
+};
+
+// ../shared/dist/rank.js
+var DIGITS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+var MIN_DIGIT = DIGITS[0];
+var LAST_INDEX = DIGITS.length - 1;
+var MID_DIGIT = DIGITS[Math.floor(DIGITS.length / 2)];
+
+// ../shared/dist/release.js
+function parseSemVer(version) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version.trim());
+  if (!match)
+    return void 0;
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) };
+}
+function compareSemVer(a, b) {
+  const left = parseSemVer(a);
+  const right = parseSemVer(b);
+  if (!left || !right)
+    throw new Error(`Cannot compare versions "${a}" and "${b}".`);
+  return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
+}
+
 // src/commands/admin.ts
 function csv(value) {
   return value.split(",").map((s) => s.trim()).filter(Boolean);
@@ -2100,6 +2628,7 @@ function csv(value) {
 function registerAdmin(program) {
   registerOrganizations(program);
   registerProjects(program);
+  registerCors(program);
   registerKeys(program);
   registerMembers(program);
   registerWebhooks(program);
@@ -2221,6 +2750,56 @@ function registerProjects(program) {
       emit(project, () => diag(`Updated ${project.slug}.`));
     })
   );
+  const origins = projects.command("origins").description("Manage allowed browser origins");
+  origins.command("list").description("List the project's allowed browser origins").argument("[project]", "project id or slug").action(
+    handle(async (ctx, args) => {
+      const ref = args[0] ?? ctx.requireProject();
+      const project = await ctx.management().projects.get(ref);
+      emit(
+        project.origins,
+        () => table(
+          project.origins.map((origin) => ({ origin })),
+          [{ header: "ORIGIN", value: (r) => r.origin }]
+        )
+      );
+    })
+  );
+  origins.command("add").description("Allow one or more browser origins").argument("<origins...>", "origins, e.g. https://example.com").option("--project <ref>", "project id or slug").action(
+    handle(async (ctx, args, opts) => {
+      const ref = opts.project ?? ctx.requireProject();
+      const project = await ctx.management().projects.get(ref);
+      const requested = args[0].map(normalizeOne);
+      const next = [.../* @__PURE__ */ new Set([...project.origins, ...requested])];
+      const added = requested.filter((o) => !project.origins.includes(o));
+      if (added.length === 0) {
+        emit({ origins: project.origins, added: [] }, () => diag("Already allowed; nothing to do."));
+        return;
+      }
+      const updated = await ctx.management().projects.update(ref, { origins: next });
+      emit(
+        { origins: updated.origins, added },
+        () => diag(`Allowed ${added.join(", ")} on ${updated.slug}.`)
+      );
+    })
+  );
+  origins.command("remove").description("Stop allowing one or more browser origins").argument("<origins...>", "origins to remove").option("--project <ref>", "project id or slug").action(
+    handle(async (ctx, args, opts) => {
+      const ref = opts.project ?? ctx.requireProject();
+      const project = await ctx.management().projects.get(ref);
+      const requested = args[0].map(normalizeOne);
+      const next = project.origins.filter((o) => !requested.includes(o));
+      const removed = project.origins.filter((o) => requested.includes(o));
+      if (removed.length === 0) {
+        emit({ origins: project.origins, removed: [] }, () => diag("Not configured; nothing to do."));
+        return;
+      }
+      const updated = await ctx.management().projects.update(ref, { origins: next });
+      emit(
+        { origins: updated.origins, removed },
+        () => diag(`Removed ${removed.join(", ")} from ${updated.slug}.`)
+      );
+    })
+  );
   projects.command("archive").description("Archive a project").argument("[project]", "project id or slug").action(
     handle(async (ctx, args) => {
       const ref = args[0] ?? ctx.requireProject();
@@ -2229,6 +2808,35 @@ function registerProjects(program) {
     })
   );
 }
+function normalizeOne(value) {
+  const normalized = normalizeOrigin(value);
+  if (!normalized) throw new UsageError(`"${value}" is not a valid http(s) origin.`);
+  return normalized;
+}
+function registerCors(program) {
+  program.command("cors").description("Diagnose browser access to published content").command("check").description("Explain whether a browser at an origin can read this project").requiredOption("--origin <url>", "the browser origin to test").option("--collection <key>", "also check a specific collection's visibility").option("--project <ref>", "project id or slug").action(
+    handle(async (ctx, _args, opts) => {
+      const ref = opts.project ?? ctx.requireProject();
+      const result = await ctx.management().projects.corsCheck(ref, opts.origin, opts.collection);
+      emit(result, () => {
+        for (const c of result.checks) {
+          process.stdout.write(`${c.ok ? "\u2713" : "\u2717"} ${c.detail}
+`);
+        }
+        if (!result.allowed) {
+          const failed = result.checks.find((c) => !c.ok);
+          if (failed?.id === "origin") {
+            diag(`
+Allow it with: myna projects origins add ${result.origin}`);
+          } else if (failed?.id === "publicApi") {
+            diag("\nEnable it with: myna projects update --public-api on");
+          }
+        }
+      });
+      if (!result.allowed) process.exitCode = 1;
+    })
+  );
+}
 function registerKeys(program) {
   const keys = program.command("keys").description("Manage API keys");
   keys.command("list").description("List API keys for the project (or organization with --org-scope)").option("--org-scope", "list organization-scoped keys", false).action(
@@ -2307,7 +2915,12 @@ function registerMembers(program) {
         email: opts.email,
         role: opts.role
       });
-      emit(invite, () => diag(`Invited ${invite.email} as ${invite.role}.`));
+      emit(
+        invite,
+        () => diag(
+          `Invited ${invite.email} as ${invite.role}. An email with the accept link is on its way; it expires ${invite.expiresAt}.`
+        )
+      );
     })
   );
   members.command("update").description("Update a member's role").argument("<user>", "user id").requiredOption("--role <role>", "new role").action(
@@ -2462,8 +3075,498 @@ function registerBilling(program) {
   );
 }
 
+// src/commands/doctor.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join6 } from "path";
+
+// src/version.ts
+var VERSION = true ? "0.4.0" : "0.0.0-dev";
+
+// src/commands/doctor.ts
+var NPM_REGISTRY = "https://registry.npmjs.org";
+var SCAN_IGNORE = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".react-router", ".turbo", "coverage"]);
+var GENERATED_MARKERS = [
+  "// Generated by `myna types generate`. Do not edit by hand.",
+  "export interface MynaCollections {"
+];
+function looksGenerated(contents) {
+  return GENERATED_MARKERS.every((marker) => contents.includes(marker));
+}
+function check(id, title, status, detail, remedy) {
+  return remedy ? { id, title, status, detail, remedy } : { id, title, status, detail };
+}
+async function latestPublished(pkg) {
+  try {
+    const res = await fetch(`${NPM_REGISTRY}/${pkg}/latest`, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.version;
+  } catch {
+    return void 0;
+  }
+}
+async function checkCliVersion() {
+  if (!parseSemVer(VERSION)) {
+    return check(
+      "cli.version",
+      "CLI version",
+      "warn",
+      `Running an unreleased build (${VERSION}).`,
+      "Install a published release: npm install -g @myna-sh/cli"
+    );
+  }
+  const latest = await latestPublished("@myna-sh/cli");
+  if (!latest) {
+    return check("cli.version", "CLI version", "skip", `${VERSION} (could not reach npm to compare).`);
+  }
+  const behind = compareSemVer(VERSION, latest) < 0;
+  return behind ? check(
+    "cli.version",
+    "CLI version",
+    "warn",
+    `${VERSION} is behind the latest release ${latest}.`,
+    `npm install -g @myna-sh/cli@${latest}`
+  ) : check("cli.version", "CLI version", "pass", `${VERSION} is current.`);
+}
+function checkApi(meta, apiUrl) {
+  if (!meta) {
+    return [
+      check(
+        "api.reachable",
+        "API reachable",
+        "fail",
+        `No capability descriptor from ${apiUrl}/v1/meta.`,
+        "Check --api-url / MYNA_API_URL and network access. An API older than 0.2.0 does not serve /v1/meta."
+      )
+    ];
+  }
+  const checks = [
+    check("api.reachable", "API reachable", "pass", `${apiUrl} speaks API ${meta.apiVersion}.`)
+  ];
+  if (!parseSemVer(VERSION)) {
+    checks.push(
+      check("api.compatibility", "Client compatibility", "skip", "Unreleased CLI build; nothing to compare.")
+    );
+    return checks;
+  }
+  const supported = compareSemVer(VERSION, meta.minClientVersion) >= 0;
+  checks.push(
+    supported ? check(
+      "api.compatibility",
+      "Client compatibility",
+      "pass",
+      `CLI ${VERSION} meets the minimum supported client ${meta.minClientVersion}.`
+    ) : check(
+      "api.compatibility",
+      "Client compatibility",
+      "fail",
+      `CLI ${VERSION} is older than the minimum client ${meta.minClientVersion} this API supports.`,
+      `npm install -g @myna-sh/cli@latest`
+    )
+  );
+  return checks;
+}
+async function checkAuth(ctx) {
+  const status = await checkCredential(ctx.apiUrl, ctx.token, ctx.tokenSource);
+  if (!status.credentialPresent) {
+    return [
+      check("auth.credential", "Credential", "fail", "No credential found.", "myna login")
+    ];
+  }
+  if (!status.credentialValid) {
+    return [
+      check(
+        "auth.credential",
+        "Credential",
+        "fail",
+        // The distinction the old `whoami` collapsed.
+        `A credential is present (from ${status.source}) but the API rejected it: ${status.error?.detail ?? "unknown reason"}.`,
+        status.error?.code === "UNREACHABLE" ? void 0 : "myna login"
+      )
+    ];
+  }
+  const checks = [
+    check("auth.credential", "Credential", "pass", `Valid \u2014 ${describeIdentity(status.identity)}.`)
+  ];
+  const scopes = scopesOf(status.identity);
+  if (scopes) {
+    checks.push(
+      scopes.length > 0 ? check("auth.scopes", "Key scopes", "pass", scopes.join(", ")) : check(
+        "auth.scopes",
+        "Key scopes",
+        "fail",
+        "The key carries no scopes, so every authorized call will be denied.",
+        "Mint a scoped key: myna keys create --scopes content:read,content:write"
+      )
+    );
+  }
+  return checks;
+}
+async function checkProject(ctx) {
+  if (!ctx.project) {
+    return [
+      check(
+        "project.link",
+        "Project",
+        "warn",
+        "No project selected.",
+        "myna link --project <project>, or pass --project"
+      )
+    ];
+  }
+  try {
+    const project = await ctx.management().projects.get(ctx.project);
+    const where = ctx.linkedRoot ? ` (linked at ${ctx.linkedRoot})` : "";
+    return [
+      check("project.link", "Project", "pass", `${project.slug}${where}.`),
+      project.publicApiEnabled ? check("project.publicApi", "Public API", "pass", "Enabled.") : check(
+        "project.publicApi",
+        "Public API",
+        "warn",
+        "Disabled \u2014 browser and unauthenticated reads will 404.",
+        "myna projects update --public-api"
+      )
+    ];
+  } catch (error) {
+    const detail = isMynaApiError(error) ? `${error.code} \u2014 ${error.detail ?? error.title}` : error instanceof Error ? error.message : String(error);
+    return [
+      check(
+        "project.link",
+        "Project",
+        "fail",
+        `Cannot read project "${ctx.project}": ${detail}`,
+        "Check the project ref and that your credential has access to it."
+      )
+    ];
+  }
+}
+async function checkOrigin(ctx, origin) {
+  const canonical = normalizeOrigin(origin);
+  if (!canonical) {
+    return check("origins", "Browser origin", "fail", `"${origin}" is not a valid http(s) origin.`);
+  }
+  if (!ctx.project) {
+    return check("origins", "Browser origin", "skip", "No project selected.");
+  }
+  try {
+    const project = await ctx.management().projects.get(ctx.project);
+    const allowed = project.origins.some((o) => normalizeOrigin(o) === canonical);
+    return allowed ? check("origins", "Browser origin", "pass", `${canonical} is allowed on ${project.slug}.`) : check(
+      "origins",
+      "Browser origin",
+      "fail",
+      `${canonical} is not allowed on ${project.slug}. A browser will discard responses from it. Configured: ${project.origins.length > 0 ? project.origins.join(", ") : "(none)"}`,
+      `myna projects update --origins ${[...project.origins, canonical].join(",")}`
+    );
+  } catch {
+    return check("origins", "Browser origin", "skip", "Could not read the project's origins.");
+  }
+}
+async function checkSchema(ctx, schemaDir) {
+  const dir = schemaDirFor(ctx.linkedRoot, schemaDir);
+  if (!existsSync4(dir)) {
+    return check("schema.drift", "Local schema", "skip", `No schema directory at ${dir}.`);
+  }
+  if (!ctx.project) {
+    return check("schema.drift", "Local schema", "skip", "No project selected.");
+  }
+  let local;
+  try {
+    local = await loadLocalSchemas(dir);
+  } catch (error) {
+    return check(
+      "schema.drift",
+      "Local schema",
+      "fail",
+      `Could not load schemas from ${dir}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (local.length === 0) {
+    return check("schema.drift", "Local schema", "skip", `No collections defined in ${dir}.`);
+  }
+  try {
+    const diff = await ctx.management().schema.diff(ctx.project, local);
+    return diff.ops.length === 0 ? check("schema.drift", "Local schema", "pass", `${local.length} collection(s) match the deployed schema.`) : check(
+      "schema.drift",
+      "Local schema",
+      "warn",
+      `${diff.ops.length} undeployed change(s) (${diff.classification}).`,
+      "myna schema diff, then myna schema push"
+    );
+  } catch (error) {
+    return check(
+      "schema.drift",
+      "Local schema",
+      "skip",
+      `Could not diff against the deployed schema: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function findGeneratedTypes(root, depth = 4) {
+  let entries;
+  try {
+    entries = readdirSync2(root);
+  } catch {
+    return void 0;
+  }
+  const dirs = [];
+  for (const entry of entries) {
+    if (SCAN_IGNORE.has(entry) || entry.startsWith(".")) continue;
+    const full = join6(root, entry);
+    let stats;
+    try {
+      stats = statSync2(full);
+    } catch {
+      continue;
+    }
+    if (stats.isDirectory()) {
+      dirs.push(full);
+      continue;
+    }
+    if (!/\.(ts|d\.ts)$/.test(entry)) continue;
+    try {
+      if (looksGenerated(readFileSync3(full, "utf8"))) return full;
+    } catch {
+    }
+  }
+  if (depth <= 0) return void 0;
+  for (const dir of dirs) {
+    const found = findGeneratedTypes(dir, depth - 1);
+    if (found) return found;
+  }
+  return void 0;
+}
+async function checkTypes(ctx, explicit, schemaDir) {
+  const root = ctx.linkedRoot ?? process.cwd();
+  const file = explicit ?? findGeneratedTypes(root);
+  if (!file) {
+    return check("types.freshness", "Generated types", "skip", "No generated types file found.");
+  }
+  if (!existsSync4(file)) {
+    return check("types.freshness", "Generated types", "fail", `${file} does not exist.`);
+  }
+  const dir = schemaDirFor(ctx.linkedRoot, schemaDir);
+  if (!existsSync4(dir)) {
+    return check("types.freshness", "Generated types", "skip", `Found ${file} but no schema directory to compare against.`);
+  }
+  try {
+    const expected = generateTypesModule(await loadLocalSchemas(dir));
+    return readFileSync3(file, "utf8") === expected ? check("types.freshness", "Generated types", "pass", `${file} matches the local schema.`) : check(
+      "types.freshness",
+      "Generated types",
+      "warn",
+      `${file} is out of date with the local schema.`,
+      `myna types generate --out ${file}`
+    );
+  } catch (error) {
+    return check(
+      "types.freshness",
+      "Generated types",
+      "skip",
+      `Could not regenerate types for comparison: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+var ICON = { pass: "\u2713", warn: "!", fail: "\u2717", skip: "\u2013" };
+function registerDoctor(program) {
+  program.command("doctor").description("Diagnose CLI, API, credential, project, schema, and origin configuration").option("--origin <url>", "also check whether this browser origin is allowed").option("--schema-dir <dir>", "schema directory").option("--types <file>", "generated types file to check for freshness").action(
+    handle(async (ctx, _args, opts) => {
+      const checks = [];
+      checks.push(await checkCliVersion());
+      const meta = await fetchMeta(ctx.apiUrl);
+      checks.push(...checkApi(meta, ctx.apiUrl));
+      const auth = await checkAuth(ctx);
+      checks.push(...auth);
+      const authed = auth[0]?.status === "pass";
+      if (authed) {
+        checks.push(...await checkProject(ctx));
+        checks.push(await checkSchema(ctx, opts.schemaDir));
+        checks.push(await checkTypes(ctx, opts.types, opts.schemaDir));
+        if (opts.origin) checks.push(await checkOrigin(ctx, opts.origin));
+      } else {
+        const deferred = [
+          ["project.link", "Project"],
+          ["schema.drift", "Local schema"],
+          ["types.freshness", "Generated types"]
+        ];
+        for (const [id, title] of deferred) {
+          checks.push(check(id, title, "skip", "Requires a valid credential."));
+        }
+      }
+      const failed = checks.filter((c) => c.status === "fail").length;
+      const warned = checks.filter((c) => c.status === "warn").length;
+      emit({ ok: failed === 0, failed, warned, checks }, () => {
+        for (const c of checks) {
+          process.stdout.write(`${ICON[c.status]} ${c.title}: ${c.detail}
+`);
+          if (c.remedy && c.status !== "pass") process.stdout.write(`    \u2192 ${c.remedy}
+`);
+        }
+        diag(
+          failed === 0 ? warned === 0 ? "\nAll checks passed." : `
+${warned} warning(s), no failures.` : `
+${failed} failure(s), ${warned} warning(s).`
+        );
+      });
+      if (failed > 0) process.exitCode = 1;
+    })
+  );
+}
+
+// src/commands/sync.ts
+import { readdir as readdir2, stat as stat2 } from "fs/promises";
+import { join as join7 } from "path";
+async function isDirectory(path) {
+  const info = await stat2(path).catch(() => void 0);
+  return Boolean(info?.isDirectory());
+}
+async function planDirectories(dir, collection) {
+  if (!await isDirectory(dir)) {
+    if (!collection) throw new UsageError("Syncing a single file needs --collection.");
+    return [{ collection, path: dir }];
+  }
+  if (collection) return [{ collection, path: dir }];
+  const children = await readdir2(dir);
+  const plan = [];
+  for (const name of children.sort()) {
+    if (name.startsWith(".")) continue;
+    const full = join7(dir, name);
+    if (await isDirectory(full)) plan.push({ collection: name, path: full });
+  }
+  if (plan.length === 0) {
+    throw new UsageError(
+      `No collection subdirectories in ${dir}. Pass --collection to sync it as one collection.`
+    );
+  }
+  return plan;
+}
+function registerSync(program) {
+  program.command("sync").description("Reconcile a content directory into collections, staged on one change set").argument("<dir>", "content directory").option("--collection <key>", "treat the directory as one collection instead of one per subdirectory").option("--format <format>", "json or markdown-frontmatter (detected from the files by default)").option("--body-field <key>", "field that receives the Markdown body", "body").option("--change-set <id>", "stage onto an existing change set").option("--dry-run", "report what would change without writing", false).option("--delete-missing", "also stage deletion of entries with no matching file", false).option("--confirm-delete", "required consequence flag for --delete-missing", false).action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const dryRun = Boolean(opts.dryRun);
+      const deleteMissing = Boolean(opts.deleteMissing);
+      if (deleteMissing && !opts.confirmDelete && !dryRun) {
+        throw new UsageError("--delete-missing removes published content. Add --confirm-delete, or use --dry-run.");
+      }
+      const plan = await planDirectories(args[0], opts.collection);
+      const mgmt = ctx.management();
+      let changeSetId = opts.changeSet;
+      const report = [];
+      let failed = false;
+      for (const target of plan) {
+        const source = await readContentRows(target.path, {
+          format: parseFormat2(opts.format),
+          bodyField: opts.bodyField
+        });
+        if (source.rows.length === 0) continue;
+        const result = await mgmt.entries.import(project, {
+          collection: target.collection,
+          entries: source.rows.map((r) => r.slug ? { slug: r.slug, data: r.data } : { data: r.data }),
+          dryRun,
+          changeSetId,
+          mode: "upsert"
+        });
+        if (!result.valid) {
+          failed = true;
+          for (const row of result.results.filter((r) => r.outcome === "invalid")) {
+            const where = source.rows[row.index]?.source ?? `row ${row.index}`;
+            for (const e of row.errors ?? []) {
+              process.stderr.write(`  ${where}: ${e.path || "(entry)"} ${e.message}
+`);
+            }
+          }
+        }
+        changeSetId ??= result.changeSetId ?? void 0;
+        let deleted = 0;
+        let deletedSlugs = [];
+        if (deleteMissing && result.valid) {
+          const staged = await stageMissingDeletions(
+            ctx,
+            project,
+            target.collection,
+            new Set(source.rows.map((r) => r.slug).filter((s) => Boolean(s))),
+            changeSetId,
+            dryRun
+          );
+          deleted = staged.count;
+          deletedSlugs = staged.slugs;
+          changeSetId ??= staged.changeSetId;
+        }
+        report.push({
+          collection: target.collection,
+          created: result.summary.created,
+          updated: result.summary.updated,
+          unchanged: result.summary.unchanged,
+          invalid: result.summary.invalid,
+          deleted,
+          deletedSlugs
+        });
+      }
+      emit({ dryRun, changeSetId: changeSetId ?? null, collections: report, ok: !failed }, () => {
+        table(report, [
+          { header: "COLLECTION", value: (r) => r.collection },
+          { header: "CREATED", value: (r) => String(r.created) },
+          { header: "UPDATED", value: (r) => String(r.updated) },
+          { header: "UNCHANGED", value: (r) => String(r.unchanged) },
+          { header: "DELETED", value: (r) => String(r.deleted) },
+          { header: "INVALID", value: (r) => String(r.invalid) }
+        ]);
+        const removals = report.flatMap((r) => r.deletedSlugs.map((slug) => `${r.collection}/${slug}`));
+        if (removals.length > 0) {
+          diag(`
+${dryRun ? "Would stage" : "Staged"} deletion of ${removals.length} entr(y/ies) with no file:`);
+          for (const slug of removals) diag(`  \u2212 ${slug}`);
+        }
+        if (dryRun) {
+          diag("\nDry run \u2014 nothing was written.");
+        } else if (changeSetId) {
+          diag(`
+Staged on change set ${changeSetId}. Review and publish it to go live.`);
+        } else {
+          diag("\nNothing to do \u2014 every file already matches.");
+        }
+      });
+      if (failed) process.exitCode = 1;
+    })
+  );
+}
+async function stageMissingDeletions(ctx, project, collection, presentSlugs, changeSetId, dryRun) {
+  const mgmt = ctx.management();
+  const missing = [];
+  let cursor;
+  do {
+    const page = await mgmt.entries.list(project, { collection, limit: 100, cursor });
+    for (const entry of page.data) {
+      if (entry.slug && !presentSlugs.has(entry.slug)) missing.push({ id: entry.id, slug: entry.slug });
+    }
+    cursor = page.nextCursor ?? void 0;
+  } while (cursor);
+  const slugs = missing.map((m) => m.slug).sort();
+  if (missing.length === 0 || dryRun) return { count: missing.length, slugs, changeSetId };
+  const result = await mgmt.entries.bulk(project, {
+    action: "delete",
+    entryIds: missing.map((m) => m.id),
+    changeSetId
+  });
+  const succeeded = result.results.filter((r) => r.ok);
+  return {
+    count: succeeded.length,
+    slugs,
+    changeSetId: changeSetId ?? succeeded.find((r) => r.changeSetId)?.changeSetId
+  };
+}
+function parseFormat2(value) {
+  if (!value) return void 0;
+  if (value === "json") return "json";
+  if (value === "markdown-frontmatter" || value === "markdown" || value === "md") return "markdown";
+  throw new UsageError("--format must be json or markdown-frontmatter.");
+}
+
 // src/main.ts
-var VERSION = "0.2.0";
 var GLOBAL_VALUE_FLAGS = /* @__PURE__ */ new Set(["--project", "--organization", "--token", "--api-url"]);
 var GLOBAL_BOOL_FLAGS = /* @__PURE__ */ new Set(["--json", "--no-interactive", "--interactive"]);
 function normalizeGlobals(argv) {
@@ -2493,9 +3596,11 @@ function buildProgram() {
   const program = new Command();
   program.name("myna").description("Myna \u2014 content infrastructure for developers and agents").version(VERSION, "-v, --version").option("--json", "emit a single machine-readable JSON value on stdout").option("--project <ref>", "project id or slug").option("--organization <ref>", "organization id or slug").option("--token <token>", "API token (overrides stored credentials)").option("--api-url <url>", "API base URL").option("--no-interactive", "disable prompts and browser opening").showHelpAfterError();
   registerAuth(program);
+  registerDoctor(program);
   registerWorkspace(program);
   registerSchema(program);
   registerEntries(program);
+  registerSync(program);
   registerChanges(program);
   registerPreviews(program);
   registerAssets(program);
@@ -2522,6 +3627,7 @@ async function main(argv = process.argv) {
   }
 }
 export {
+  VERSION,
   buildProgram,
   main
 };