@mynthio/cli 0.0.22 → 0.0.23

package/dist/bin.js

@@ -1,11 +1,2545 @@
 #!/usr/bin/env node
-import J from'chalk';import {Command,Option,Help}from'commander';import {z}from'zod';import {readFile,mkdir,writeFile,rename,rm,stat}from'fs/promises';import {hostname,homedir}from'os';import {resolve,join,dirname,extname,basename}from'path';import {spawn}from'child_process';import {existsSync}from'fs';import dr from'ora';import Tn from'fuzzysort';var be="client_01KATK792RR5ZCHMF5YMNN1ZSE",Xe=process.env.MYNTH_WORKOS_API_URL??"https://api.workos.com",Ze="0.0.22",qe=e=>e.replace(/\/+$/,""),Ve=e=>e!==void 0&&e.length>0?e:void 0,q=()=>({apiUrl:qe(process.env.MYNTH_API_URL??"https://api.mynth.io"),docsUrl:qe(process.env.MYNTH_DOCS_URL??"https://docs.mynth.io"),envApiKey:Ve(process.env.MYNTH_API_KEY),envDestination:Ve(process.env.MYNTH_DESTINATION),debug:process.env.MYNTH_DEBUG==="1"||process.env.MYNTH_DEBUG==="true"});var b={error:1,usage:2,auth:3,insufficientCredits:4,moderation:5,rateLimited:6},y=class extends Error{constructor(t,n){super(t,n),this.name=new.target.name;}},l=class extends y{},$=class extends y{},k=class extends y{status;code;constructor(t,n){super(t,n),this.status=n.status,this.code=n.code;}},O=class extends y{code;constructor(t,n,o){super(n,o),this.code=t;}},Hn={UNAUTHORIZED:b.auth,INSUFFICIENT_SCOPE:b.auth,VALIDATION_ERROR:b.usage,INSUFFICIENT_BALANCE:b.insufficientCredits,SPENDING_LIMIT_EXCEEDED:b.insufficientCredits,RESTRICTED_CONTENT:b.moderation},Qe=e=>{if(e instanceof l)return b.usage;if(e instanceof $)return b.auth;if(e instanceof k){let n=e.code!==void 0?Hn[e.code]:void 0;return n!==void 0?n:e.status===401||e.status===403?b.auth:e.status===429?b.rateLimited:b.error}let t=e?.code;return typeof t=="string"&&t.startsWith("commander.")?b.usage:b.error},ve=e=>{let t=e.result,n=[...(e.errors??[]).map(o=>o.code),...(t?.images??[]).map(o=>o.error?.code)].filter(o=>typeof o=="string");return n.find(o=>o==="RESTRICTED_CONTENT")??n[0]},et=e=>ve(e)==="RESTRICTED_CONTENT"?b.moderation:b.error;var a=(e="")=>{process.stdout.write(`${e}
-`);},T=(e="")=>{process.stderr.write(`${e}
-`);},p=e=>{a(JSON.stringify(e,null,2));},g={ok:J.green("\u2713"),fail:J.red("\u2717"),pending:J.yellow("\u2026")},V=e=>e==="completed"?g.ok:e==="failed"?g.fail:g.pending,F=(e,t,n="s")=>`${e} ${t}${e===1?"":n}`,tt=(e,t=2)=>{let n=" ".repeat(t);return e.split(`
-`).map(o=>`${n}${o}`).join(`
-`)};var _=z.lazy(()=>z.union([z.string(),z.number(),z.boolean(),z.null(),z.array(_),z.record(_)])),nt=e=>z.object({data:e}),Gn=z.object({id:z.string(),email:z.string(),first_name:z.string().nullable().optional(),last_name:z.string().nullable().optional()}),ot=z.object({device_code:z.string(),user_code:z.string(),verification_uri:z.string(),verification_uri_complete:z.string().optional(),expires_in:z.number(),interval:z.number().optional()}),rt=z.object({access_token:z.string(),refresh_token:z.string(),user:Gn.optional()}),it=z.object({error:z.string().optional(),error_description:z.string().optional(),message:z.string().optional(),code:z.string().optional()}),at=z.object({kind:z.literal("api_key"),api_key:z.string(),id:z.string().optional()}),R=["generate","manage","keys"],Ie=z.object({raw:z.string(),apiKey:z.object({id:z.string(),name:z.string().optional(),keyPreview:z.string(),scopes:z.array(z.string())})}),qn=z.union([z.string(),z.number()]).nullable().optional(),st=z.object({id:z.string(),name:z.string().nullable(),keyPreview:z.string(),scopes:z.array(z.string()),spendingLimit:qn,spendingLimitPeriod:z.string().nullable().optional(),createdAt:z.string()}),Vn=z.union([z.object({mode:z.literal("unlimited")}),z.object({mode:z.literal("limited"),limit:z.string(),period:z.string(),used:z.string(),remaining:z.string()})]),dt=z.object({userId:z.string(),auth:z.object({method:z.string(),apiKey:z.object({id:z.string(),name:z.string().nullable(),keyPreview:z.string(),scopes:z.array(z.string()).optional(),spending:Vn.optional()}).optional()})}),lt=z.object({balance:z.string(),reserved:z.string(),available:z.string(),currency:z.string()}),Xn=z.object({type:z.string(),kind:z.string().optional(),min:z.number().optional(),max:z.number()}),Zn=z.object({inputs:z.object({rules:z.array(Xn),maxTotal:z.number().optional()}).optional()}),Qn=z.object({perImage:z.object({base:z.string(),"4k":z.string().optional()}),perInput:z.string().optional()}),eo=z.object({perSecond:z.record(z.string(),z.string()),audio:z.object({perSecond:z.string()}).optional()}),ct=z.object({id:z.string(),displayName:z.string().nullable(),type:z.string(),modes:z.record(z.string(),Zn),pricing:z.union([Qn,eo]).nullable()}),X=z.enum(["pending","completed","failed"]),pt=z.object({id:z.string(),type:z.string(),status:X,userId:z.string().optional(),apiKeyId:z.string().nullable().optional(),cost:z.string().nullable(),request:_.optional(),result:_.nullable(),errors:z.array(z.object({code:z.string(),message:z.string().optional()})).nullish(),createdAt:z.string(),updatedAt:z.string()}),mt=z.object({id:z.string(),type:z.string(),status:z.string(),cost:z.string().nullable(),createdAt:z.string(),updatedAt:z.string()}),ut=z.object({id:z.string(),type:z.string(),status:X,result:_.nullable()}),gt=z.object({urls:z.array(z.string())}),ft=z.object({taskId:z.string(),estimatedCost:z.string().optional(),access:z.object({publicAccessToken:z.string()}).optional()}),yt=z.object({estimatedCost:z.string(),currency:z.string(),estimateKind:z.enum(["exact","upper_bound"])}),ht=z.object({level:z.string()}),wt=z.object({alt:z.string()}),kt=z.object({score:z.number(),summary:z.string(),findings:z.array(z.object({finding:z.string(),category:z.string(),severity:z.string(),where:z.string(),confidence:z.string()})).optional(),strengths:z.array(z.object({strength:z.string(),confidence:z.string()})).optional()}),$e=z.object({code:z.string(),message:z.string().optional()}),bt=z.union([z.object({status:z.literal("success"),name:z.string()}),z.object({status:z.literal("failed"),name:z.string(),error:$e})]),to=z.union([z.object({status:z.literal("success"),id:z.string().optional(),url:z.string().nullable().optional(),mynth_url:z.string().optional(),size:z.string().optional(),format:z.string().optional(),rating:z.union([z.object({status:z.literal("success"),level:z.string()}),z.object({status:z.literal("failed"),error:$e})]).optional(),destination:bt.optional()}),z.object({status:z.literal("failed"),error:$e})]),vt=z.object({model:z.string().optional(),images:z.array(to).optional(),magic_prompt:z.object({positive:z.string(),negative:z.string().optional()}).optional()}),At=z.object({image:z.object({id:z.string(),url:z.string().nullable(),mynth_url:z.string(),size:z.string(),format:z.string(),destination:bt.optional()})}),U=z.object({id:z.string(),name:z.string(),provider:z.object({id:z.string()}).catchall(_),config:z.object({path_template:z.string(),url_template:z.string().optional()}).partial(),createdAt:z.string(),updatedAt:z.string()}),$t=z.union([z.literal("all"),z.array(z.string())]),It=z.object({id:z.string(),enabled:z.boolean(),url:z.string(),secret:z.string(),events:$t,apiKeyIds:z.array(z.string()).nullish(),oauthEnabled:z.boolean().optional(),createdAt:z.string().optional()}),xt=z.object({id:z.string(),enabled:z.boolean().optional(),url:z.string(),events:$t,apiKeyIds:z.array(z.string()).nullish(),oauthEnabled:z.boolean().optional()});var no=e=>{if(e===void 0)return "";let t=new URLSearchParams;for(let[n,o]of Object.entries(e))o!==void 0&&t.set(n,String(o));return t.size>0?`?${t}`:""},oo=e=>e===void 0?{headers:{}}:e instanceof FormData?{body:e,headers:{}}:{body:JSON.stringify(e),headers:{"Content-Type":"application/json"}},ro=async e=>{try{return await e.text()}catch{return ""}},io=async(e,t)=>{let n=await ro(e),o,r;try{let s=JSON.parse(n);typeof s.code=="string"&&(o=s.code),typeof s.message=="string"?r=s.message:typeof s.error=="string"&&(r=s.error);}catch{}return new k(`${t} failed (${e.status}): ${r??n??"no body"}`,{status:e.status,...o!==void 0?{code:o}:{}})},Z=class{constructor(t,n){this.tokens=n;this.baseUrl=t.apiUrl;}baseUrl;async send(t,n,o={}){let r=await this.attempt(n,o);if(r.ok)return r;throw await io(r,t)}async fetch(t,n,o,r={}){let s=await this.send(t,n,r),d;try{d=await s.json();}catch(h){throw new k(`${t} returned invalid JSON: ${h.message}`,{status:s.status,cause:h})}let c=nt(o).safeParse(d);if(!c.success)throw new k(`${t} returned an unexpected response shape`,{status:s.status,cause:c.error});return c.data.data}async call(t,n,o={}){await this.send(t,n,o);}async attempt(t,n){let{body:o,headers:r}=oo(n.body),s=n.auth===false?void 0:n.token??await this.tokens.token();try{return await fetch(`${this.baseUrl}${t}${no(n.query)}`,{method:n.method??(n.body!==void 0?"POST":"GET"),headers:{...r,...s!==void 0?{Authorization:`Bearer ${s}`}:{}},...o!==void 0?{body:o}:{}})}catch(d){throw new k(`request to ${t} failed: ${d.message}`,{status:0,cause:d})}}};var ao=2048,so=/^[A-Za-z0-9._~%-]+$/,lo=e=>{let t=e.trim();if(t.length===0)throw new l("documentation path must not be empty");if(t.length>ao)throw new l("documentation path is too long");if(t.startsWith("//")||t.includes("://"))throw new l("documentation path must be a path, not a URL");if(/[?#\\]/.test(t))throw new l("documentation path must not contain a query, fragment, or backslash");let n=t.startsWith("/")?t.slice(1):t;if(n.endsWith(".md"))throw new l("documentation path must not include the .md suffix");let o=n.split("/");if(o.some(r=>!so.test(r)||r==="."||r===".."))throw new l("documentation path contains an invalid segment");return o.join("/")},co=e=>e.length>500?`${e.slice(0,500)}\u2026`:e,Tt=async(e,t)=>{let n;try{n=await fetch(e);}catch(r){throw new k(`${t} failed: ${r.message}`,{status:0,cause:r})}let o=await n.text().catch(()=>"");if(!n.ok)throw new k(`${t} failed (${n.status}): ${co(o)||"no body"}`,{status:n.status});return o},Q=class{constructor(t){this.docsUrl=t;}async get(t){let n=lo(t),o=n.split("/").map(encodeURIComponent).join("/");return {path:n,content:await Tt(`${this.docsUrl}/${o}.md`,`docs fetch for ${n}`)}}list(){return Tt(`${this.docsUrl}/llms.txt`,"docs index fetch")}};var ko="credentials.json",bo=384,vo=()=>{let e=process.env.XDG_CONFIG_HOME;return join(e!==void 0&&e.length>0?e:join(homedir(),".config"),"mynth")},Ao=async e=>{try{return await stat(e),true}catch{return  false}},ee=class{filePath;constructor(){this.filePath=join(vo(),ko);}async get(){if(!await Ao(this.filePath))return;let t;try{t=await readFile(this.filePath,"utf8");}catch(r){throw new y(`could not read ${this.filePath}: ${r.message}`,{cause:r})}let n;try{n=JSON.parse(t);}catch(r){throw new y(`${this.filePath} is not valid JSON`,{cause:r})}let o=at.safeParse(n);if(!o.success)throw new y(`${this.filePath} has an unexpected shape; run \`mynth auth login\``,{cause:o.error});return o.data}async set(t){try{await mkdir(dirname(this.filePath),{recursive:true,mode:448});let n=`${this.filePath}.${process.pid}.tmp`;await writeFile(n,JSON.stringify(t),{encoding:"utf8",mode:bo}),await rename(n,this.filePath);}catch(n){throw new y(`could not write ${this.filePath}: ${n.message}`,{cause:n})}}async clear(){try{await rm(this.filePath,{force:true});}catch(t){throw new y(`could not delete ${this.filePath}: ${t.message}`,{cause:t})}}};var te=class{constructor(t){this.config=t;this.store=new ee,this.envApiKeySet=t.envApiKey!==void 0;}store;envApiKeySet;cached;async token(){if(this.config.envApiKey!==void 0)return this.config.envApiKey;if(this.cached!==void 0)return this.cached;let t=await this.read();if(t===void 0)throw new $("not authenticated: run `mynth auth login` or set MYNTH_API_KEY");return this.cached=t.api_key,this.cached}async status(){if(this.envApiKeySet)return {kind:"env"};let t=await this.read().catch(()=>{});return t===void 0?{kind:"none"}:{kind:"stored",credentials:t}}async save(t){await this.store.set(t),this.cached=void 0;}async clear(){await this.store.clear(),this.cached=void 0;}async read(){try{return await this.store.get()}catch(t){throw new $(`could not read stored credentials: ${t.message}`,{cause:t})}}};var Rt=()=>{let e=q(),t=new te(e);return {config:e,session:t,api:new Z(e,t),docs:new Q(e.docsUrl)}};var Te=["...........",".....4.....","....343....",".....2.....",".344.2.443.","..4432344..",".....2.....",".233.2.332.","..3322233..",".....1.....","..........."],K={1:"#318267",2:"#00a27a",3:"#33bb92",4:"#6bd1ad"},$o=(e,t)=>{let n=o=>o!==".";return !n(e)&&!n(t)?" ":J.level===0?n(e)&&n(t)?"\u2588":n(e)?"\u2580":"\u2584":n(t)?n(e)?e===t?J.hex(K[e])("\u2588"):J.hex(K[e]).bgHex(K[t])("\u2580"):J.hex(K[t])("\u2584"):J.hex(K[e])("\u2580")},Ct=()=>{let e=[];for(let t=0;t<Te.length;t+=2){let n=Te[t],o=Te[t+1]??"",r="";for(let s=0;s<n.length;s+=1)r+=$o(n[s],o[s]??".");e.push(r.trimEnd());}return e.filter(t=>t.length>0).join(`
-`)};var Et=(e,t)=>e.fetch("api key create","/api-key",Ie,{body:{name:t.name,scopes:t.scopes},token:t.token}),Pt=(e,t)=>e.fetch("api key create","/api-key",Ie,{body:{name:t.name,scopes:t.scopes}}),Ot=e=>e.fetch("api key list","/api-key",z.array(st)),ne=(e,t)=>e.call("api key delete",`/api-key/${t}`,{method:"DELETE"});var C=(e,t,n)=>{if(e.length===0){a(n);return}let o=e.map(d=>t.map(c=>c.value(d))),r=t.map((d,c)=>Math.max(d.header.length,...o.map(h=>h[c].length))),s=d=>d.map((c,h)=>h===d.length-1?c:c.padEnd(r[h])).join("  ");a(s(t.map(d=>d.header)));for(let d of o)a(s(d));};var f=()=>new Option("--json","Output machine-readable JSON instead of a human-readable summary"),S=()=>new Option("--yes","Confirm the destructive action (required; there is no interactive prompt)");var St=["generate"],To=e=>{if(e===void 0)return St;let t=e.split(",").map(o=>o.trim()).filter(Boolean),n=t.filter(o=>!R.includes(o));if(t.length===0||n.length>0)throw new l(`invalid --scopes: ${n.join(", ")||"empty"}. Valid scopes: ${R.join(", ")}`);return t},jt=e=>{let t=new Command("api-key").description("Manage Mynth API keys");return t.command("create").description("Create an API key. The key itself is shown once, on success.").argument("<name>","Name for the key, e.g. the app or environment it belongs to").option("--scopes <list>",`Comma-separated scopes (default: ${St.join(",")}). Widening beyond \`generate\` requires the dashboard: the API refuses scope escalation from a CLI session.`).addOption(f()).action(async(n,o)=>{let r=await Pt(e.api,{name:n,scopes:To(o.scopes)});if(o.json){p({key:r.raw,...r.apiKey});return}a(`${g.ok} Created API key "${r.apiKey.name??n}"`),a(`  ID:     ${r.apiKey.id}`),a(`  Scopes: ${r.apiKey.scopes.join(", ")}`),a(""),a(`  ${r.raw}`),a("  Save this now \u2014 it is shown only once and cannot be retrieved again.");}),t.command("list").description("List active API keys").addOption(f()).action(async n=>{let o=await Ot(e.api);if(n.json){p(o);return}C(o,[{header:"ID",value:r=>r.id},{header:"Name",value:r=>r.name??"-"},{header:"Preview",value:r=>r.keyPreview},{header:"Scopes",value:r=>r.scopes.join(",")},{header:"Limit",value:r=>r.spendingLimit===null||r.spendingLimit===void 0?"-":`$${r.spendingLimit}/${r.spendingLimitPeriod??"period"}`},{header:"Created",value:r=>r.createdAt}],"No API keys found.");}),t.command("delete").description("Revoke an API key").argument("<id>","API key ID").addOption(S()).addOption(f()).action(async(n,o)=>{if(o.yes!==true)throw new l("refusing to delete without --yes");if(await ne(e.api,n),o.json){p({deleted:n});return}a(`${g.ok} Revoked API key ${n}`);}),t};var oe=e=>e.fetch("me","/me",dt),Dt=e=>e.fetch("balance","/balance",lt);var Ro="urn:ietf:params:oauth:grant-type:device_code",Nt=async e=>{try{return await e.json()}catch{return {}}},Lt=async(e,t,n)=>{try{return await fetch(`${Xe}${e}`,{method:"POST",body:t,headers:{Accept:"application/json",...typeof t=="string"?{"Content-Type":"application/json"}:{}}})}catch(o){throw new y(`${n} failed: ${o.message}`,{cause:o})}},Mt=async(e,t)=>{let n=it.catch({}).parse(await Nt(e)),o=n.error??n.code??"workos_error";return new O(o,n.error_description??n.message??`${t} failed`)},Ft=async(e,t,n)=>{let o=t.safeParse(await Nt(e));if(!o.success)throw new y(`${n} returned an unexpected response`,{cause:o.error});return o.data},Ut=async()=>{let e=await Lt("/user_management/authorize/device",new URLSearchParams({client_id:be}),"device authorization");if(!e.ok)throw await Mt(e,"device authorization");return Ft(e,ot,"device authorization")},Jt=async e=>{let t=await Lt("/user_management/authenticate",JSON.stringify({grant_type:Ro,client_id:be,device_code:e}),"device token exchange");if(!t.ok)throw await Mt(t,"device token exchange");return Ft(t,rt,"device token exchange")};var re=e=>new Promise(t=>setTimeout(t,e)),Kt=async(e,t,n)=>{let o=Array.from({length:e.length}),r=0,s=async()=>{for(;;){let d=r++;if(d>=e.length)return;o[d]=await n(e[d],d);}};return await Promise.all(Array.from({length:Math.min(t,e.length)},s)),o};var zt=()=>{let e=process.env;return !(e.CI!==void 0||e.SSH_CONNECTION!==void 0||e.SSH_TTY!==void 0||process.stdout.isTTY!==true||process.platform==="linux"&&(e.DISPLAY===void 0&&e.WAYLAND_DISPLAY===void 0||existsSync("/.dockerenv")))},Po=e=>{switch(process.platform){case "darwin":return {command:"open",args:[e]};case "win32":return {command:"cmd",args:["/c","start","",e]};default:return {command:"xdg-open",args:[e]}}},Wt=async e=>{try{let{protocol:o}=new URL(e);if(o!=="https:"&&o!=="http:")return  false}catch{return  false}let{command:t,args:n}=Po(e);return new Promise(o=>{try{let r=spawn(t,[...n],{detached:true,stdio:"ignore"});r.on("error",()=>o(false)),r.unref(),setTimeout(()=>o(true),150).unref();}catch{o(false);}})};var _o="https://mynth.io/dashboard",Bt=e=>`${_o}/keys/${e}`,So=5e3,jo=5,Do=()=>`mynth-cli (${hostname()})`,No=async(e,t,n)=>{let o=t;for(;;){if(Date.now()>=n)throw new y("device code expired before approval");try{return await Jt(e)}catch(r){if(!(r instanceof O))throw r;if(r.code==="access_denied")throw new $("login was denied");if(r.code==="expired_token")throw new $("device code expired; run `mynth auth login` again");if(r.code!=="authorization_pending"&&r.code!=="slow_down")throw r;r.code==="slow_down"&&(o+=So),await re(o);}}},Lo=e=>new Command("login").description("Authenticate with Mynth and store a long-lived API key").option("--scopes <list>",`Comma-separated scopes for the created key (default: ${R.join(",")})`).option("--no-browser","Print the login URL instead of opening a browser").addOption(f()).action(async t=>{if(e.session.envApiKeySet)throw new $("MYNTH_API_KEY is set and takes precedence over login. Unset it to log in, or keep using the env API key.");let n=t.scopes!==void 0?t.scopes.split(",").map(P=>P.trim()).filter(Boolean):[...R],o=n.filter(P=>!R.includes(P));if(n.length===0||o.length>0)throw new $(`invalid --scopes: ${o.join(", ")||"empty"}. Valid scopes: ${R.join(", ")}`);let r=await Ut(),s=r.verification_uri_complete??r.verification_uri,d=r.verification_uri_complete!==void 0,c=t.browser!==false&&zt()?await Wt(s):false;a(""),a(`  ${c?"Opened":"Open"}: ${s}`),a(d?`  Check the page shows this code: ${r.user_code}`:`  Enter this code: ${r.user_code}`),a(""),a("Waiting for confirmation...");let h=await No(r.device_code,(r.interval??jo)*1e3,Date.now()+r.expires_in*1e3),v=Do(),w=await Et(e.api,{name:v,scopes:n,token:h.access_token});await e.session.save({kind:"api_key",api_key:w.raw,id:w.apiKey.id});let I=h.user?.email??h.user?.id??"unknown user";if(t.json){p({user:h.user?.id??null,apiKey:{id:w.apiKey.id,name:w.apiKey.name??v,keyPreview:w.apiKey.keyPreview,scopes:w.apiKey.scopes},storedAt:e.session.store.filePath});return}a(`${g.ok} Logged in as ${I}`),a(`  Created API key "${v}" with scopes: ${w.apiKey.scopes.join(", ")}`),a(`  Stored in ${e.session.store.filePath}`),a(`  Set a spending limit or change scopes: ${Bt(w.apiKey.id)}`);}),Mo=e=>new Command("logout").description("Revoke this machine's API key and clear local credentials").action(async()=>{let t=await e.session.status(),n=t.kind==="stored"?t.credentials.id:void 0,o=false;if(n!==void 0)try{await ne(e.api,n),o=true;}catch(r){T(`Warning: could not revoke API key ${n}: ${r.message}`),T(`Revoke it manually at ${Bt(n)}`);}await e.session.clear(),a(`${g.ok} Local credentials cleared${o?" and API key revoked":""}`),n===void 0&&t.kind==="stored"&&a("  The stored key was not created by `auth login`, so it was left active."),e.session.envApiKeySet&&a("Note: MYNTH_API_KEY is still set in your environment and will still be used.");}),Fo=e=>new Command("status").description("Show how this machine is authenticated, without calling the API").addOption(f()).action(async t=>{let n=await e.session.status();if(t.json){p({source:n.kind,...n.kind==="stored"?{apiKeyId:n.credentials.id??null,path:e.session.store.filePath}:{}});return}switch(n.kind){case "env":a("Authenticated via env: MYNTH_API_KEY");return;case "none":a("Not authenticated. Run `mynth auth login`, or set an API key.");return;case "stored":{let{id:o}=n.credentials;a("Authenticated via stored API key"),o!==void 0&&a(`  key:    ${o}`),a(`  stored: ${e.session.store.filePath}`),a("  Run `mynth whoami` for its current scopes and spending limit.");}}}),Re=e=>new Command("whoami").description("Print the active Mynth identity, verified against the API").addOption(f()).action(async t=>{let n=await e.session.status();if(n.kind==="none")throw new $("not authenticated: run `mynth auth login` or set MYNTH_API_KEY");let o=await oe(e.api);if(t.json){p({source:n.kind,...o});return}a(n.kind==="env"?"env:MYNTH_API_KEY":"api-key"),a(`  user:   ${o.userId}`),a(`  method: ${o.auth.method}`);let r=o.auth.apiKey;r!==void 0&&(a(`  key:    ${r.name??"unnamed"} (${r.keyPreview})`),r.scopes!==void 0&&r.scopes.length>0&&a(`  scopes: ${r.scopes.join(", ")}`),r.spending?.mode==="limited"&&a(`  spend:  $${r.spending.used} of $${r.spending.limit} per ${r.spending.period} ($${r.spending.remaining} left)`));}),Yt=e=>new Command("auth").description("Manage Mynth authentication").addCommand(Lo(e)).addCommand(Mo(e)).addCommand(Fo(e)).addCommand(Re(e));var Ht=e=>new Command("balance").description("Show account balance, and the active API key's spending limit").addOption(f()).action(async t=>{let n=await Dt(e.api),r=(await oe(e.api).catch(()=>{}))?.auth.apiKey?.spending;if(t.json){p({...n,...r!==void 0?{spending:r}:{}});return}if(a(`Balance:   $${n.balance}`),a(`Reserved:  $${n.reserved}`),a(`Available: $${n.available}`),r!==void 0){if(a(""),r.mode==="unlimited"){a("API key spending: unlimited");return}a(`API key limit: $${r.limit} / ${r.period}`),a(`  used:      $${r.used}`),a(`  remaining: $${r.remaining}`);}});var qt={".jpg":"image/jpeg",".jpeg":"image/jpeg",".png":"image/png",".webp":"image/webp"},Ce=Object.keys(qt),Ee=async()=>{try{let e="";process.stdin.setEncoding("utf8");for await(let t of process.stdin)e+=t;return e}catch(e){throw new y("could not read stdin",{cause:e})}},W=async e=>{if(e==="-")return Ee();try{return await readFile(e,"utf8")}catch(t){throw new l(`could not read ${e}: ${t.message}`)}},Vt=async e=>{let t=await W(e);try{return JSON.parse(t)}catch(n){throw new l(`invalid JSON in ${e}: ${n.message}`)}},Xt=async e=>{let t=extname(e).toLowerCase(),n=qt[t];if(n===void 0)throw new l(`unsupported image extension "${t}" for ${e} (allowed: ${Ce.join(", ")})`);let o;try{o=await readFile(e);}catch(r){throw new l(`could not read ${e}: ${r.message}`)}return new File([new Uint8Array(o)],basename(e),{type:n})};var Zt=e=>{let t=new Command("set").description("Set local CLI configuration");t.command("api-key").description("Save an existing Mynth API key to the credentials file").argument("<value>","API key value, or `-` to read it from stdin").action(async o=>{let r=(o==="-"?await Ee():o).trim();if(r.length===0)throw new l("API key is empty");await e.session.save({kind:"api_key",api_key:r}),a(`${g.ok} API key saved to ${e.session.store.filePath}`),e.session.envApiKeySet&&a("Note: MYNTH_API_KEY is also set in your environment and takes precedence.");});let n=new Command("unset").description("Unset local CLI configuration");return n.command("api-key").description("Clear stored Mynth credentials").action(async()=>{await e.session.clear(),a(`${g.ok} Stored credentials cleared`),a("This does not revoke the key; use `mynth auth logout` for a CLI-created key.");}),new Command("config").description("Manage local CLI configuration").addCommand(t).addCommand(n)};var Qt=e=>e.fetch("destination list","/destinations",z.array(U)),en=(e,t)=>e.fetch("destination fetch",`/destinations/${t}`,U),tn=(e,t)=>e.fetch("destination create","/destinations",U,{body:t}),nn=(e,t,n)=>e.fetch("destination update",`/destinations/${t}`,U,{method:"PUT",body:n}),on=(e,t,n)=>e.call("destination test",`/destinations/${t}/test`,{body:{path:n}}),rn=(e,t)=>e.call("destination delete",`/destinations/${t}`,{method:"DELETE"});var Oe=/^[a-z0-9-]+$/,_e=64,Bo=["bunny","r2","s3"],je=["de","uk","ny","la","sg","se","br","jh","syd"],Yo=["default","eu","fedramp"],Ho=(e,t)=>{if(e===void 0)throw new l(`${t} is required`);return e},B=(e,t,n)=>{if(t===void 0)throw new l(`--provider ${e} requires ${n}`);return t},Y=(e,t)=>t!==void 0?{[e]:t}:{},Go=(e,t)=>{switch(t){case "bunny":{let n=e.region;if(n!==void 0&&!je.includes(n))throw new l(`invalid bunny --region "${n}". One of: ${je.join(", ")}`);return {id:"bunny",storage_zone:B(t,e.storageZone,"--storage-zone"),...Y("region",n)}}case "r2":return {id:"r2",account_id:B(t,e.accountId,"--account-id"),bucket:B(t,e.bucket,"--bucket"),...Y("jurisdiction",e.jurisdiction)};case "s3":return {id:"s3",bucket:B(t,e.bucket,"--bucket"),region:B(t,e.region,"--region"),...Y("endpoint",e.endpoint),...Y("force_path_style",e.forcePathStyle)}}},qo=async(e,t)=>{let n=(await W(e)).trim();if(n.startsWith("{"))try{return JSON.parse(n)}catch(o){throw new l(`invalid JSON secret from ${e}: ${o.message}`)}if(t!=="bunny")throw new l(`--provider ${t} needs a JSON secret: { "access_key_id": "...", "secret_access_key": "..." }`);if(n.length===0)throw new l(`secret from ${e} is empty`);return {password:n}},Vo=e=>({path_template:Ho(e.pathTemplate,"--path-template"),...Y("url_template",e.urlTemplate)}),sn=async(e,t,n)=>{if(e.file!==void 0){if(e.provider!==void 0)throw new l("use either --file or the typed --provider flags, not both");let s=await Vt(e.file);if(s===null||typeof s!="object"||Array.isArray(s))throw new l(`${e.file} must contain a JSON object`);return {...s,...t}}let o=e.provider;if(o===void 0)throw new l("--provider or --file is required");let r=e.secret!==void 0?await qo(e.secret,o):void 0;if(r===void 0&&n)throw new l("--secret <path|-> is required (use `-` to read the secret from stdin)");return {...t,provider:Go(e,o),config:Vo(e),...r!==void 0?{secret:r}:{}}},dn=e=>e.addOption(new Option("--provider <id>","Storage provider. Required unless --file is used.").choices([...Bo])).option("--path-template <template>",'Object path template, e.g. "images/{id}"').option("--url-template <template>",'Public URL template; must contain {path}, e.g. "https://cdn.example.com/{path}"').option("--storage-zone <name>","bunny: storage zone name").option("--region <region>",`bunny: one of ${je.join(", ")}. s3: the bucket's region, e.g. us-east-1.`).option("--account-id <id>","r2: Cloudflare account ID").option("--bucket <name>","r2/s3: bucket name").addOption(new Option("--jurisdiction <name>","r2: data jurisdiction").choices([...Yo])).option("--endpoint <url>","s3: custom endpoint for S3-compatible storage").option("--force-path-style","s3: use path-style addressing instead of virtual-hosted").option("--secret <path>","Path to a JSON secret file, or `-` to read it from stdin. bunny also accepts a bare password.").option("--file <path>","Full destination JSON body, or `-` for stdin. Alternative to the flags above.").addOption(f()),Se=e=>{a(`Destination ${e.id}`),a(`  Name:     ${e.name}`),a(`  Provider: ${e.provider.id}`),e.config.path_template!==void 0&&a(`  Path:     ${e.config.path_template}`),e.config.url_template!==void 0&&a(`  URL:      ${e.config.url_template}`),a(`  Created:  ${e.createdAt}`),a(`  Updated:  ${e.updatedAt}`);},ln=e=>{let t=new Command("destination").description("Manage storage destinations that generated images are delivered to");t.command("list").description("List storage destinations").addOption(f()).action(async r=>{let s=await Qt(e.api);if(r.json){p(s);return}C(s,[{header:"ID",value:d=>d.id},{header:"Name",value:d=>d.name},{header:"Provider",value:d=>d.provider.id},{header:"Created",value:d=>d.createdAt}],"No destinations found.");}),t.command("get").description("Fetch a destination by ID").argument("<id>","Destination ID").addOption(f()).action(async(r,s)=>{let d=await en(e.api,r);if(s.json){p(d);return}Se(d);});let n=t.command("create").description("Create a storage destination").argument("<name>",`Destination slug: 1-${_e} chars, ${Oe.source}. Immutable.`);dn(n).action(async(r,s)=>{if(r.length>_e||!Oe.test(r))throw new l(`invalid destination name "${r}": expected 1-${_e} chars matching ${Oe.source}`);let d=await tn(e.api,await sn(s,{name:r},true));if(s.json){p(d);return}Se(d),a(""),a(`Next: verify the credentials with \`mynth destination test ${d.id}\``);});let o=t.command("update").description("Replace a destination's provider and config. The slug is immutable.").argument("<id>","Destination ID");return dn(o).action(async(r,s)=>{let d=await sn(s,{},false);delete d.name;let c=await nn(e.api,r,d);if(s.json){p(c);return}Se(c);}),t.command("test").description("Verify a destination's credentials by uploading a probe file").argument("<id>","Destination ID").option("--path <path>","Object path to write (defaults to a unique probe path)").addOption(f()).action(async(r,s)=>{let d=s.path??`mynth-cli-test/${Date.now()}.txt`;if(await on(e.api,r,d),s.json){p({id:r,path:d,ok:true});return}a(`${g.ok} Credentials valid (wrote ${d})`);}),t.command("delete").description("Delete a destination").argument("<id>","Destination ID").addOption(S()).addOption(f()).action(async(r,s)=>{if(s.yes!==true)throw new l("refusing to delete without --yes");if(await rn(e.api,r),s.json){p({deleted:r});return}a(`${g.ok} Deleted destination ${r}`);}),t};var cn=e=>{let t=new Command("docs").description("Read Mynth documentation (no authentication)");return t.command("get").description("Fetch a documentation page as Markdown").argument("<path>","Documentation path, without the .md suffix (e.g. guides/async-and-polling)").addOption(f()).action(async(n,o)=>{let r=await e.docs.get(n);if(o.json){p(r);return}a(r.content);}),t.command("list").description("Fetch the complete documentation index").addOption(f()).action(async n=>{let o=await e.docs.list();if(n.json){p({content:o});return}a(o);}),t};var Zo={4:"Production-ready",3:"Usable, with fixes",2:"Not fit for purpose",1:"Discard"},De=e=>e.type==="image.generate",ae=e=>{let t=vt.safeParse(e??{});return t.success?{...t.data,images:t.data.images??[]}:{images:[]}},Ne=e=>e.status==="success"?e.url??e.mynth_url??void 0:void 0,ie=e=>e.message!==void 0?`${e.code}: ${e.message}`:e.code,E=e=>{if(e.length!==0){a(`${g.ok} Uploaded ${F(e.length,"image")}`);for(let t of e)a(`  ${t.path} -> ${t.url}`);}},se=(e,t)=>{if(e.length!==0){a(""),a(`${g.ok} Saved ${F(e.length,"image")} to ${t}`);for(let n of e)a(`  ${n}`);}},pn=e=>{let{image:t}=e;a(`${g.ok} Removed background (task ${e.taskId})`),e.cost!==null&&a(`  Cost:  ${e.cost}`),a(`  Size:  ${t.size} ${t.format}`),a(""),a(`  ${g.ok} ${t.url??t.mynth_url}`),t.destination?.status==="failed"&&a(`      ${g.fail} destination ${t.destination.name}: ${ie(t.destination.error)}`);},Qo=e=>{let t=ae(e.result),n=t.images,o=n.filter(r=>r.status==="success").length;if(a(`${g.ok} Generated ${o}/${n.length} ${n.length===1?"image":"images"} (task ${e.id})`),t.model!==void 0&&a(`  Model: ${t.model}`),e.cost!==null&&a(`  Cost:  ${e.cost}`),t.magic_prompt!==void 0&&(a(""),a("Enhanced prompt (mynth):"),a(`  ${t.magic_prompt.positive}`),t.magic_prompt.negative&&a(`  negative: ${t.magic_prompt.negative}`)),n.length!==0){a("");for(let r of n){if(r.status==="failed"){a(`  ${g.fail} ${ie(r.error)}`);continue}let s=r.rating?.status==="success"?` [${r.rating.level}]`:"";a(`  ${g.ok} ${Ne(r)??"(no url)"}${s}`),r.destination?.status==="failed"&&a(`      ${g.fail} destination ${r.destination.name}: ${ie(r.destination.error)}`);}}},Le=e=>{if(a(`${V(e.status)} Task ${e.id}`),a(`  Type:    ${e.type}`),a(`  Status:  ${e.status}`),e.cost!==null&&a(`  Cost:    ${e.cost}`),a(`  Created: ${e.createdAt}`),a(`  Updated: ${e.updatedAt}`),e.errors!==null&&e.errors!==void 0&&e.errors.length>0){a(""),a("Errors:");for(let t of e.errors)a(`  ${g.fail} ${ie(t)}`);}e.result!==null&&e.result!==void 0&&(a(""),a("Result:"),a(tt(JSON.stringify(e.result,null,2))));},de=e=>{if(De(e)&&e.status==="completed"){Qo(e);return}Le(e);},le=e=>{let t=ae(e.result);return {taskId:e.id,status:e.status,images:t.images.map(n=>n.status==="success"?{status:"success",url:n.url??null,mynth_url:n.mynth_url??null,size:n.size,format:n.format,rating:n.rating,destination:n.destination}:{status:"failed",error:n.error}),...t.magic_prompt!==void 0?{magic_prompt:t.magic_prompt}:{},...e.cost!==null?{cost:e.cost}:{},...t.model!==void 0?{model:t.model}:{}}},mn=e=>{if(a(`${g.ok} Reviewed (task ${e.taskId})`),a(`  Score: ${e.score}/4 \u2014 ${Zo[e.score]??"unknown"}`),e.cost!==null&&a(`  Cost:  ${e.cost}`),a(`  ${e.url}`),e.summary.length>0&&(a(""),a("Summary"),a(`  ${e.summary}`)),e.findings.length>0){a(""),a(`Findings (${e.findings.length})`);for(let t of e.findings)a(`  \u2022 [${t.severity}] ${t.category} \u2014 ${t.finding}`),a(`    where: ${t.where}  (${t.confidence} confidence)`);}if(e.strengths.length>0){a(""),a(`Strengths (${e.strengths.length})`);for(let t of e.strengths)a(`  \u2022 ${t.strength}  (${t.confidence} confidence)`);}};var x=(e,t=[])=>[...t,e],Me=e=>t=>{let n=Number.parseInt(t,10);if(!Number.isInteger(n)||String(n)!==t)throw new l(`invalid ${e}: "${t}" (expected an integer)`);return n},Fe=e=>t=>{let n=Me(e)(t);if(n<=0)throw new l(`invalid ${e}: "${t}" (expected a positive integer)`);return n},ce=(e,t)=>{let n;try{n=JSON.parse(e);}catch(o){throw new l(`invalid JSON in ${t}: ${o.message}`)}if(n===null||typeof n!="object"||Array.isArray(n))throw new l(`${t} must be a JSON object`);return n},pe=e=>/^https?:\/\//i.test(e);var H=10,j=async(e,t)=>{if(t.length===0)throw new l("no files to upload");if(t.length>H)throw new l(`too many files: ${t.length} (max ${H})`);let n=new FormData;for(let r of await Promise.all(t.map(Xt)))n.append("images",r);let{urls:o}=await e.fetch("upload","/image/upload",gt,{body:n});if(o.length!==t.length)throw new l(`upload returned ${o.length} URLs for ${t.length} files`);return t.map((r,s)=>({path:r,url:o[s]}))},G=(e,t,n)=>e.fetch(`image ${t}`,`/image/${t}`,ft,{body:n}),un=(e,t)=>e.fetch("estimate","/image/generate/estimate",yt,{body:t});var Ue=1800*1e3,er=12e3,tr=2500,nr=5e3,or=500,rr=new Set([0,404,408,429]),ir=e=>e instanceof k&&(rr.has(e.status)||e.status>=500),ar=10,Je=(e,t)=>e.fetch("task fetch",`/tasks/${t}`,pt),fn=(e,t={})=>e.fetch("task list","/tasks",z.array(mt),{query:t}),sr=(e,t)=>e.fetch("task status",`/tasks/${t}/status`,z.object({status:X})).then(n=>n.status),yn=(e,t)=>e.fetch("task result",`/tasks/${t}/result`,ut),D=async(e,t,n=Ue)=>{let o=Date.now(),r=0;for(;;){try{let c=await sr(e,t);if(r=0,c!=="pending")return await Je(e,t)}catch(c){if(!ir(c)||++r>ar)throw c}let s=Date.now()-o;if(s>=n)throw new k(`task ${t} did not complete within ${Math.round(n/1e3)}s; it may still finish, check \`mynth task get ${t}\``,{status:0});let d=s<er?tr:nr;await re(d+Math.floor(Math.random()*or));}};var lr=["Priming the canvas","Summoning pixels","Mixing digital pigments","Whispering to the model","Dreaming up details","Sketching silhouettes","Arranging composition","Weaving light and shadow","Polishing reflections","Sculpting atmosphere","Tracing final strokes"],cr=2800,pr=e=>{let t=e.slice();for(let n=t.length-1;n>0;n--){let o=Math.floor(Math.random()*(n+1));[t[n],t[o]]=[t[o],t[n]];}return t},N=async(e,t={})=>{if(process.stderr.isTTY!==true)return e;let n=pr(t.messages??lr),o=0,r=dr({text:n[0]??"Working",stream:process.stderr}).start(),s=setInterval(()=>{o++,r.text=n[o%n.length]??"Working";},cr);try{return await e}finally{clearInterval(s),r.stop();}};var ue=2,ge=7,L=async(e,t)=>{if(pe(t))return {url:t,uploads:[]};let n=await j(e.api,[t]);return {url:n[0].url,uploads:n}},fe=e=>e.option("--destination <name>","Slug of a configured storage destination to deliver results to. Defaults to MYNTH_DESTINATION.").option("--webhook-url <url>","Deliver this task's events to this URL (repeatable, max 5)",x).option("--no-dashboard-webhooks","Skip dashboard-configured webhooks for this task"),ye=(e,t)=>{let n=t.destination??e.config.envDestination,o=t.webhookUrl??[],r=t.dashboardWebhooks===false,s=o.length===0&&!r?void 0:{...r?{dashboard:false}:{},...o.length>0?{custom:o.map(d=>({url:d}))}:{}};return {...n!==void 0?{destination:n}:{},...s!==void 0?{webhook:s}:{}}},he=async(e,t)=>{let n=await G(e.api,t.endpoint,{...t.body,access:{pat:{enabled:true}}}),o=n.access?.publicAccessToken;if(t.json){p({taskId:n.taskId,...n.estimatedCost!==void 0?{estimatedCost:n.estimatedCost}:{},...o!==void 0?{access:{publicAccessToken:o}}:{}});return}a(`${g.ok} Task created: ${n.taskId}`),o!==void 0&&a(`  Public access token: ${o}`),a(`  Await it with: mynth task wait ${n.taskId}`);},mr=z.array(z.object({value:z.string(),description:z.string()})),ur=e=>{let t=e.indexOf("=");if(t<=0)throw new l(`invalid --level "${e}": expected "value=description"`);let n={value:e.slice(0,t).trim(),description:e.slice(t+1).trim()};if(n.value.length===0||n.description.length===0)throw new l(`invalid --level "${e}": value and description must both be non-empty`);return n},hn=(e,t)=>{let n;try{n=JSON.parse(e);}catch(r){throw new l(`invalid JSON in ${t}: ${r.message}`)}let o=mr.safeParse(n);if(!o.success)throw new l(`invalid levels in ${t}: expected an array of { value, description }`);return o.data},we=async e=>{let t=e.level??[],n=[t.length>0?"--level":void 0,e.levelsFile!==void 0?"--levels-file":void 0,e.levelsJson!==void 0?"--levels-json":void 0].filter(s=>s!==void 0);if(n.length===0)return;if(n.length>1)throw new l(`conflicting level options: ${n.join(", ")} \u2014 use only one`);let o=t.length>0?t.map(ur):e.levelsFile!==void 0?hn(await W(e.levelsFile),e.levelsFile):hn(e.levelsJson??"[]","--levels-json");if(o.length<ue||o.length>ge)throw new l(`levels must have between ${ue} and ${ge} items (got ${o.length})`);let r=new Set;for(let s of o){if(r.has(s.value))throw new l(`duplicate level value: "${s.value}"`);r.add(s.value);}return o},gr=(e,t)=>{let n=ve(e);return new k(`${t} task ${e.id} failed${n!==void 0?` (${n})`:""}`,{status:0,...n!==void 0?{code:n}:{}})},M=async(e,t)=>{let n=await G(e.api,t.endpoint,t.body),o=D(e.api,n.taskId),r=t.quiet?await o:await N(o);if(r.status!=="completed")throw gr(r,t.endpoint);let s=t.schema.safeParse(r.result);if(!s.success)throw new k(`${t.endpoint} task ${r.id} returned an unexpected result`,{status:0,cause:s.error});return {taskId:r.id,cost:r.cost,result:s.data}};var yr=["low","high"],ze="Image URL (http/https), or a local image file to upload first",hr=e=>e.option("-l, --level <value>",`Custom rating level as "value=description" (repeatable, ${ue}-${ge} items). Example: -l safe="No explicit content" -l nsfw="Contains nudity"`,x).option("--levels-file <path>",'JSON file holding an array of { "value", "description" }, or `-` for stdin. Use when descriptions contain shell metacharacters.').option("--levels-json <json>","Inline JSON array of { value, description }."),wr=e=>{let t=new Command("rate").description("Classify an image against the default sfw/nsfw levels, or custom ones").argument("<image>",ze).addOption(f());return hr(t).action(async(n,o)=>{let r=await we(o),{url:s,uploads:d}=await L(e,n),{taskId:c,cost:h,result:v}=await M(e,{endpoint:"rate",body:r!==void 0?{url:s,mode:"custom",levels:r}:{url:s},schema:ht,quiet:o.json===true});if(o.json){p({taskId:c,cost:h,...v});return}E(d),a(`${g.ok} Rated (task ${c})`),a(`  ${v.level}  ${s}`);}),t},kr=e=>new Command("alt").description("Generate accessibility alt text for an image").argument("<image>",ze).addOption(f()).action(async(t,n)=>{let{url:o,uploads:r}=await L(e,t),{taskId:s,cost:d,result:c}=await M(e,{endpoint:"alt",body:{url:o},schema:wt,quiet:n.json===true});if(n.json){p({taskId:s,cost:d,...c});return}E(r),a(`${g.ok} Generated alt text (task ${s})`),a(`  ${c.alt}`),a(`  ${o}`);}),br=e=>new Command("review").description("Review image quality with a multi-model panel (score, findings, strengths)").argument("<image>",ze).addOption(new Option("--effort <level>",'"high" (default) runs five strong vision models; "low" runs three smaller ones for faster, cheaper triage').choices([...yr])).addOption(f()).action(async(t,n)=>{let{url:o,uploads:r}=await L(e,t),{taskId:s,cost:d,result:c}=await M(e,{endpoint:"review",body:{url:o,...n.effort!==void 0?{effort:n.effort}:{}},schema:kt,quiet:n.json===true});if(n.json){p({taskId:s,cost:d,...c});return}E(r),mn({taskId:s,cost:d,url:o,...c,findings:c.findings??[],strengths:c.strengths??[]});}),wn=e=>[wr(e),kr(e),br(e)];var xr=4,Tr=(e,t,n)=>{try{let o=new URL(e).pathname.split("/").filter(Boolean).pop();if(o!==void 0&&o.length>0)return decodeURIComponent(o)}catch{}return `${t}-${n}`},ke=async e=>{let t=resolve(e.directory);try{await mkdir(t,{recursive:true});}catch(n){throw new y(`could not create ${t}: ${n.message}`,{cause:n})}return Kt(e.urls,xr,async(n,o)=>{let r;try{r=await fetch(n);}catch(d){throw new y(`download failed for ${n}: ${d.message}`,{cause:d})}if(!r.ok)throw new y(`download failed for ${n} (${r.status})`);let s=join(t,Tr(n,e.fallbackPrefix,o));try{await writeFile(s,new Uint8Array(await r.arrayBuffer()));}catch(d){throw new y(`could not write ${s}: ${d.message}`,{cause:d})}return s})};var We=20,Pr=["png","jpg","webp"],Be=["auto","source","reference"],Or="https://dry-run.mynth.io/input",_r=e=>{let t=e.indexOf(":"),n,o=e;if(t>0&&!/^https?:/i.test(e)){let r=e.slice(0,t);if(!Be.includes(r))throw new l(`invalid --input role "${r}". Expected one of: ${Be.join(", ")}`);n=r,o=e.slice(t+1);}if(o.length===0)throw new l(`invalid --input "${e}": missing path or URL`);return {...n!==void 0?{role:n}:{},value:o,isLocalFile:!pe(o)}},Sr=async(e,t,n,o)=>{let r=await we(t),s=r!==void 0?{mode:"custom",levels:r}:t.contentRating===true?true:void 0,d=n.map(c=>({type:"image",...c.role!==void 0?{as:c.role}:{},source:{type:"url",url:c.isLocalFile?o.get(c.value)??Or:c.value}}));return {prompt:t.prompt??"",...t.model!==void 0?{model:t.model}:{},...t.negative!==void 0?{negative_prompt:t.negative}:{},...t.magicPrompt===true?{magic_prompt:true}:{},...t.size!==void 0?{size:t.size}:{},...t.count!==void 0?{count:t.count}:{},...t.format!==void 0?{output:{format:t.format}}:{},...d.length>0?{inputs:d}:{},...ye(e,t),...s!==void 0?{rating:s}:{},...t.metadata!==void 0?{metadata:ce(t.metadata,"--metadata")}:{}}},jr=(e,t)=>{let n=ae(e.result).images.map(Ne).filter(o=>o!==void 0);return n.length===0?Promise.resolve([]):ke({urls:n,directory:t,fallbackPrefix:e.id})},kn=e=>{let t=new Command("generate").description("Generate images with Mynth").addHelpText("after",`
-Browse models with: mynth models list`).option("-p, --prompt <text>","Text prompt describing the image to generate").option("-n, --negative <text>","Negative prompt: elements to exclude").option("--magic-prompt","Let Mynth expand the prompt before generating").option("-m, --model <id>",'Model ID (e.g. "black-forest-labs/flux.2-pro"). Default: auto').option("-s, --size <size>",'Size preset or aspect ratio: "square", "portrait", "landscape", "1:1", "16:9", "16:9_4k", "auto", ...').option("-c, --count <number>","Number of images to generate (default: 1)",Me("--count")).addOption(new Option("-f, --format <format>","Output image format").choices([...Pr])).option("-i, --input <value>",`Input image as "[role:]path-or-url" (repeatable, up to ${We}). Roles: ${Be.join(", ")}. Examples: -i ./img.jpg, -i source:https://example.com/a.png`,x).option("-o, --output-dir <dir>","Directory to save generated images into. Created if missing. Ignored with --async.").option("--metadata <json>","Inline JSON object attached to the task (max 2KB)").option("--content-rating","Classify each image with the default sfw/nsfw levels. For custom levels use --level.").option("-l, --level <value>",'Custom rating level as "value=description" (repeatable, 2-7)',x).option("--levels-file <path>","JSON file of custom rating levels, or `-` for stdin").option("--levels-json <json>","Inline JSON array of custom rating levels");return fe(t).option("--dry-run","Validate the request and print the estimated cost without generating").option("--async","Print the task ID immediately instead of waiting for the result").option("--detailed","Include the full task record in --json output").addOption(f()),t.action(async n=>{let o=n.input??[];if(o.length>We)throw new l(`too many --input values: ${o.length} (max ${We})`);let r=o.map(_r),s=[...new Set(r.filter(A=>A.isLocalFile).map(A=>A.value))],d=s.length>0&&n.dryRun!==true?await j(e.api,s):[],c=await Sr(e,n,r,new Map(d.map(A=>[A.path,A.url])));if(n.dryRun===true){let A=await un(e.api,c);if(n.json){p(A);return}let Yn=A.estimateKind==="upper_bound"?" (upper bound)":"";a(`${g.ok} Estimated cost: $${A.estimatedCost}${Yn}`);return}if(n.async===true){await he(e,{endpoint:"generate",body:c,json:n.json===true});return}let h=await G(e.api,"generate",c),v=D(e.api,h.taskId),w=n.json?await v:await N(v),I=n.outputDir!==void 0?resolve(n.outputDir):void 0,P=I!==void 0?await jr(w,I):[];if(n.json){let A=n.detailed===true?w:le(w);p(I!==void 0?{...A,downloadedFiles:P}:A);return}E(d),de(w),I!==void 0&&se(P,I);}),t};var Mr=["png","webp"],bn=e=>{let t=new Command("remove-background").description("Remove the background from an image. Mynth picks the model.").argument("<image>","Image URL (http/https), or a local image file to upload first").addOption(new Option("-f, --format <format>","Output format. Default: whatever the provider returns").choices([...Mr])).option("-o, --output-dir <dir>","Directory to save the result into. Created if missing. Ignored with --async.").option("--metadata <json>","Inline JSON object attached to the task (max 2KB)");return fe(t).option("--async","Print the task ID immediately instead of waiting for the result").addOption(f()),t.action(async(n,o)=>{let{url:r,uploads:s}=await L(e,n),d={url:r,...o.format!==void 0?{output:{format:o.format}}:{},...ye(e,o),...o.metadata!==void 0?{metadata:ce(o.metadata,"--metadata")}:{}};if(o.async===true){await he(e,{endpoint:"remove-background",body:d,json:o.json===true});return}let{taskId:c,cost:h,result:v}=await M(e,{endpoint:"remove-background",body:d,schema:At,quiet:o.json===true}),w=o.outputDir!==void 0?resolve(o.outputDir):void 0,I=w!==void 0?await ke({urls:[v.image.url??v.image.mynth_url],directory:w,fallbackPrefix:c}):[];if(o.json){p({taskId:c,cost:h,...v,...w!==void 0?{downloadedFiles:I}:{}});return}E(s),pn({taskId:c,cost:h,...v}),w!==void 0&&se(I,w);}),t};var vn=e=>new Command("upload").description("Upload local images to Mynth's temporary input storage").argument("<files...>",`Local image files (${Ce.join(", ")})`).addOption(f()).action(async(t,n)=>{if(t.length>H)throw new l(`too many files: ${t.length} (max ${H})`);let o=await j(e.api,t);if(n.json){p({images:o});return}a(`${g.ok} Uploaded ${F(o.length,"image")}`);for(let{path:r,url:s}of o)a(`  ${r}`),a(`    -> ${s}`);});var An=e=>{let t=new Command("image").description("Generate, upload, analyze, and remove backgrounds from images");t.addCommand(kn(e)),t.addCommand(vn(e)),t.addCommand(bn(e));for(let n of wn(e))t.addCommand(n);return t};var $n=e=>e.fetch("models list","/models",z.array(ct),{auth:false});var Rn={txt2img:"txt->img",img2img:"img->img",txt2vid:"txt->vid",img2vid:"img->vid"},Cn=e=>e.id.split("/")[0],Ye=e=>"perImage"in e,En=e=>e.type==="video"?"/s":"",Wr=e=>{let t=e.pricing;return t===null?[]:Ye(t)?[t.perImage.base]:Object.values(t.perSecond)},Pn=e=>{let t;for(let n of Wr(e)){let o=Number.parseFloat(n);Number.isFinite(o)&&(t===void 0||o<t.value)&&(t={raw:n,value:o});}return t},In=e=>Pn(e)?.value,Br=e=>{let t=Pn(e);return t===void 0?"-":`${t.raw}${En(e)}`},On=e=>{let t=e.pricing;if(t!==null)return Ye(t)?t.perImage["4k"]:t.perSecond["4k"]},Yr=e=>{let t=On(e);return t===void 0?"-":`${t}${En(e)}`},Hr=e=>{let t=e.pricing;if(!(t===null||!Ye(t)))return t.perInput},xn=e=>t=>{let n=Number.parseFloat(t);if(!Number.isFinite(n)||n<0)throw new l(`invalid ${e}: "${t}" (expected a non-negative number)`);return n},_n=.3,Gr=(e,t)=>Tn.go(t,e,{keys:["id","displayName"],threshold:_n}).map(n=>n.obj),qr=(e,t)=>{let n=[...new Set(e.map(Cn))];return n.includes(t)?new Set([t]):new Set(Tn.go(t,n,{threshold:_n}).map(o=>o.target))},Vr=(e,t)=>{let n=e;if(t.org!==void 0){let o=qr(n,t.org);n=n.filter(r=>o.has(Cn(r)));}if(t.type!==void 0){let o=t.type;n=n.filter(r=>r.type===o);}if(t["4k"]&&(n=n.filter(o=>On(o)!==void 0)),t.capability!==void 0){let o=Rn[t.capability];n=n.filter(r=>o in r.modes);}if(t.maxPrice!==void 0){let o=t.maxPrice;n=n.filter(r=>(In(r)??1/0)<=o);}if(t.minPrice!==void 0){let o=t.minPrice;n=n.filter(r=>(In(r)??-1/0)>=o);}return t.search!==void 0&&(n=Gr(n,t.search)),n},Sn=e=>{let t=new Command("models").description("Browse the public Mynth model catalog");return t.command("list").description("List available generation models and their pricing").option("-s, --search <query>","Fuzzy match against model ID (which includes the org) and name").option("--org <org>","Only models from this org, fuzzy matched (e.g. bfl, google)").option("--type <type>","Only models of this media type (image, video)").option("--max-price <usd>","Only models at or below this price (per image, or per second for video)",xn("--max-price")).option("--min-price <usd>","Only models at or above this price (per image, or per second for video)",xn("--min-price")).option("--4k","Only models with 4K pricing").addOption(new Option("--capability <capability>","Only models serving this generation mode").choices(Object.keys(Rn))).addOption(f()).action(async n=>{let o=Vr(await $n(e.api),n);if(n.json){p(o);return}C(o,[{header:"ID",value:r=>r.id},{header:"Name",value:r=>r.displayName??"-"},{header:"Type",value:r=>r.type},{header:"Modes",value:r=>Object.keys(r.modes).join(",")||"-"},{header:"Price",value:r=>Br(r)},{header:"4K",value:r=>Yr(r)},{header:"Input fee",value:r=>Hr(r)??"-"}],"No models matched the filters.");}),t};var jn=Ue/1e3,Zr=e=>e.option("--detailed","Include the full task record instead of a compact summary"),Dn=e=>{let t=new Command("task").description("Inspect and await Mynth tasks");t.command("get").description("Fetch a task by ID").argument("<id>","Task ID").addOption(f()).action(async(o,r)=>{let s=await Je(e.api,o);if(r.json){p(s);return}Le(s);}),t.command("result").description("Print a task's result payload as JSON").argument("<id>","Task ID").action(async o=>{p((await yn(e.api,o)).result);});let n=t.command("wait").description("Block until a task completes or fails, then print it").argument("<id>","Task ID").option("--timeout <seconds>",`Max seconds to wait before giving up (default: ${jn})`,Fe("--timeout")).addOption(f());return Zr(n).action(async(o,r)=>{let s=D(e.api,o,(r.timeout??jn)*1e3),d=r.json?await s:await N(s);if(d.status==="failed"&&(process.exitCode=et(d)),r.json){let c=!r.detailed&&De(d);p(c?le(d):d);return}de(d);}),t.command("list").description("List recent tasks, newest first").option("--limit <number>","Max tasks to return (1-100, default: 20)",Fe("--limit")).option("--after <id>","Cursor: return tasks created before this task ID").addOption(f()).action(async o=>{let r=await fn(e.api,{...o.limit!==void 0?{limit:o.limit}:{},...o.after!==void 0?{after:o.after}:{}});if(o.json){p({tasks:r});return}C(r,[{header:"",value:s=>V(s.status)},{header:"ID",value:s=>s.id},{header:"Type",value:s=>s.type},{header:"Status",value:s=>s.status},{header:"Cost",value:s=>s.cost??"-"},{header:"Created",value:s=>s.createdAt}],"No tasks found.");}),t};var Nn=(e,t)=>e.fetch("webhook create","/webhook",It,{body:t}),Ln=(e,t,n)=>e.fetch("webhook update",`/webhook/${t}`,xt,{method:"PUT",body:n}),Mn=(e,t)=>e.call("webhook delete",`/webhook/${t}`,{method:"DELETE"});var He=["task.completed","task.failed","task.image.generate.completed","task.image.generate.failed","task.image.rate.completed","task.image.rate.failed","task.image.alt.completed","task.image.alt.failed","task.image.review.completed","task.image.review.failed","task.image.remove_background.completed","task.image.remove_background.failed","task.video.generate.completed","task.video.generate.failed"],ei=e=>{if(e===void 0||e.length===0)throw new l("at least one --event is required");if(e.includes("all"))return "all";for(let t of e)if(!He.includes(t))throw new l(`unknown event "${t}". Valid events: all, ${He.join(", ")}`);return e},ti=e=>{if(e.enabled===true&&e.disabled===true)throw new l("--enabled and --disabled are mutually exclusive");return e.disabled!==true},Fn=e=>({enabled:ti(e),url:e.url,events:ei(e.event),...e.apiKeyId!==void 0?{apiKeyIds:e.apiKeyId}:{},...e.oauthEvents===true?{oauthEnabled:true}:{}}),Un=e=>Array.isArray(e)?e.join(", "):String(e),Jn=e=>e.requiredOption("--url <url>","Destination URL for webhook deliveries").option("-e, --event <name>",`Event to subscribe to (repeatable). Use \`all\` for every event. One of: ${He.join(", ")}`,x).option("--api-key-id <id>","Only deliver tasks created by this API key (repeatable). Omit to deliver for every key.",x).option("--oauth-events","Also deliver tasks created by OAuth sessions (this CLI, the playground). Off by default.").addOption(f()),Kn=e=>{let t=new Command("webhook").description("Manage registered webhooks"),n=t.command("create").description("Register a webhook. The signing secret is shown once, on success.").option("--disabled","Create the webhook disabled (default: enabled)");Jn(n).action(async r=>{let s=await Nn(e.api,Fn(r));if(r.json){p(s);return}a(`${g.ok} Webhook ${s.id} created`),a(`  URL:     ${s.url}`),a(`  Enabled: ${s.enabled}`),a(`  Events:  ${Un(s.events)}`),s.oauthEnabled!==void 0&&a(`  OAuth:   ${s.oauthEnabled}`),a(""),a(`  Signing secret: ${s.secret}`),a("  Save this now \u2014 it is shown only once and cannot be retrieved again.");});let o=t.command("update").description("Replace a webhook's configuration. Every field is sent, so pass them all.").argument("<id>","Webhook ID").option("--enabled","Enable the webhook").option("--disabled","Disable the webhook");return Jn(o).action(async(r,s)=>{let d=await Ln(e.api,r,Fn(s));if(s.json){p(d);return}a(`${g.ok} Webhook ${d.id} updated`),a(`  URL:     ${d.url}`),d.enabled!==void 0&&a(`  Enabled: ${d.enabled}`),a(`  Events:  ${Un(d.events)}`),d.oauthEnabled!==void 0&&a(`  OAuth:   ${d.oauthEnabled}`);}),t.command("delete").description("Delete a webhook").argument("<id>","Webhook ID").addOption(S()).addOption(f()).action(async(r,s)=>{if(s.yes!==true)throw new l("refusing to delete without --yes");if(await Mn(e.api,r),s.json){p({deleted:r});return}a(`${g.ok} Deleted webhook ${r}`);}),t};var ri=100,ii=`
+import chalk from "chalk";
+import { Command, Help, Option } from "commander";
+import { z } from "zod";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { basename, dirname, extname, join, resolve } from "node:path";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import ora from "ora";
+import fuzzysort from "fuzzysort";
+//#region src/config.ts
+/**
+* Build-time and environment configuration.
+*
+* `MYNTH_WORKOS_CLIENT_ID` and `MYNTH_CLI_VERSION` are replaced with string
+* literals by tsdown (see `tsdown.config.ts`), so the `process.env` lookups do
+* not exist in the published bundle and users cannot override them.
+*/
+const WORKOS_CLIENT_ID = "client_01KATK792RR5ZCHMF5YMNN1ZSE";
+/** Overridable so the device-login flow can be exercised against a test server. */
+const WORKOS_API_URL = process.env["MYNTH_WORKOS_API_URL"] ?? "https://api.workos.com";
+const CLI_VERSION = "0.0.23";
+const trimTrailingSlash = (url) => url.replace(/\/+$/, "");
+const nonEmpty = (value) => value !== void 0 && value.length > 0 ? value : void 0;
+const loadConfig = () => ({
+	apiUrl: trimTrailingSlash(process.env["MYNTH_API_URL"] ?? "https://api.mynth.io"),
+	docsUrl: trimTrailingSlash(process.env["MYNTH_DOCS_URL"] ?? "https://mynth.io/docs"),
+	envApiKey: nonEmpty(process.env["MYNTH_API_KEY"]),
+	envDestination: nonEmpty(process.env["MYNTH_DESTINATION"]),
+	debug: process.env["MYNTH_DEBUG"] === "1" || process.env["MYNTH_DEBUG"] === "true"
+});
+//#endregion
+//#region src/errors.ts
+/**
+* Stable exit-code contract so scripts and agents can branch without parsing
+* error prose. Documented in `mynth --help` and the README; keep all three in
+* sync.
+*/
+const EXIT_CODES = {
+	success: 0,
+	error: 1,
+	usage: 2,
+	auth: 3,
+	insufficientCredits: 4,
+	moderation: 5,
+	rateLimited: 6
+};
+var CliError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = new.target.name;
+	}
+};
+/** Bad arguments, flags, or local input. Exits 2. */
+var UsageError = class extends CliError {};
+/** Missing, invalid, or insufficient credentials. Exits 3. */
+var AuthError = class extends CliError {};
+/** A non-2xx API response, or a transport failure (`status: 0`). */
+var ApiError = class extends CliError {
+	status;
+	code;
+	constructor(message, options) {
+		super(message, options);
+		this.status = options.status;
+		this.code = options.code;
+	}
+};
+/** An OAuth device-flow response that the login loop reacts to by `code`. */
+var DeviceFlowError = class extends CliError {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+	}
+};
+const EXIT_BY_API_CODE = {
+	UNAUTHORIZED: EXIT_CODES.auth,
+	INSUFFICIENT_SCOPE: EXIT_CODES.auth,
+	VALIDATION_ERROR: EXIT_CODES.usage,
+	INSUFFICIENT_BALANCE: EXIT_CODES.insufficientCredits,
+	SPENDING_LIMIT_EXCEEDED: EXIT_CODES.insufficientCredits,
+	RESTRICTED_CONTENT: EXIT_CODES.moderation
+};
+const exitCodeForError = (error) => {
+	if (error instanceof UsageError) return EXIT_CODES.usage;
+	if (error instanceof AuthError) return EXIT_CODES.auth;
+	if (error instanceof ApiError) {
+		const byCode = error.code !== void 0 ? EXIT_BY_API_CODE[error.code] : void 0;
+		if (byCode !== void 0) return byCode;
+		if (error.status === 401 || error.status === 403) return EXIT_CODES.auth;
+		if (error.status === 429) return EXIT_CODES.rateLimited;
+		return EXIT_CODES.error;
+	}
+	const code = error?.code;
+	if (typeof code === "string" && code.startsWith("commander.")) return EXIT_CODES.usage;
+	return EXIT_CODES.error;
+};
+/**
+* A failed task carries codes at the task level and per generated item; a
+* moderation block anywhere means the request was moderated.
+*/
+const taskFailureCode = (task) => {
+	const result = task.result;
+	const codes = [...(task.errors ?? []).map((error) => error.code), ...(result?.images ?? []).map((image) => image["error"]?.code)].filter((code) => typeof code === "string");
+	return codes.find((code) => code === "RESTRICTED_CONTENT") ?? codes[0];
+};
+const exitCodeForFailedTask = (task) => taskFailureCode(task) === "RESTRICTED_CONTENT" ? EXIT_CODES.moderation : EXIT_CODES.error;
+//#endregion
+//#region src/output/print.ts
+const print = (message = "") => {
+	process.stdout.write(`${message}\n`);
+};
+const printErr = (message = "") => {
+	process.stderr.write(`${message}\n`);
+};
+const printJson = (value) => {
+	print(JSON.stringify(value, null, 2));
+};
+const glyph = {
+	ok: chalk.green("✓"),
+	fail: chalk.red("✗"),
+	pending: chalk.yellow("…")
+};
+const glyphForStatus = (status) => status === "completed" ? glyph.ok : status === "failed" ? glyph.fail : glyph.pending;
+const plural = (count, singular, suffix = "s") => `${count} ${singular}${count === 1 ? "" : suffix}`;
+const indent = (text, spaces = 2) => {
+	const pad = " ".repeat(spaces);
+	return text.split("\n").map((line) => `${pad}${line}`).join("\n");
+};
+//#endregion
+//#region src/api/schemas.ts
+/**
+* Zod mirrors of the Mynth API response shapes. Only the fields the CLI reads
+* are declared; unknown fields are ignored, so additive API changes never break
+* a released CLI.
+*/
+const jsonValue = z.lazy(() => z.union([
+	z.string(),
+	z.number(),
+	z.boolean(),
+	z.null(),
+	z.array(jsonValue),
+	z.record(jsonValue)
+]));
+/** Every API endpoint wraps its payload in `{ data: ... }`. */
+const envelope = (data) => z.object({ data });
+const workosUser = z.object({
+	id: z.string(),
+	email: z.string(),
+	first_name: z.string().nullable().optional(),
+	last_name: z.string().nullable().optional()
+});
+const deviceAuthorization = z.object({
+	device_code: z.string(),
+	user_code: z.string(),
+	verification_uri: z.string(),
+	verification_uri_complete: z.string().optional(),
+	expires_in: z.number(),
+	interval: z.number().optional()
+});
+const tokenResponse = z.object({
+	access_token: z.string(),
+	refresh_token: z.string(),
+	user: workosUser.optional()
+});
+const workosErrorResponse = z.object({
+	error: z.string().optional(),
+	error_description: z.string().optional(),
+	message: z.string().optional(),
+	code: z.string().optional()
+});
+/**
+* The only credential the CLI stores. `auth login` exchanges a short-lived
+* WorkOS session for a long-lived API key, so no OAuth token ever reaches disk
+* and there is nothing to refresh.
+*/
+const credentials = z.object({
+	kind: z.literal("api_key"),
+	api_key: z.string(),
+	/** Present when the CLI minted the key, so `auth logout` can revoke it. */
+	id: z.string().optional()
+});
+const API_KEY_SCOPES = [
+	"generate",
+	"manage",
+	"keys"
+];
+/** The raw key is returned exactly once, by the create endpoint. */
+const createdApiKey = z.object({
+	raw: z.string(),
+	apiKey: z.object({
+		id: z.string(),
+		name: z.string().optional(),
+		keyPreview: z.string(),
+		scopes: z.array(z.string())
+	})
+});
+/** Money fields come back as decimal strings, but tolerate numbers. */
+const decimal = z.union([z.string(), z.number()]).nullable().optional();
+const apiKey = z.object({
+	id: z.string(),
+	name: z.string().nullable(),
+	keyPreview: z.string(),
+	scopes: z.array(z.string()),
+	spendingLimit: decimal,
+	spendingLimitPeriod: z.string().nullable().optional(),
+	createdAt: z.string()
+});
+const apiKeySpending = z.union([z.object({ mode: z.literal("unlimited") }), z.object({
+	mode: z.literal("limited"),
+	limit: z.string(),
+	period: z.string(),
+	used: z.string(),
+	remaining: z.string()
+})]);
+const me = z.object({
+	userId: z.string(),
+	auth: z.object({
+		method: z.string(),
+		apiKey: z.object({
+			id: z.string(),
+			name: z.string().nullable(),
+			keyPreview: z.string(),
+			scopes: z.array(z.string()).optional(),
+			spending: apiKeySpending.optional()
+		}).optional()
+	})
+});
+const balance = z.object({
+	balance: z.string(),
+	reserved: z.string(),
+	available: z.string(),
+	currency: z.string()
+});
+const modelInputRule = z.object({
+	type: z.string(),
+	kind: z.string().optional(),
+	min: z.number().optional(),
+	max: z.number()
+});
+const modelMode = z.object({ inputs: z.object({
+	rules: z.array(modelInputRule),
+	maxTotal: z.number().optional()
+}).optional() });
+const imagePricing = z.object({
+	perImage: z.object({
+		base: z.string(),
+		"4k": z.string().optional()
+	}),
+	perInput: z.string().optional()
+});
+const videoPricing = z.object({
+	perSecond: z.record(z.string(), z.string()),
+	audio: z.object({ perSecond: z.string() }).optional()
+});
+/**
+* Media types, mode names, and input kinds are read as open strings for the same
+* reason task types are: the API adds them and a released CLI must still render
+* them. Only the pricing shapes are narrowed, because the two are read per key.
+*/
+const model = z.object({
+	id: z.string(),
+	displayName: z.string().nullable(),
+	type: z.string(),
+	modes: z.record(z.string(), modelMode),
+	pricing: z.union([imagePricing, videoPricing]).nullable()
+});
+const taskStatus = z.enum([
+	"pending",
+	"completed",
+	"failed"
+]);
+/**
+* Task types are not narrowed to a closed set: the API adds new ones (video,
+* and more later) and a released CLI must still render them.
+*/
+const task = z.object({
+	id: z.string(),
+	type: z.string(),
+	status: taskStatus,
+	userId: z.string().optional(),
+	apiKeyId: z.string().nullable().optional(),
+	cost: z.string().nullable(),
+	request: jsonValue.optional(),
+	result: jsonValue.nullable(),
+	errors: z.array(z.object({
+		code: z.string(),
+		message: z.string().optional()
+	})).nullish(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+const taskListItem = z.object({
+	id: z.string(),
+	type: z.string(),
+	status: z.string(),
+	cost: z.string().nullable(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+/** `GET /tasks/:id/result` — a lighter, PAT-readable view of a task. */
+const taskResult = z.object({
+	id: z.string(),
+	type: z.string(),
+	status: taskStatus,
+	result: jsonValue.nullable()
+});
+const uploadResult = z.object({ urls: z.array(z.string()) });
+/** Shared 201 envelope of every async create-task endpoint. */
+const createdTask = z.object({
+	taskId: z.string(),
+	estimatedCost: z.string().optional(),
+	access: z.object({ publicAccessToken: z.string() }).optional()
+});
+const estimate = z.object({
+	estimatedCost: z.string(),
+	currency: z.string(),
+	estimateKind: z.enum(["exact", "upper_bound"])
+});
+const imageRateResult = z.object({ level: z.string() });
+const imageAltResult = z.object({ alt: z.string() });
+const imageReviewResult = z.object({
+	score: z.number(),
+	summary: z.string(),
+	findings: z.array(z.object({
+		finding: z.string(),
+		category: z.string(),
+		severity: z.string(),
+		where: z.string(),
+		confidence: z.string()
+	})).optional(),
+	strengths: z.array(z.object({
+		strength: z.string(),
+		confidence: z.string()
+	})).optional()
+});
+const imageError = z.object({
+	code: z.string(),
+	message: z.string().optional()
+});
+const imageDestination = z.union([z.object({
+	status: z.literal("success"),
+	name: z.string()
+}), z.object({
+	status: z.literal("failed"),
+	name: z.string(),
+	error: imageError
+})]);
+const generatedImage = z.union([z.object({
+	status: z.literal("success"),
+	id: z.string().optional(),
+	url: z.string().nullable().optional(),
+	mynth_url: z.string().optional(),
+	size: z.string().optional(),
+	format: z.string().optional(),
+	rating: z.union([z.object({
+		status: z.literal("success"),
+		level: z.string()
+	}), z.object({
+		status: z.literal("failed"),
+		error: imageError
+	})]).optional(),
+	destination: imageDestination.optional()
+}), z.object({
+	status: z.literal("failed"),
+	error: imageError
+})]);
+const imageGenerateResult = z.object({
+	model: z.string().optional(),
+	images: z.array(generatedImage).optional(),
+	magic_prompt: z.object({
+		positive: z.string(),
+		negative: z.string().optional()
+	}).optional()
+});
+const imageRemoveBackgroundResult = z.object({ image: z.object({
+	id: z.string(),
+	url: z.string().nullable(),
+	mynth_url: z.string(),
+	size: z.string(),
+	format: z.string(),
+	destination: imageDestination.optional()
+}) });
+const destination = z.object({
+	id: z.string(),
+	name: z.string(),
+	provider: z.object({ id: z.string() }).catchall(jsonValue),
+	config: z.object({
+		path_template: z.string(),
+		url_template: z.string().optional()
+	}).partial(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+const webhookEvents = z.union([z.literal("all"), z.array(z.string())]);
+/** The HMAC signing secret is only ever returned by the create endpoint. */
+const createdWebhook = z.object({
+	id: z.string(),
+	enabled: z.boolean(),
+	url: z.string(),
+	secret: z.string(),
+	events: webhookEvents,
+	apiKeyIds: z.array(z.string()).nullish(),
+	oauthEnabled: z.boolean().optional(),
+	createdAt: z.string().optional()
+});
+const updatedWebhook = z.object({
+	id: z.string(),
+	enabled: z.boolean().optional(),
+	url: z.string(),
+	events: webhookEvents,
+	apiKeyIds: z.array(z.string()).nullish(),
+	oauthEnabled: z.boolean().optional()
+});
+//#endregion
+//#region src/api/client.ts
+const buildQuery = (query) => {
+	if (query === void 0) return "";
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(query)) if (value !== void 0) params.set(key, String(value));
+	return params.size > 0 ? `?${params}` : "";
+};
+const buildBody$1 = (body) => {
+	if (body === void 0) return { headers: {} };
+	if (body instanceof FormData) return {
+		body,
+		headers: {}
+	};
+	return {
+		body: JSON.stringify(body),
+		headers: { "Content-Type": "application/json" }
+	};
+};
+const readText = async (response) => {
+	try {
+		return await response.text();
+	} catch {
+		return "";
+	}
+};
+/**
+* Turns a non-2xx response into an `ApiError`, preserving the server's `code`
+* (UNAUTHORIZED, INSUFFICIENT_BALANCE, ...) so it can drive the exit code.
+*/
+const toApiError = async (response, label) => {
+	const text = await readText(response);
+	let code;
+	let message;
+	try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed.code === "string") code = parsed.code;
+		if (typeof parsed.message === "string") message = parsed.message;
+		else if (typeof parsed.error === "string") message = parsed.error;
+	} catch {}
+	return new ApiError(`${label} failed (${response.status}): ${message ?? text ?? "no body"}`, {
+		status: response.status,
+		...code !== void 0 ? { code } : {}
+	});
+};
+var ApiClient = class {
+	baseUrl;
+	tokens;
+	constructor(config, tokens) {
+		this.baseUrl = config.apiUrl;
+		this.tokens = tokens;
+	}
+	/** Performs a request and throws `ApiError` on transport failure or non-2xx. */
+	async send(label, path, options = {}) {
+		const response = await this.attempt(path, options);
+		if (response.ok) return response;
+		throw await toApiError(response, label);
+	}
+	/** Performs a request and parses the `{ data }` envelope with `schema`. */
+	async fetch(label, path, schema, options = {}) {
+		const response = await this.send(label, path, options);
+		let json;
+		try {
+			json = await response.json();
+		} catch (cause) {
+			throw new ApiError(`${label} returned invalid JSON: ${cause.message}`, {
+				status: response.status,
+				cause
+			});
+		}
+		const parsed = envelope(schema).safeParse(json);
+		if (!parsed.success) throw new ApiError(`${label} returned an unexpected response shape`, {
+			status: response.status,
+			cause: parsed.error
+		});
+		return parsed.data.data;
+	}
+	/** Performs a request whose success response has no body (204). */
+	async call(label, path, options = {}) {
+		await this.send(label, path, options);
+	}
+	async attempt(path, options) {
+		const { body, headers } = buildBody$1(options.body);
+		const auth = options.auth === false ? void 0 : options.token ?? await this.tokens.token();
+		try {
+			return await fetch(`${this.baseUrl}${path}${buildQuery(options.query)}`, {
+				method: options.method ?? (options.body !== void 0 ? "POST" : "GET"),
+				headers: {
+					...headers,
+					...auth !== void 0 ? { Authorization: `Bearer ${auth}` } : {}
+				},
+				...body !== void 0 ? { body } : {}
+			});
+		} catch (cause) {
+			throw new ApiError(`request to ${path} failed: ${cause.message}`, {
+				status: 0,
+				cause
+			});
+		}
+	}
+};
+//#endregion
+//#region src/api/docs.ts
+const MAX_PATH_LENGTH = 2048;
+const SAFE_SEGMENT = /^[A-Za-z0-9._~%-]+$/;
+/**
+* Documentation paths become URL path segments on the docs host, so they are
+* validated rather than escaped: no URLs, no queries, no traversal.
+*/
+const normalizePath = (raw) => {
+	const path = raw.trim();
+	if (path.length === 0) throw new UsageError("documentation path must not be empty");
+	if (path.length > MAX_PATH_LENGTH) throw new UsageError("documentation path is too long");
+	if (path.startsWith("//") || path.includes("://")) throw new UsageError("documentation path must be a path, not a URL");
+	if (/[?#\\]/.test(path)) throw new UsageError("documentation path must not contain a query, fragment, or backslash");
+	const trimmed = path.startsWith("/") ? path.slice(1) : path;
+	if (trimmed.endsWith(".md")) throw new UsageError("documentation path must not include the .md suffix");
+	const segments = trimmed.split("/");
+	if (segments.some((segment) => !SAFE_SEGMENT.test(segment) || segment === "." || segment === "..")) throw new UsageError("documentation path contains an invalid segment");
+	return segments.join("/");
+};
+const truncate = (body) => body.length > 500 ? `${body.slice(0, 500)}…` : body;
+const fetchText = async (url, label) => {
+	let response;
+	try {
+		response = await fetch(url);
+	} catch (cause) {
+		throw new ApiError(`${label} failed: ${cause.message}`, {
+			status: 0,
+			cause
+		});
+	}
+	const body = await response.text().catch(() => "");
+	if (!response.ok) throw new ApiError(`${label} failed (${response.status}): ${truncate(body) || "no body"}`, { status: response.status });
+	return body;
+};
+/** The docs site is public and served from its own host, so it bypasses ApiClient. */
+var DocsClient = class {
+	docsUrl;
+	constructor(docsUrl) {
+		this.docsUrl = docsUrl;
+	}
+	async get(path) {
+		const normalized = normalizePath(path);
+		const encoded = normalized.split("/").map(encodeURIComponent).join("/");
+		return {
+			path: normalized,
+			content: await fetchText(`${this.docsUrl}/${encoded}.md`, `docs fetch for ${normalized}`)
+		};
+	}
+	/** llms.txt lives at the site root by convention, whatever path the pages sit under. */
+	list() {
+		return fetchText(new URL("/llms.txt", this.docsUrl).href, "docs index fetch");
+	}
+};
+//#endregion
+//#region src/auth/credentials.ts
+const FILE_NAME = "credentials.json";
+const FILE_MODE = 384;
+/**
+* Credentials live in a `0600` file, the same as vercel, gcloud, npm and
+* wrangler.
+*
+* A system keychain was tried and removed. A keychain ACL binds to a code
+* signature, and there is no mynth binary to bind to — only a JS file run by
+* whichever `node` is on PATH. macOS therefore prompted on every read, which is
+* unanswerable for this CLI's main callers: agents, CI, containers and SSH. The
+* protection was close to nil anyway, since anything able to run `node` could
+* read the secret back out through the CLI itself.
+*/
+const configDir = () => {
+	const xdg = process.env["XDG_CONFIG_HOME"];
+	return join(xdg !== void 0 && xdg.length > 0 ? xdg : join(homedir(), ".config"), "mynth");
+};
+const exists = async (path) => {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var CredentialsStore = class {
+	filePath;
+	constructor() {
+		this.filePath = join(configDir(), FILE_NAME);
+	}
+	async get() {
+		if (!await exists(this.filePath)) return void 0;
+		let raw;
+		try {
+			raw = await readFile(this.filePath, "utf8");
+		} catch (cause) {
+			throw new CliError(`could not read ${this.filePath}: ${cause.message}`, { cause });
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch (cause) {
+			throw new CliError(`${this.filePath} is not valid JSON`, { cause });
+		}
+		const result = credentials.safeParse(parsed);
+		if (!result.success) throw new CliError(`${this.filePath} has an unexpected shape; run \`mynth auth login\``, { cause: result.error });
+		return result.data;
+	}
+	async set(credentials) {
+		try {
+			await mkdir(dirname(this.filePath), {
+				recursive: true,
+				mode: 448
+			});
+			const temporary = `${this.filePath}.${process.pid}.tmp`;
+			await writeFile(temporary, JSON.stringify(credentials), {
+				encoding: "utf8",
+				mode: FILE_MODE
+			});
+			await rename(temporary, this.filePath);
+		} catch (cause) {
+			throw new CliError(`could not write ${this.filePath}: ${cause.message}`, { cause });
+		}
+	}
+	async clear() {
+		try {
+			await rm(this.filePath, { force: true });
+		} catch (cause) {
+			throw new CliError(`could not delete ${this.filePath}: ${cause.message}`, { cause });
+		}
+	}
+};
+//#endregion
+//#region src/auth/session.ts
+/**
+* Resolves the API key for outgoing requests: `MYNTH_API_KEY` first, then the
+* stored key. Keys do not expire, so there is nothing to refresh and no expiry
+* to track.
+*/
+var Session = class {
+	store;
+	envApiKeySet;
+	cached;
+	config;
+	constructor(config) {
+		this.config = config;
+		this.store = new CredentialsStore();
+		this.envApiKeySet = config.envApiKey !== void 0;
+	}
+	async token() {
+		if (this.config.envApiKey !== void 0) return this.config.envApiKey;
+		if (this.cached !== void 0) return this.cached;
+		const stored = await this.read();
+		if (stored === void 0) throw new AuthError("not authenticated: run `mynth auth login` or set MYNTH_API_KEY");
+		this.cached = stored.api_key;
+		return this.cached;
+	}
+	async status() {
+		if (this.envApiKeySet) return { kind: "env" };
+		const stored = await this.read().catch(() => void 0);
+		return stored === void 0 ? { kind: "none" } : {
+			kind: "stored",
+			credentials: stored
+		};
+	}
+	async save(credentials) {
+		await this.store.set(credentials);
+		this.cached = void 0;
+	}
+	async clear() {
+		await this.store.clear();
+		this.cached = void 0;
+	}
+	async read() {
+		try {
+			return await this.store.get();
+		} catch (cause) {
+			throw new AuthError(`could not read stored credentials: ${cause.message}`, { cause });
+		}
+	}
+};
+//#endregion
+//#region src/app.ts
+const createApp = () => {
+	const config = loadConfig();
+	const session = new Session(config);
+	return {
+		config,
+		session,
+		api: new ApiClient(config, session),
+		docs: new DocsClient(config.docsUrl)
+	};
+};
+//#endregion
+//#region src/output/logo.ts
+/**
+* The mint sprig glyph from the web app (`apps/app` nav pixel glyph), drawn with
+* half-block characters so one terminal cell carries two vertically stacked
+* pixels — which is what makes the pixels come out square.
+*
+* Digits are palette indices, `.` is transparent: unpainted cells keep the
+* terminal's own background, so the glyph sits on light and dark themes alike.
+*/
+const MINT = [
+	"...........",
+	".....4.....",
+	"....343....",
+	".....2.....",
+	".344.2.443.",
+	"..4432344..",
+	".....2.....",
+	".233.2.332.",
+	"..3322233..",
+	".....1.....",
+	"..........."
+];
+/**
+* Mint (oklch hue 168) at four steps, same ramp as the web palette but with the
+* lightness range pulled in: the web's top shades are near-white and vanish on a
+* light terminal. These keep ≥2:1 contrast against both black and white.
+*/
+const PALETTE = {
+	"1": "#318267",
+	"2": "#00a27a",
+	"3": "#33bb92",
+	"4": "#6bd1ad"
+};
+const paint = (top, bottom) => {
+	const filled = (pixel) => pixel !== ".";
+	if (!filled(top) && !filled(bottom)) return " ";
+	if (chalk.level === 0) return filled(top) && filled(bottom) ? "█" : filled(top) ? "▀" : "▄";
+	if (!filled(bottom)) return chalk.hex(PALETTE[top])("▀");
+	if (!filled(top)) return chalk.hex(PALETTE[bottom])("▄");
+	if (top === bottom) return chalk.hex(PALETTE[top])("█");
+	return chalk.hex(PALETTE[top]).bgHex(PALETTE[bottom])("▀");
+};
+/** The glyph, at most 11 cells wide, one line per two grid rows. */
+const logo = () => {
+	const lines = [];
+	for (let row = 0; row < MINT.length; row += 2) {
+		const top = MINT[row];
+		const bottom = MINT[row + 1] ?? "";
+		let line = "";
+		for (let column = 0; column < top.length; column += 1) line += paint(top[column], bottom[column] ?? ".");
+		lines.push(line.trimEnd());
+	}
+	return lines.filter((line) => line.length > 0).join("\n");
+};
+//#endregion
+//#region src/api/api-keys.ts
+/**
+* Minting a key with `manage` or `keys` scope requires OAuth: the API rejects
+* scope escalation from an API-key session. `token` therefore carries the
+* short-lived access token from the device flow.
+*/
+const createApiKey = (client, args) => client.fetch("api key create", "/api-key", createdApiKey, {
+	body: {
+		name: args.name,
+		scopes: args.scopes
+	},
+	token: args.token
+});
+/**
+* Creates a key with the current session's credentials. An API-key session can
+* only ever mint `generate` keys; the API rejects anything wider with
+* SCOPE_ESCALATION and explains why.
+*/
+const createApiKeyAsSelf = (client, args) => client.fetch("api key create", "/api-key", createdApiKey, { body: {
+	name: args.name,
+	scopes: args.scopes
+} });
+const listApiKeys = (client) => client.fetch("api key list", "/api-key", z.array(apiKey));
+const deleteApiKey = (client, id) => client.call("api key delete", `/api-key/${id}`, { method: "DELETE" });
+//#endregion
+//#region src/output/table.ts
+/**
+* Renders left-aligned, space-padded columns. The last column is never padded,
+* so trailing whitespace never ends up in piped output.
+*/
+const printTable = (rows, columns, emptyMessage) => {
+	if (rows.length === 0) {
+		print(emptyMessage);
+		return;
+	}
+	const cells = rows.map((row) => columns.map((column) => column.value(row)));
+	const widths = columns.map((column, index) => Math.max(column.header.length, ...cells.map((cell) => cell[index].length)));
+	const line = (values) => values.map((value, index) => index === values.length - 1 ? value : value.padEnd(widths[index])).join("  ");
+	print(line(columns.map((column) => column.header)));
+	for (const cell of cells) print(line(cell));
+};
+//#endregion
+//#region src/commands/options.ts
+const jsonOption = () => new Option("--json", "Output machine-readable JSON instead of a human-readable summary");
+const yesOption = () => new Option("--yes", "Confirm the destructive action (required; there is no interactive prompt)");
+//#endregion
+//#region src/commands/api-key.ts
+const DEFAULT_SCOPES = ["generate"];
+const parseScopes = (raw) => {
+	if (raw === void 0) return DEFAULT_SCOPES;
+	const scopes = raw.split(",").map((scope) => scope.trim()).filter(Boolean);
+	const unknown = scopes.filter((scope) => !API_KEY_SCOPES.includes(scope));
+	if (scopes.length === 0 || unknown.length > 0) throw new UsageError(`invalid --scopes: ${unknown.join(", ") || "empty"}. Valid scopes: ${API_KEY_SCOPES.join(", ")}`);
+	return scopes;
+};
+const apiKeyCommand = (app) => {
+	const apiKey = new Command("api-key").description("Manage Mynth API keys");
+	apiKey.command("create").description("Create an API key. The key itself is shown once, on success.").argument("<name>", "Name for the key, e.g. the app or environment it belongs to").option("--scopes <list>", `Comma-separated scopes (default: ${DEFAULT_SCOPES.join(",")}). Widening beyond \`generate\` requires the dashboard: the API refuses scope escalation from a CLI session.`).addOption(jsonOption()).action(async (name, options) => {
+		const created = await createApiKeyAsSelf(app.api, {
+			name,
+			scopes: parseScopes(options.scopes)
+		});
+		if (options.json) {
+			printJson({
+				key: created.raw,
+				...created.apiKey
+			});
+			return;
+		}
+		print(`${glyph.ok} Created API key "${created.apiKey.name ?? name}"`);
+		print(`  ID:     ${created.apiKey.id}`);
+		print(`  Scopes: ${created.apiKey.scopes.join(", ")}`);
+		print("");
+		print(`  ${created.raw}`);
+		print("  Save this now — it is shown only once and cannot be retrieved again.");
+	});
+	apiKey.command("list").description("List active API keys").addOption(jsonOption()).action(async (options) => {
+		const keys = await listApiKeys(app.api);
+		if (options.json) {
+			printJson(keys);
+			return;
+		}
+		printTable(keys, [
+			{
+				header: "ID",
+				value: (key) => key.id
+			},
+			{
+				header: "Name",
+				value: (key) => key.name ?? "-"
+			},
+			{
+				header: "Preview",
+				value: (key) => key.keyPreview
+			},
+			{
+				header: "Scopes",
+				value: (key) => key.scopes.join(",")
+			},
+			{
+				header: "Limit",
+				value: (key) => key.spendingLimit === null || key.spendingLimit === void 0 ? "-" : `$${key.spendingLimit}/${key.spendingLimitPeriod ?? "period"}`
+			},
+			{
+				header: "Created",
+				value: (key) => key.createdAt
+			}
+		], "No API keys found.");
+	});
+	apiKey.command("delete").description("Revoke an API key").argument("<id>", "API key ID").addOption(yesOption()).addOption(jsonOption()).action(async (id, options) => {
+		if (options.yes !== true) throw new UsageError("refusing to delete without --yes");
+		await deleteApiKey(app.api, id);
+		if (options.json) {
+			printJson({ deleted: id });
+			return;
+		}
+		print(`${glyph.ok} Revoked API key ${id}`);
+	});
+	return apiKey;
+};
+//#endregion
+//#region src/api/account.ts
+const getMe = (client) => client.fetch("me", "/me", me);
+const getBalance = (client) => client.fetch("balance", "/balance", balance);
+//#endregion
+//#region src/auth/workos.ts
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const readJson = async (response) => {
+	try {
+		return await response.json();
+	} catch {
+		return {};
+	}
+};
+const post = async (path, body, label) => {
+	try {
+		return await fetch(`${WORKOS_API_URL}${path}`, {
+			method: "POST",
+			body,
+			headers: {
+				Accept: "application/json",
+				...typeof body === "string" ? { "Content-Type": "application/json" } : {}
+			}
+		});
+	} catch (cause) {
+		throw new CliError(`${label} failed: ${cause.message}`, { cause });
+	}
+};
+const failure = async (response, label) => {
+	const body = workosErrorResponse.catch({}).parse(await readJson(response));
+	return new DeviceFlowError(body.error ?? body.code ?? "workos_error", body.error_description ?? body.message ?? `${label} failed`);
+};
+const parse = async (response, schema, label) => {
+	const parsed = schema.safeParse(await readJson(response));
+	if (!parsed.success) throw new CliError(`${label} returned an unexpected response`, { cause: parsed.error });
+	return parsed.data;
+};
+/** Step 1: ask WorkOS for a user code and verification URL. */
+const requestDeviceAuthorization = async () => {
+	const response = await post("/user_management/authorize/device", new URLSearchParams({ client_id: WORKOS_CLIENT_ID }), "device authorization");
+	if (!response.ok) throw await failure(response, "device authorization");
+	return parse(response, deviceAuthorization, "device authorization");
+};
+/**
+* Step 2: exchange the device code for a session. Throws a `DeviceFlowError`
+* with `authorization_pending` / `slow_down` / `expired_token` /
+* `access_denied`, which the login loop uses to decide whether to keep waiting.
+*
+* The access token is used once, to mint an API key, and never stored.
+*/
+const exchangeDeviceCode = async (deviceCode) => {
+	const response = await post("/user_management/authenticate", JSON.stringify({
+		grant_type: DEVICE_GRANT,
+		client_id: WORKOS_CLIENT_ID,
+		device_code: deviceCode
+	}), "device token exchange");
+	if (!response.ok) throw await failure(response, "device token exchange");
+	return parse(response, tokenResponse, "device token exchange");
+};
+//#endregion
+//#region src/utils/async.ts
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Runs `fn` over `items` with at most `limit` in flight, preserving order. */
+const mapLimit = async (items, limit, fn) => {
+	const results = Array.from({ length: items.length });
+	let next = 0;
+	const worker = async () => {
+		while (true) {
+			const index = next++;
+			if (index >= items.length) return;
+			results[index] = await fn(items[index], index);
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+	return results;
+};
+//#endregion
+//#region src/utils/browser.ts
+/**
+* Whether this looks like a person at a graphical desktop. Deliberately
+* conservative: the login URL is always printed, so a false negative costs a
+* copy-paste, while a false positive fires a browser at an agent, a CI runner,
+* or someone's SSH session.
+*/
+const canOpenBrowser = () => {
+	const env = process.env;
+	if (env["CI"] !== void 0) return false;
+	if (env["SSH_CONNECTION"] !== void 0 || env["SSH_TTY"] !== void 0) return false;
+	if (process.stdout.isTTY !== true) return false;
+	if (process.platform === "linux") {
+		if (env["DISPLAY"] === void 0 && env["WAYLAND_DISPLAY"] === void 0) return false;
+		if (existsSync("/.dockerenv")) return false;
+	}
+	return true;
+};
+const opener = (url) => {
+	switch (process.platform) {
+		case "darwin": return {
+			command: "open",
+			args: [url]
+		};
+		case "win32": return {
+			command: "cmd",
+			args: [
+				"/c",
+				"start",
+				"",
+				url
+			]
+		};
+		default: return {
+			command: "xdg-open",
+			args: [url]
+		};
+	}
+};
+/**
+* Opens `url` in the default browser. Resolves false if it could not be
+* launched, so the caller falls back to printing the URL.
+*
+* The URL arrives in an HTTP response, so it is parsed and scheme-checked
+* before reaching a process, and passed as an argument rather than interpolated
+* into a shell command.
+*/
+const openInBrowser = async (url) => {
+	try {
+		const { protocol } = new URL(url);
+		if (protocol !== "https:" && protocol !== "http:") return false;
+	} catch {
+		return false;
+	}
+	const { command, args } = opener(url);
+	return new Promise((resolve) => {
+		try {
+			const child = spawn(command, [...args], {
+				detached: true,
+				stdio: "ignore"
+			});
+			child.on("error", () => resolve(false));
+			child.unref();
+			setTimeout(() => resolve(true), 150).unref();
+		} catch {
+			resolve(false);
+		}
+	});
+};
+//#endregion
+//#region src/commands/auth.ts
+const DASHBOARD_URL = "https://mynth.io/dashboard";
+const keyUrl = (id) => `${DASHBOARD_URL}/keys/${id}`;
+const SLOW_DOWN_STEP_MS = 5e3;
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const keyName = () => `mynth-cli (${hostname()})`;
+/**
+* Polls WorkOS until the user approves the device code in their browser.
+* `authorization_pending` and `slow_down` are the only codes worth waiting on.
+*/
+const awaitApproval = async (deviceCode, intervalMs, expiresAtMs) => {
+	let interval = intervalMs;
+	while (true) {
+		if (Date.now() >= expiresAtMs) throw new CliError("device code expired before approval");
+		try {
+			return await exchangeDeviceCode(deviceCode);
+		} catch (error) {
+			if (!(error instanceof DeviceFlowError)) throw error;
+			if (error.code === "access_denied") throw new AuthError("login was denied");
+			if (error.code === "expired_token") throw new AuthError("device code expired; run `mynth auth login` again");
+			if (error.code !== "authorization_pending" && error.code !== "slow_down") throw error;
+			if (error.code === "slow_down") interval += SLOW_DOWN_STEP_MS;
+			await sleep(interval);
+		}
+	}
+};
+/**
+* Logging in trades a WorkOS session for a long-lived API key and stores only
+* the key. WorkOS sessions cap out at 7 days (2 days idle) and their refresh
+* tokens rotate, which races when an agent runs commands concurrently; an API
+* key has neither problem, and can be inspected, limited and revoked from the
+* dashboard.
+*/
+const login = (app) => new Command("login").description("Authenticate with Mynth and store a long-lived API key").option("--scopes <list>", `Comma-separated scopes for the created key (default: ${API_KEY_SCOPES.join(",")})`).option("--no-browser", "Print the login URL instead of opening a browser").addOption(jsonOption()).action(async (options) => {
+	if (app.session.envApiKeySet) throw new AuthError("MYNTH_API_KEY is set and takes precedence over login. Unset it to log in, or keep using the env API key.");
+	const scopes = options.scopes !== void 0 ? options.scopes.split(",").map((scope) => scope.trim()).filter(Boolean) : [...API_KEY_SCOPES];
+	const unknown = scopes.filter((scope) => !API_KEY_SCOPES.includes(scope));
+	if (scopes.length === 0 || unknown.length > 0) throw new AuthError(`invalid --scopes: ${unknown.join(", ") || "empty"}. Valid scopes: ${API_KEY_SCOPES.join(", ")}`);
+	const device = await requestDeviceAuthorization();
+	const url = device.verification_uri_complete ?? device.verification_uri;
+	const prefilled = device.verification_uri_complete !== void 0;
+	const opened = options.browser !== false && canOpenBrowser() ? await openInBrowser(url) : false;
+	print("");
+	print(`  ${opened ? "Opened" : "Open"}: ${url}`);
+	print(prefilled ? `  Check the page shows this code: ${device.user_code}` : `  Enter this code: ${device.user_code}`);
+	print("");
+	print("Waiting for confirmation...");
+	const session = await awaitApproval(device.device_code, (device.interval ?? DEFAULT_POLL_INTERVAL_SECONDS) * 1e3, Date.now() + device.expires_in * 1e3);
+	const name = keyName();
+	const created = await createApiKey(app.api, {
+		name,
+		scopes,
+		token: session.access_token
+	});
+	await app.session.save({
+		kind: "api_key",
+		api_key: created.raw,
+		id: created.apiKey.id
+	});
+	const who = session.user?.email ?? session.user?.id ?? "unknown user";
+	if (options.json) {
+		printJson({
+			user: session.user?.id ?? null,
+			apiKey: {
+				id: created.apiKey.id,
+				name: created.apiKey.name ?? name,
+				keyPreview: created.apiKey.keyPreview,
+				scopes: created.apiKey.scopes
+			},
+			storedAt: app.session.store.filePath
+		});
+		return;
+	}
+	print(`${glyph.ok} Logged in as ${who}`);
+	print(`  Created API key "${name}" with scopes: ${created.apiKey.scopes.join(", ")}`);
+	print(`  Stored in ${app.session.store.filePath}`);
+	print(`  Set a spending limit or change scopes: ${keyUrl(created.apiKey.id)}`);
+});
+const logout = (app) => new Command("logout").description("Revoke this machine's API key and clear local credentials").action(async () => {
+	const status = await app.session.status();
+	const id = status.kind === "stored" ? status.credentials.id : void 0;
+	let revoked = false;
+	if (id !== void 0) try {
+		await deleteApiKey(app.api, id);
+		revoked = true;
+	} catch (error) {
+		printErr(`Warning: could not revoke API key ${id}: ${error.message}`);
+		printErr(`Revoke it manually at ${keyUrl(id)}`);
+	}
+	await app.session.clear();
+	print(`${glyph.ok} Local credentials cleared${revoked ? " and API key revoked" : ""}`);
+	if (id === void 0 && status.kind === "stored") print(`  The stored key was not created by \`auth login\`, so it was left active.`);
+	if (app.session.envApiKeySet) print("Note: MYNTH_API_KEY is still set in your environment and will still be used.");
+});
+const status = (app) => new Command("status").description("Show how this machine is authenticated, without calling the API").addOption(jsonOption()).action(async (options) => {
+	const current = await app.session.status();
+	if (options.json) {
+		printJson({
+			source: current.kind,
+			...current.kind === "stored" ? {
+				apiKeyId: current.credentials.id ?? null,
+				path: app.session.store.filePath
+			} : {}
+		});
+		return;
+	}
+	switch (current.kind) {
+		case "env":
+			print("Authenticated via env: MYNTH_API_KEY");
+			return;
+		case "none":
+			print("Not authenticated. Run `mynth auth login`, or set an API key.");
+			return;
+		case "stored": {
+			const { id } = current.credentials;
+			print("Authenticated via stored API key");
+			if (id !== void 0) print(`  key:    ${id}`);
+			print(`  stored: ${app.session.store.filePath}`);
+			print("  Run `mynth whoami` for its current scopes and spending limit.");
+		}
+	}
+});
+/**
+* Verifies credentials against the API, so a revoked key fails here instead of
+* part-way through a real command.
+*/
+const whoamiCommand = (app) => new Command("whoami").description("Print the active Mynth identity, verified against the API").addOption(jsonOption()).action(async (options) => {
+	const current = await app.session.status();
+	if (current.kind === "none") throw new AuthError("not authenticated: run `mynth auth login` or set MYNTH_API_KEY");
+	const me = await getMe(app.api);
+	if (options.json) {
+		printJson({
+			source: current.kind,
+			...me
+		});
+		return;
+	}
+	print(current.kind === "env" ? "env:MYNTH_API_KEY" : "api-key");
+	print(`  user:   ${me.userId}`);
+	print(`  method: ${me.auth.method}`);
+	const key = me.auth.apiKey;
+	if (key === void 0) return;
+	print(`  key:    ${key.name ?? "unnamed"} (${key.keyPreview})`);
+	if (key.scopes !== void 0 && key.scopes.length > 0) print(`  scopes: ${key.scopes.join(", ")}`);
+	if (key.spending?.mode === "limited") print(`  spend:  $${key.spending.used} of $${key.spending.limit} per ${key.spending.period} ($${key.spending.remaining} left)`);
+});
+const authCommand = (app) => new Command("auth").description("Manage Mynth authentication").addCommand(login(app)).addCommand(logout(app)).addCommand(status(app)).addCommand(whoamiCommand(app));
+//#endregion
+//#region src/commands/balance.ts
+/**
+* Spending limits live on `/me` (they belong to the API key, not the account),
+* so an API-key session fetches both and prints them together.
+*/
+const balanceCommand = (app) => new Command("balance").description("Show account balance, and the active API key's spending limit").addOption(jsonOption()).action(async (options) => {
+	const balance = await getBalance(app.api);
+	const spending = (await getMe(app.api).catch(() => void 0))?.auth.apiKey?.spending;
+	if (options.json) {
+		printJson({
+			...balance,
+			...spending !== void 0 ? { spending } : {}
+		});
+		return;
+	}
+	print(`Balance:   $${balance.balance}`);
+	print(`Reserved:  $${balance.reserved}`);
+	print(`Available: $${balance.available}`);
+	if (spending === void 0) return;
+	print("");
+	if (spending.mode === "unlimited") {
+		print("API key spending: unlimited");
+		return;
+	}
+	print(`API key limit: $${spending.limit} / ${spending.period}`);
+	print(`  used:      $${spending.used}`);
+	print(`  remaining: $${spending.remaining}`);
+});
+//#endregion
+//#region src/utils/files.ts
+const IMAGE_MIME_BY_EXTENSION = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp"
+};
+const SUPPORTED_IMAGE_EXTENSIONS = Object.keys(IMAGE_MIME_BY_EXTENSION);
+const readStdin = async () => {
+	try {
+		let data = "";
+		process.stdin.setEncoding("utf8");
+		for await (const chunk of process.stdin) data += chunk;
+		return data;
+	} catch (cause) {
+		throw new CliError("could not read stdin", { cause });
+	}
+};
+/** Reads a file, or stdin when `path` is `-`. */
+const readTextInput = async (path) => {
+	if (path === "-") return readStdin();
+	try {
+		return await readFile(path, "utf8");
+	} catch (cause) {
+		throw new UsageError(`could not read ${path}: ${cause.message}`);
+	}
+};
+const readJsonInput = async (path) => {
+	const contents = await readTextInput(path);
+	try {
+		return JSON.parse(contents);
+	} catch (cause) {
+		throw new UsageError(`invalid JSON in ${path}: ${cause.message}`);
+	}
+};
+const readImageFile = async (path) => {
+	const extension = extname(path).toLowerCase();
+	const mime = IMAGE_MIME_BY_EXTENSION[extension];
+	if (mime === void 0) throw new UsageError(`unsupported image extension "${extension}" for ${path} (allowed: ${SUPPORTED_IMAGE_EXTENSIONS.join(", ")})`);
+	let bytes;
+	try {
+		bytes = await readFile(path);
+	} catch (cause) {
+		throw new UsageError(`could not read ${path}: ${cause.message}`);
+	}
+	return new File([new Uint8Array(bytes)], basename(path), { type: mime });
+};
+//#endregion
+//#region src/commands/config.ts
+const configCommand = (app) => {
+	const set = new Command("set").description("Set local CLI configuration");
+	set.command("api-key").description("Save an existing Mynth API key to the credentials file").argument("<value>", "API key value, or `-` to read it from stdin").action(async (value) => {
+		const key = (value === "-" ? await readStdin() : value).trim();
+		if (key.length === 0) throw new UsageError("API key is empty");
+		await app.session.save({
+			kind: "api_key",
+			api_key: key
+		});
+		print(`${glyph.ok} API key saved to ${app.session.store.filePath}`);
+		if (app.session.envApiKeySet) print("Note: MYNTH_API_KEY is also set in your environment and takes precedence.");
+	});
+	const unset = new Command("unset").description("Unset local CLI configuration");
+	unset.command("api-key").description("Clear stored Mynth credentials").action(async () => {
+		await app.session.clear();
+		print(`${glyph.ok} Stored credentials cleared`);
+		print("This does not revoke the key; use `mynth auth logout` for a CLI-created key.");
+	});
+	return new Command("config").description("Manage local CLI configuration").addCommand(set).addCommand(unset);
+};
+//#endregion
+//#region src/api/destinations.ts
+const listDestinations = (client) => client.fetch("destination list", "/destinations", z.array(destination));
+const getDestination = (client, id) => client.fetch("destination fetch", `/destinations/${id}`, destination);
+const createDestination = (client, body) => client.fetch("destination create", "/destinations", destination, { body });
+const updateDestination = (client, id, body) => client.fetch("destination update", `/destinations/${id}`, destination, {
+	method: "PUT",
+	body
+});
+/** Writes a probe object; a credential problem surfaces as a non-2xx response. */
+const testDestination = (client, id, path) => client.call("destination test", `/destinations/${id}/test`, { body: { path } });
+const deleteDestination = (client, id) => client.call("destination delete", `/destinations/${id}`, { method: "DELETE" });
+//#endregion
+//#region src/commands/destination.ts
+const NAME_PATTERN = /^[a-z0-9-]+$/;
+const MAX_NAME_LENGTH = 64;
+const PROVIDER_IDS = [
+	"bunny",
+	"r2",
+	"s3"
+];
+const BUNNY_REGIONS = [
+	"de",
+	"uk",
+	"ny",
+	"la",
+	"sg",
+	"se",
+	"br",
+	"jh",
+	"syd"
+];
+const R2_JURISDICTIONS = [
+	"default",
+	"eu",
+	"fedramp"
+];
+const required = (value, flag) => {
+	if (value === void 0) throw new UsageError(`${flag} is required`);
+	return value;
+};
+const requireFor = (provider, value, flag) => {
+	if (value === void 0) throw new UsageError(`--provider ${provider} requires ${flag}`);
+	return value;
+};
+const optional = (key, value) => value !== void 0 ? { [key]: value } : {};
+const buildProvider = (options, provider) => {
+	switch (provider) {
+		case "bunny": {
+			const region = options.region;
+			if (region !== void 0 && !BUNNY_REGIONS.includes(region)) throw new UsageError(`invalid bunny --region "${region}". One of: ${BUNNY_REGIONS.join(", ")}`);
+			return {
+				id: "bunny",
+				storage_zone: requireFor(provider, options.storageZone, "--storage-zone"),
+				...optional("region", region)
+			};
+		}
+		case "r2": return {
+			id: "r2",
+			account_id: requireFor(provider, options.accountId, "--account-id"),
+			bucket: requireFor(provider, options.bucket, "--bucket"),
+			...optional("jurisdiction", options.jurisdiction)
+		};
+		case "s3": return {
+			id: "s3",
+			bucket: requireFor(provider, options.bucket, "--bucket"),
+			region: requireFor(provider, options.region, "--region"),
+			...optional("endpoint", options.endpoint),
+			...optional("force_path_style", options.forcePathStyle)
+		};
+	}
+};
+/**
+* Secrets are read from a file or stdin, never from argv, so they do not leak
+* into shell history or `ps` output. Bunny's single-field secret also accepts
+* the bare password.
+*/
+const readSecret = async (path, provider) => {
+	const raw = (await readTextInput(path)).trim();
+	if (raw.startsWith("{")) try {
+		return JSON.parse(raw);
+	} catch (cause) {
+		throw new UsageError(`invalid JSON secret from ${path}: ${cause.message}`);
+	}
+	if (provider !== "bunny") throw new UsageError(`--provider ${provider} needs a JSON secret: { "access_key_id": "...", "secret_access_key": "..." }`);
+	if (raw.length === 0) throw new UsageError(`secret from ${path} is empty`);
+	return { password: raw };
+};
+const buildConfig = (options) => ({
+	path_template: required(options.pathTemplate, "--path-template"),
+	...optional("url_template", options.urlTemplate)
+});
+/**
+* A destination body comes either wholesale from `--file` (scripting) or from
+* typed flags (interactive). Mixing the two would make precedence ambiguous.
+*/
+const buildBody = async (options, extra, secretRequired) => {
+	if (options.file !== void 0) {
+		if (options.provider !== void 0) throw new UsageError("use either --file or the typed --provider flags, not both");
+		const body = await readJsonInput(options.file);
+		if (body === null || typeof body !== "object" || Array.isArray(body)) throw new UsageError(`${options.file} must contain a JSON object`);
+		return {
+			...body,
+			...extra
+		};
+	}
+	const provider = options.provider;
+	if (provider === void 0) throw new UsageError("--provider or --file is required");
+	const secret = options.secret !== void 0 ? await readSecret(options.secret, provider) : void 0;
+	if (secret === void 0 && secretRequired) throw new UsageError("--secret <path|-> is required (use `-` to read the secret from stdin)");
+	return {
+		...extra,
+		provider: buildProvider(options, provider),
+		config: buildConfig(options),
+		...secret !== void 0 ? { secret } : {}
+	};
+};
+const addProviderOptions = (command) => command.addOption(new Option("--provider <id>", "Storage provider. Required unless --file is used.").choices([...PROVIDER_IDS])).option("--path-template <template>", "Object path template, e.g. \"images/{id}\"").option("--url-template <template>", "Public URL template; must contain {path}, e.g. \"https://cdn.example.com/{path}\"").option("--storage-zone <name>", "bunny: storage zone name").option("--region <region>", `bunny: one of ${BUNNY_REGIONS.join(", ")}. s3: the bucket's region, e.g. us-east-1.`).option("--account-id <id>", "r2: Cloudflare account ID").option("--bucket <name>", "r2/s3: bucket name").addOption(new Option("--jurisdiction <name>", "r2: data jurisdiction").choices([...R2_JURISDICTIONS])).option("--endpoint <url>", "s3: custom endpoint for S3-compatible storage").option("--force-path-style", "s3: use path-style addressing instead of virtual-hosted").option("--secret <path>", "Path to a JSON secret file, or `-` to read it from stdin. bunny also accepts a bare password.").option("--file <path>", "Full destination JSON body, or `-` for stdin. Alternative to the flags above.").addOption(jsonOption());
+const renderOne = (destination) => {
+	print(`Destination ${destination.id}`);
+	print(`  Name:     ${destination.name}`);
+	print(`  Provider: ${destination.provider.id}`);
+	if (destination.config.path_template !== void 0) print(`  Path:     ${destination.config.path_template}`);
+	if (destination.config.url_template !== void 0) print(`  URL:      ${destination.config.url_template}`);
+	print(`  Created:  ${destination.createdAt}`);
+	print(`  Updated:  ${destination.updatedAt}`);
+};
+const destinationCommand = (app) => {
+	const destination = new Command("destination").description("Manage storage destinations that generated images are delivered to");
+	destination.command("list").description("List storage destinations").addOption(jsonOption()).action(async (options) => {
+		const data = await listDestinations(app.api);
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		printTable(data, [
+			{
+				header: "ID",
+				value: (item) => item.id
+			},
+			{
+				header: "Name",
+				value: (item) => item.name
+			},
+			{
+				header: "Provider",
+				value: (item) => item.provider.id
+			},
+			{
+				header: "Created",
+				value: (item) => item.createdAt
+			}
+		], "No destinations found.");
+	});
+	destination.command("get").description("Fetch a destination by ID").argument("<id>", "Destination ID").addOption(jsonOption()).action(async (id, options) => {
+		const data = await getDestination(app.api, id);
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		renderOne(data);
+	});
+	const create = destination.command("create").description("Create a storage destination").argument("<name>", `Destination slug: 1-${MAX_NAME_LENGTH} chars, ${NAME_PATTERN.source}. Immutable.`);
+	addProviderOptions(create).action(async (name, options) => {
+		if (name.length > MAX_NAME_LENGTH || !NAME_PATTERN.test(name)) throw new UsageError(`invalid destination name "${name}": expected 1-${MAX_NAME_LENGTH} chars matching ${NAME_PATTERN.source}`);
+		const data = await createDestination(app.api, await buildBody(options, { name }, true));
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		renderOne(data);
+		print("");
+		print(`Next: verify the credentials with \`mynth destination test ${data.id}\``);
+	});
+	const update = destination.command("update").description("Replace a destination's provider and config. The slug is immutable.").argument("<id>", "Destination ID");
+	addProviderOptions(update).action(async (id, options) => {
+		const body = await buildBody(options, {}, false);
+		delete body["name"];
+		const data = await updateDestination(app.api, id, body);
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		renderOne(data);
+	});
+	destination.command("test").description("Verify a destination's credentials by uploading a probe file").argument("<id>", "Destination ID").option("--path <path>", "Object path to write (defaults to a unique probe path)").addOption(jsonOption()).action(async (id, options) => {
+		const path = options.path ?? `mynth-cli-test/${Date.now()}.txt`;
+		await testDestination(app.api, id, path);
+		if (options.json) {
+			printJson({
+				id,
+				path,
+				ok: true
+			});
+			return;
+		}
+		print(`${glyph.ok} Credentials valid (wrote ${path})`);
+	});
+	destination.command("delete").description("Delete a destination").argument("<id>", "Destination ID").addOption(yesOption()).addOption(jsonOption()).action(async (id, options) => {
+		if (options.yes !== true) throw new UsageError("refusing to delete without --yes");
+		await deleteDestination(app.api, id);
+		if (options.json) {
+			printJson({ deleted: id });
+			return;
+		}
+		print(`${glyph.ok} Deleted destination ${id}`);
+	});
+	return destination;
+};
+//#endregion
+//#region src/commands/docs.ts
+const docsCommand = (app) => {
+	const docs = new Command("docs").description("Read Mynth documentation (no authentication)");
+	docs.command("get").description("Fetch a documentation page as Markdown").argument("<path>", "Documentation path, without the .md suffix (e.g. concepts/tasks)").addOption(jsonOption()).action(async (path, options) => {
+		const page = await app.docs.get(path);
+		if (options.json) {
+			printJson(page);
+			return;
+		}
+		print(page.content);
+	});
+	docs.command("list").description("Fetch the complete documentation index").addOption(jsonOption()).action(async (options) => {
+		const content = await app.docs.list();
+		if (options.json) {
+			printJson({ content });
+			return;
+		}
+		print(content);
+	});
+	return docs;
+};
+//#endregion
+//#region src/output/render.ts
+/**
+* Renderers shared by the `image` and `task` commands, so `image generate` and
+* `task wait` print an identical result for the same task.
+*/
+/** Labels for the 1–4 review score scale (higher is better). */
+const REVIEW_SCORE_LABELS = {
+	4: "Production-ready",
+	3: "Usable, with fixes",
+	2: "Not fit for purpose",
+	1: "Discard"
+};
+const isImageGenerateTask = (task) => task.type === "image.generate";
+/** Parses `task.result` as an image generation result, tolerating older shapes. */
+const readImageGenerateResult = (result) => {
+	const parsed = imageGenerateResult.safeParse(result ?? {});
+	if (!parsed.success) return { images: [] };
+	return {
+		...parsed.data,
+		images: parsed.data.images ?? []
+	};
+};
+const imageUrl = (image) => image.status === "success" ? image.url ?? image.mynth_url ?? void 0 : void 0;
+const formatError = (error) => error.message !== void 0 ? `${error.code}: ${error.message}` : error.code;
+const renderUploads = (uploads) => {
+	if (uploads.length === 0) return;
+	print(`${glyph.ok} Uploaded ${plural(uploads.length, "image")}`);
+	for (const upload of uploads) print(`  ${upload.path} -> ${upload.url}`);
+};
+const renderDownloads = (files, directory) => {
+	if (files.length === 0) return;
+	print("");
+	print(`${glyph.ok} Saved ${plural(files.length, "image")} to ${directory}`);
+	for (const file of files) print(`  ${file}`);
+};
+const renderRemoveBackground = (removal) => {
+	const { image } = removal;
+	print(`${glyph.ok} Removed background (task ${removal.taskId})`);
+	if (removal.cost !== null) print(`  Cost:  ${removal.cost}`);
+	print(`  Size:  ${image.size} ${image.format}`);
+	print("");
+	print(`  ${glyph.ok} ${image.url ?? image.mynth_url}`);
+	if (image.destination?.status === "failed") print(`      ${glyph.fail} destination ${image.destination.name}: ${formatError(image.destination.error)}`);
+};
+const renderImageGenerateTask = (task) => {
+	const result = readImageGenerateResult(task.result);
+	const images = result.images;
+	const succeeded = images.filter((image) => image.status === "success").length;
+	print(`${glyph.ok} Generated ${succeeded}/${images.length} ${images.length === 1 ? "image" : "images"} (task ${task.id})`);
+	if (result.model !== void 0) print(`  Model: ${result.model}`);
+	if (task.cost !== null) print(`  Cost:  ${task.cost}`);
+	if (result.magic_prompt !== void 0) {
+		print("");
+		print("Enhanced prompt (mynth):");
+		print(`  ${result.magic_prompt.positive}`);
+		if (result.magic_prompt.negative) print(`  negative: ${result.magic_prompt.negative}`);
+	}
+	if (images.length === 0) return;
+	print("");
+	for (const image of images) {
+		if (image.status === "failed") {
+			print(`  ${glyph.fail} ${formatError(image.error)}`);
+			continue;
+		}
+		const rating = image.rating?.status === "success" ? ` [${image.rating.level}]` : "";
+		print(`  ${glyph.ok} ${imageUrl(image) ?? "(no url)"}${rating}`);
+		if (image.destination?.status === "failed") print(`      ${glyph.fail} destination ${image.destination.name}: ${formatError(image.destination.error)}`);
+	}
+};
+/** Fallback rendering for any task type the CLI has no bespoke renderer for. */
+const renderTask = (task) => {
+	print(`${glyphForStatus(task.status)} Task ${task.id}`);
+	print(`  Type:    ${task.type}`);
+	print(`  Status:  ${task.status}`);
+	if (task.cost !== null) print(`  Cost:    ${task.cost}`);
+	print(`  Created: ${task.createdAt}`);
+	print(`  Updated: ${task.updatedAt}`);
+	if (task.errors !== null && task.errors !== void 0 && task.errors.length > 0) {
+		print("");
+		print("Errors:");
+		for (const error of task.errors) print(`  ${glyph.fail} ${formatError(error)}`);
+	}
+	if (task.result !== null && task.result !== void 0) {
+		print("");
+		print("Result:");
+		print(indent(JSON.stringify(task.result, null, 2)));
+	}
+};
+/** `image generate` and `task wait` share this entry point. */
+const renderTaskResult = (task) => {
+	if (isImageGenerateTask(task) && task.status === "completed") {
+		renderImageGenerateTask(task);
+		return;
+	}
+	renderTask(task);
+};
+/** Compact JSON view of a generation task; `--detailed` prints the raw task. */
+const summarizeTask = (task) => {
+	const result = readImageGenerateResult(task.result);
+	return {
+		taskId: task.id,
+		status: task.status,
+		images: result.images.map((image) => image.status === "success" ? {
+			status: "success",
+			url: image.url ?? null,
+			mynth_url: image.mynth_url ?? null,
+			size: image.size,
+			format: image.format,
+			rating: image.rating,
+			destination: image.destination
+		} : {
+			status: "failed",
+			error: image.error
+		}),
+		...result.magic_prompt !== void 0 ? { magic_prompt: result.magic_prompt } : {},
+		...task.cost !== null ? { cost: task.cost } : {},
+		...result.model !== void 0 ? { model: result.model } : {}
+	};
+};
+const renderReview = (review) => {
+	print(`${glyph.ok} Reviewed (task ${review.taskId})`);
+	print(`  Score: ${review.score}/4 — ${REVIEW_SCORE_LABELS[review.score] ?? "unknown"}`);
+	if (review.cost !== null) print(`  Cost:  ${review.cost}`);
+	print(`  ${review.url}`);
+	if (review.summary.length > 0) {
+		print("");
+		print("Summary");
+		print(`  ${review.summary}`);
+	}
+	if (review.findings.length > 0) {
+		print("");
+		print(`Findings (${review.findings.length})`);
+		for (const item of review.findings) {
+			print(`  • [${item.severity}] ${item.category} — ${item.finding}`);
+			print(`    where: ${item.where}  (${item.confidence} confidence)`);
+		}
+	}
+	if (review.strengths.length > 0) {
+		print("");
+		print(`Strengths (${review.strengths.length})`);
+		for (const item of review.strengths) print(`  • ${item.strength}  (${item.confidence} confidence)`);
+	}
+};
+//#endregion
+//#region src/utils/parse.ts
+/** Commander reducer for repeatable options: `-e a -e b` -> `["a", "b"]`. */
+const collect = (value, previous = []) => [...previous, value];
+const parseInteger = (label) => (value) => {
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isInteger(parsed) || String(parsed) !== value) throw new UsageError(`invalid ${label}: "${value}" (expected an integer)`);
+	return parsed;
+};
+const parsePositiveInteger = (label) => (value) => {
+	const parsed = parseInteger(label)(value);
+	if (parsed <= 0) throw new UsageError(`invalid ${label}: "${value}" (expected a positive integer)`);
+	return parsed;
+};
+const parseJsonObject = (raw, origin) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (cause) {
+		throw new UsageError(`invalid JSON in ${origin}: ${cause.message}`);
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new UsageError(`${origin} must be a JSON object`);
+	return parsed;
+};
+const isHttpUrl = (value) => /^https?:\/\//i.test(value);
+/** Uploads local files to Mynth's temporary input storage and returns their URLs. */
+const uploadImages = async (client, paths) => {
+	if (paths.length === 0) throw new UsageError("no files to upload");
+	if (paths.length > 10) throw new UsageError(`too many files: ${paths.length} (max 10)`);
+	const form = new FormData();
+	for (const file of await Promise.all(paths.map(readImageFile))) form.append("images", file);
+	const { urls } = await client.fetch("upload", "/image/upload", uploadResult, { body: form });
+	if (urls.length !== paths.length) throw new UsageError(`upload returned ${urls.length} URLs for ${paths.length} files`);
+	return paths.map((path, index) => ({
+		path,
+		url: urls[index]
+	}));
+};
+/** POSTs a request body to an async image endpoint and returns the created task. */
+const createImageTask = (client, endpoint, body) => client.fetch(`image ${endpoint}`, `/image/${endpoint}`, createdTask, { body });
+/** Validates the request server-side and prices it without generating anything. */
+const estimateGeneration = (client, body) => client.fetch("estimate", "/image/generate/estimate", estimate, { body });
+//#endregion
+//#region src/api/tasks.ts
+const DEFAULT_WAIT_TIMEOUT_MS = 18e5;
+const FAST_PHASE_MS = 12e3;
+const FAST_INTERVAL_MS = 2500;
+const SLOW_INTERVAL_MS = 5e3;
+const JITTER_MS = 500;
+const RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
+	0,
+	404,
+	408,
+	429
+]);
+const isRetryable = (error) => error instanceof ApiError && (RETRYABLE_STATUSES.has(error.status) || error.status >= 500);
+const MAX_CONSECUTIVE_FAILURES = 10;
+const getTask = (client, id) => client.fetch("task fetch", `/tasks/${id}`, task);
+const listTasks = (client, query = {}) => client.fetch("task list", "/tasks", z.array(taskListItem), { query });
+/** Cache-backed; this is what polling loops hit. */
+const getTaskStatus = (client, id) => client.fetch("task status", `/tasks/${id}/status`, z.object({ status: taskStatus })).then((data) => data.status);
+/** Just the task's output — lighter than the full task record. */
+const getTaskResult = (client, id) => client.fetch("task result", `/tasks/${id}/result`, taskResult);
+/**
+* Polls until the task settles, then returns the full task. A `failed` task is
+* returned rather than thrown, so callers can render the failure and pick their
+* own exit code. Transient API failures are absorbed (see
+* `MAX_CONSECUTIVE_FAILURES`); the last one is rethrown once the budget is gone.
+*/
+const waitForTask = async (client, id, timeoutMs = DEFAULT_WAIT_TIMEOUT_MS) => {
+	const startedAt = Date.now();
+	let failures = 0;
+	while (true) {
+		try {
+			const status = await getTaskStatus(client, id);
+			failures = 0;
+			if (status !== "pending") return await getTask(client, id);
+		} catch (error) {
+			if (!isRetryable(error) || ++failures > MAX_CONSECUTIVE_FAILURES) throw error;
+		}
+		const elapsed = Date.now() - startedAt;
+		if (elapsed >= timeoutMs) throw new ApiError(`task ${id} did not complete within ${Math.round(timeoutMs / 1e3)}s; it may still finish, check \`mynth task get ${id}\``, { status: 0 });
+		await sleep((elapsed < FAST_PHASE_MS ? FAST_INTERVAL_MS : SLOW_INTERVAL_MS) + Math.floor(Math.random() * JITTER_MS));
+	}
+};
+//#endregion
+//#region src/output/spinner.ts
+const DEFAULT_MESSAGES = [
+	"Priming the canvas",
+	"Summoning pixels",
+	"Mixing digital pigments",
+	"Whispering to the model",
+	"Dreaming up details",
+	"Sketching silhouettes",
+	"Arranging composition",
+	"Weaving light and shadow",
+	"Polishing reflections",
+	"Sculpting atmosphere",
+	"Tracing final strokes"
+];
+const ROTATE_INTERVAL_MS = 2800;
+const shuffled = (items) => {
+	const copy = items.slice();
+	for (let i = copy.length - 1; i > 0; i--) {
+		const j = Math.floor(Math.random() * (i + 1));
+		[copy[i], copy[j]] = [copy[j], copy[i]];
+	}
+	return copy;
+};
+/**
+* Wraps a long-running promise in a spinner on stderr. A no-op when stderr is
+* not a TTY, so piped and `--json` output stays clean.
+*/
+const withSpinner = async (promise, options = {}) => {
+	if (process.stderr.isTTY !== true) return promise;
+	const messages = shuffled(options.messages ?? DEFAULT_MESSAGES);
+	let index = 0;
+	const spinner = ora({
+		text: messages[0] ?? "Working",
+		stream: process.stderr
+	}).start();
+	const rotate = setInterval(() => {
+		index++;
+		spinner.text = messages[index % messages.length] ?? "Working";
+	}, ROTATE_INTERVAL_MS);
+	try {
+		return await promise;
+	} finally {
+		clearInterval(rotate);
+		spinner.stop();
+	}
+};
+/**
+* Commands take an image as either a URL or a local path. A local path is
+* uploaded first; the uploads are returned so they can be reported.
+*/
+const resolveImage = async (app, input) => {
+	if (isHttpUrl(input)) return {
+		url: input,
+		uploads: []
+	};
+	const uploads = await uploadImages(app.api, [input]);
+	return {
+		url: uploads[0].url,
+		uploads
+	};
+};
+/** Destination and webhook flags shared by commands that create a deliverable image. */
+const addDeliveryOptions = (command) => command.option("--destination <name>", "Slug of a configured storage destination to deliver results to. Defaults to MYNTH_DESTINATION.").option("--webhook-url <url>", "Deliver this task's events to this URL (repeatable, max 5)", collect).option("--no-dashboard-webhooks", "Skip dashboard-configured webhooks for this task");
+/** Builds the `destination` and `webhook` request fields from the delivery flags. */
+const buildDelivery = (app, options) => {
+	const destination = options.destination ?? app.config.envDestination;
+	const custom = options.webhookUrl ?? [];
+	const disableDashboard = options.dashboardWebhooks === false;
+	const webhook = custom.length === 0 && !disableDashboard ? void 0 : {
+		...disableDashboard ? { dashboard: false } : {},
+		...custom.length > 0 ? { custom: custom.map((url) => ({ url })) } : {}
+	};
+	return {
+		...destination !== void 0 ? { destination } : {},
+		...webhook !== void 0 ? { webhook } : {}
+	};
+};
+/**
+* Creates a task without waiting and prints its ID. A public access token lets
+* browser or CI code poll the task without the API key, so it is requested here.
+*/
+const createTaskAsync = async (app, args) => {
+	const created = await createImageTask(app.api, args.endpoint, {
+		...args.body,
+		access: { pat: { enabled: true } }
+	});
+	const token = created.access?.publicAccessToken;
+	if (args.json) {
+		printJson({
+			taskId: created.taskId,
+			...created.estimatedCost !== void 0 ? { estimatedCost: created.estimatedCost } : {},
+			...token !== void 0 ? { access: { publicAccessToken: token } } : {}
+		});
+		return;
+	}
+	print(`${glyph.ok} Task created: ${created.taskId}`);
+	if (token !== void 0) print(`  Public access token: ${token}`);
+	print(`  Await it with: mynth task wait ${created.taskId}`);
+};
+const levelArray = z.array(z.object({
+	value: z.string(),
+	description: z.string()
+}));
+const parseLevelPair = (raw) => {
+	const separator = raw.indexOf("=");
+	if (separator <= 0) throw new UsageError(`invalid --level "${raw}": expected "value=description"`);
+	const level = {
+		value: raw.slice(0, separator).trim(),
+		description: raw.slice(separator + 1).trim()
+	};
+	if (level.value.length === 0 || level.description.length === 0) throw new UsageError(`invalid --level "${raw}": value and description must both be non-empty`);
+	return level;
+};
+const parseLevelsJson = (source, origin) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch (cause) {
+		throw new UsageError(`invalid JSON in ${origin}: ${cause.message}`);
+	}
+	const result = levelArray.safeParse(parsed);
+	if (!result.success) throw new UsageError(`invalid levels in ${origin}: expected an array of { value, description }`);
+	return result.data;
+};
+/**
+* Custom rating levels can come from repeated `--level value=description`, a
+* JSON file, or inline JSON — exactly one source at a time.
+*/
+const resolveLevels = async (options) => {
+	const pairs = options.level ?? [];
+	const sources = [
+		pairs.length > 0 ? "--level" : void 0,
+		options.levelsFile !== void 0 ? "--levels-file" : void 0,
+		options.levelsJson !== void 0 ? "--levels-json" : void 0
+	].filter((source) => source !== void 0);
+	if (sources.length === 0) return void 0;
+	if (sources.length > 1) throw new UsageError(`conflicting level options: ${sources.join(", ")} — use only one`);
+	const levels = pairs.length > 0 ? pairs.map(parseLevelPair) : options.levelsFile !== void 0 ? parseLevelsJson(await readTextInput(options.levelsFile), options.levelsFile) : parseLevelsJson(options.levelsJson ?? "[]", "--levels-json");
+	if (levels.length < 2 || levels.length > 7) throw new UsageError(`levels must have between 2 and 7 items (got ${levels.length})`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const level of levels) {
+		if (seen.has(level.value)) throw new UsageError(`duplicate level value: "${level.value}"`);
+		seen.add(level.value);
+	}
+	return levels;
+};
+const failedTaskError = (task, label) => {
+	const code = taskFailureCode(task);
+	return new ApiError(`${label} task ${task.id} failed${code !== void 0 ? ` (${code})` : ""}`, {
+		status: 0,
+		...code !== void 0 ? { code } : {}
+	});
+};
+/**
+* Creates a single-image task, waits for it, and validates its result. The
+* commands only differ by endpoint and result shape.
+*/
+const runImageTask = async (app, args) => {
+	const created = await createImageTask(app.api, args.endpoint, args.body);
+	const pending = waitForTask(app.api, created.taskId);
+	const task = args.quiet ? await pending : await withSpinner(pending);
+	if (task.status !== "completed") throw failedTaskError(task, args.endpoint);
+	const parsed = args.schema.safeParse(task.result);
+	if (!parsed.success) throw new ApiError(`${args.endpoint} task ${task.id} returned an unexpected result`, {
+		status: 0,
+		cause: parsed.error
+	});
+	return {
+		taskId: task.id,
+		cost: task.cost,
+		result: parsed.data
+	};
+};
+//#endregion
+//#region src/commands/image/analyze.ts
+const REVIEW_EFFORTS = ["low", "high"];
+const IMAGE_ARGUMENT_HELP = "Image URL (http/https), or a local image file to upload first";
+const addLevelOptions = (command) => command.option("-l, --level <value>", `Custom rating level as "value=description" (repeatable, 2-7 items). Example: -l safe="No explicit content" -l nsfw="Contains nudity"`, collect).option("--levels-file <path>", "JSON file holding an array of { \"value\", \"description\" }, or `-` for stdin. Use when descriptions contain shell metacharacters.").option("--levels-json <json>", "Inline JSON array of { value, description }.");
+const rateCommand = (app) => {
+	const rate = new Command("rate").description("Classify an image against the default sfw/nsfw levels, or custom ones").argument("<image>", IMAGE_ARGUMENT_HELP).addOption(jsonOption());
+	addLevelOptions(rate).action(async (input, options) => {
+		const levels = await resolveLevels(options);
+		const { url, uploads } = await resolveImage(app, input);
+		const { taskId, cost, result } = await runImageTask(app, {
+			endpoint: "rate",
+			body: levels !== void 0 ? {
+				url,
+				mode: "custom",
+				levels
+			} : { url },
+			schema: imageRateResult,
+			quiet: options.json === true
+		});
+		if (options.json) {
+			printJson({
+				taskId,
+				cost,
+				...result
+			});
+			return;
+		}
+		renderUploads(uploads);
+		print(`${glyph.ok} Rated (task ${taskId})`);
+		print(`  ${result.level}  ${url}`);
+	});
+	return rate;
+};
+const altCommand = (app) => new Command("alt").description("Generate accessibility alt text for an image").argument("<image>", IMAGE_ARGUMENT_HELP).addOption(jsonOption()).action(async (input, options) => {
+	const { url, uploads } = await resolveImage(app, input);
+	const { taskId, cost, result } = await runImageTask(app, {
+		endpoint: "alt",
+		body: { url },
+		schema: imageAltResult,
+		quiet: options.json === true
+	});
+	if (options.json) {
+		printJson({
+			taskId,
+			cost,
+			...result
+		});
+		return;
+	}
+	renderUploads(uploads);
+	print(`${glyph.ok} Generated alt text (task ${taskId})`);
+	print(`  ${result.alt}`);
+	print(`  ${url}`);
+});
+const reviewCommand = (app) => new Command("review").description("Review image quality with a multi-model panel (score, findings, strengths)").argument("<image>", IMAGE_ARGUMENT_HELP).addOption(new Option("--effort <level>", "\"high\" (default) runs five strong vision models; \"low\" runs three smaller ones for faster, cheaper triage").choices([...REVIEW_EFFORTS])).addOption(jsonOption()).action(async (input, options) => {
+	const { url, uploads } = await resolveImage(app, input);
+	const { taskId, cost, result } = await runImageTask(app, {
+		endpoint: "review",
+		body: {
+			url,
+			...options.effort !== void 0 ? { effort: options.effort } : {}
+		},
+		schema: imageReviewResult,
+		quiet: options.json === true
+	});
+	if (options.json) {
+		printJson({
+			taskId,
+			cost,
+			...result
+		});
+		return;
+	}
+	renderUploads(uploads);
+	renderReview({
+		taskId,
+		cost,
+		url,
+		...result,
+		findings: result.findings ?? [],
+		strengths: result.strengths ?? []
+	});
+});
+const analysisCommands = (app) => [
+	rateCommand(app),
+	altCommand(app),
+	reviewCommand(app)
+];
+//#endregion
+//#region src/utils/download.ts
+const CONCURRENCY = 4;
+const filenameFor = (url, fallbackPrefix, index) => {
+	try {
+		const last = new URL(url).pathname.split("/").filter(Boolean).pop();
+		if (last !== void 0 && last.length > 0) return decodeURIComponent(last);
+	} catch {}
+	return `${fallbackPrefix}-${index}`;
+};
+/** Downloads URLs into `directory`, creating it if needed. Returns file paths. */
+const downloadAll = async (args) => {
+	const directory = resolve(args.directory);
+	try {
+		await mkdir(directory, { recursive: true });
+	} catch (cause) {
+		throw new CliError(`could not create ${directory}: ${cause.message}`, { cause });
+	}
+	return mapLimit(args.urls, CONCURRENCY, async (url, index) => {
+		let response;
+		try {
+			response = await fetch(url);
+		} catch (cause) {
+			throw new CliError(`download failed for ${url}: ${cause.message}`, { cause });
+		}
+		if (!response.ok) throw new CliError(`download failed for ${url} (${response.status})`);
+		const path = join(directory, filenameFor(url, args.fallbackPrefix, index));
+		try {
+			await writeFile(path, new Uint8Array(await response.arrayBuffer()));
+		} catch (cause) {
+			throw new CliError(`could not write ${path}: ${cause.message}`, { cause });
+		}
+		return path;
+	});
+};
+//#endregion
+//#region src/commands/image/generate.ts
+const MAX_INPUTS = 20;
+const OUTPUT_FORMATS$1 = [
+	"png",
+	"jpg",
+	"webp"
+];
+const INPUT_ROLES = [
+	"auto",
+	"source",
+	"reference"
+];
+/**
+* Stands in for local files during `--dry-run`: the estimate only depends on
+* input count and roles, so nothing is uploaded.
+*/
+const DRY_RUN_INPUT_URL = "https://dry-run.mynth.io/input";
+/** Parses `[role:]path-or-url`. A bare `https://...` keeps its colon. */
+const parseInput = (raw) => {
+	const separator = raw.indexOf(":");
+	let role;
+	let value = raw;
+	if (separator > 0 && !/^https?:/i.test(raw)) {
+		const candidate = raw.slice(0, separator);
+		if (!INPUT_ROLES.includes(candidate)) throw new UsageError(`invalid --input role "${candidate}". Expected one of: ${INPUT_ROLES.join(", ")}`);
+		role = candidate;
+		value = raw.slice(separator + 1);
+	}
+	if (value.length === 0) throw new UsageError(`invalid --input "${raw}": missing path or URL`);
+	return {
+		...role !== void 0 ? { role } : {},
+		value,
+		isLocalFile: !isHttpUrl(value)
+	};
+};
+const buildRequest = async (app, options, inputs, uploadedByPath) => {
+	const levels = await resolveLevels(options);
+	const rating = levels !== void 0 ? {
+		mode: "custom",
+		levels
+	} : options.contentRating === true ? true : void 0;
+	const resolvedInputs = inputs.map((input) => ({
+		type: "image",
+		...input.role !== void 0 ? { as: input.role } : {},
+		source: {
+			type: "url",
+			url: input.isLocalFile ? uploadedByPath.get(input.value) ?? DRY_RUN_INPUT_URL : input.value
+		}
+	}));
+	return {
+		prompt: options.prompt,
+		...options.model !== void 0 ? { model: options.model } : {},
+		...options.negative !== void 0 ? { negative_prompt: options.negative } : {},
+		...options.magicPrompt === true ? { magic_prompt: true } : {},
+		...options.size !== void 0 ? { size: options.size } : {},
+		...options.count !== void 0 ? { count: options.count } : {},
+		...options.format !== void 0 ? { output: { format: options.format } } : {},
+		...resolvedInputs.length > 0 ? { inputs: resolvedInputs } : {},
+		...buildDelivery(app, options),
+		...rating !== void 0 ? { rating } : {},
+		...options.metadata !== void 0 ? { metadata: parseJsonObject(options.metadata, "--metadata") } : {}
+	};
+};
+const downloadImages = (task, directory) => {
+	const urls = readImageGenerateResult(task.result).images.map(imageUrl).filter((url) => url !== void 0);
+	return urls.length === 0 ? Promise.resolve([]) : downloadAll({
+		urls,
+		directory,
+		fallbackPrefix: task.id
+	});
+};
+const generateCommand = (app) => {
+	const generate = new Command("generate").description("Generate images with Mynth").addHelpText("after", "\nBrowse models with: mynth models list").requiredOption("-p, --prompt <text>", "Text prompt describing the image to generate").option("-n, --negative <text>", "Negative prompt: elements to exclude").option("--magic-prompt", "Let Mynth expand the prompt before generating").option("-m, --model <id>", "Model ID (e.g. \"black-forest-labs/flux.2-pro\"). Default: auto").option("-s, --size <size>", "Size preset or aspect ratio: \"square\", \"portrait\", \"landscape\", \"1:1\", \"16:9\", \"16:9_4k\", \"auto\", ...").option("-c, --count <number>", "Number of images to generate (default: 1)", parseInteger("--count")).addOption(new Option("-f, --format <format>", "Output image format").choices([...OUTPUT_FORMATS$1])).option("-i, --input <value>", `Input image as "[role:]path-or-url" (repeatable, up to ${MAX_INPUTS}). Roles: ${INPUT_ROLES.join(", ")}. Examples: -i ./img.jpg, -i source:https://example.com/a.png`, collect).option("-o, --output-dir <dir>", "Directory to save generated images into. Created if missing. Ignored with --async.").option("--metadata <json>", "Inline JSON object attached to the task (max 2KB)").option("--content-rating", "Classify each image with the default sfw/nsfw levels. For custom levels use --level.").option("-l, --level <value>", "Custom rating level as \"value=description\" (repeatable, 2-7)", collect).option("--levels-file <path>", "JSON file of custom rating levels, or `-` for stdin").option("--levels-json <json>", "Inline JSON array of custom rating levels");
+	addDeliveryOptions(generate).option("--dry-run", "Validate the request and print the estimated cost without generating").option("--async", "Print the task ID immediately instead of waiting for the result").option("--detailed", "Include the full task record in --json output").addOption(jsonOption());
+	generate.action(async (options) => {
+		const rawInputs = options.input ?? [];
+		if (rawInputs.length > MAX_INPUTS) throw new UsageError(`too many --input values: ${rawInputs.length} (max ${MAX_INPUTS})`);
+		const inputs = rawInputs.map(parseInput);
+		const localPaths = [...new Set(inputs.filter((input) => input.isLocalFile).map((input) => input.value))];
+		const uploads = localPaths.length > 0 && options.dryRun !== true ? await uploadImages(app.api, localPaths) : [];
+		const request = await buildRequest(app, options, inputs, new Map(uploads.map((upload) => [upload.path, upload.url])));
+		if (options.dryRun === true) {
+			const estimate = await estimateGeneration(app.api, request);
+			if (options.json) {
+				printJson(estimate);
+				return;
+			}
+			const qualifier = estimate.estimateKind === "upper_bound" ? " (upper bound)" : "";
+			print(`${glyph.ok} Estimated cost: $${estimate.estimatedCost}${qualifier}`);
+			return;
+		}
+		if (options.async === true) {
+			await createTaskAsync(app, {
+				endpoint: "generate",
+				body: request,
+				json: options.json === true
+			});
+			return;
+		}
+		const created = await createImageTask(app.api, "generate", request);
+		const pending = waitForTask(app.api, created.taskId);
+		const task = options.json ? await pending : await withSpinner(pending);
+		const outputDir = options.outputDir !== void 0 ? resolve(options.outputDir) : void 0;
+		const downloaded = outputDir !== void 0 ? await downloadImages(task, outputDir) : [];
+		if (options.json) {
+			const base = options.detailed === true ? task : summarizeTask(task);
+			printJson(outputDir !== void 0 ? {
+				...base,
+				downloadedFiles: downloaded
+			} : base);
+			return;
+		}
+		renderUploads(uploads);
+		renderTaskResult(task);
+		if (outputDir !== void 0) renderDownloads(downloaded, outputDir);
+	});
+	return generate;
+};
+//#endregion
+//#region src/commands/image/remove-background.ts
+const OUTPUT_FORMATS = ["png", "webp"];
+const removeBackgroundCommand = (app) => {
+	const command = new Command("remove-background").description("Remove the background from an image. Mynth picks the model.").argument("<image>", "Image URL (http/https), or a local image file to upload first").addOption(new Option("-f, --format <format>", "Output format. Default: whatever the provider returns").choices([...OUTPUT_FORMATS])).option("-o, --output-dir <dir>", "Directory to save the result into. Created if missing. Ignored with --async.").option("--metadata <json>", "Inline JSON object attached to the task (max 2KB)");
+	addDeliveryOptions(command).option("--async", "Print the task ID immediately instead of waiting for the result").addOption(jsonOption());
+	command.action(async (input, options) => {
+		const { url, uploads } = await resolveImage(app, input);
+		const body = {
+			url,
+			...options.format !== void 0 ? { output: { format: options.format } } : {},
+			...buildDelivery(app, options),
+			...options.metadata !== void 0 ? { metadata: parseJsonObject(options.metadata, "--metadata") } : {}
+		};
+		if (options.async === true) {
+			await createTaskAsync(app, {
+				endpoint: "remove-background",
+				body,
+				json: options.json === true
+			});
+			return;
+		}
+		const { taskId, cost, result } = await runImageTask(app, {
+			endpoint: "remove-background",
+			body,
+			schema: imageRemoveBackgroundResult,
+			quiet: options.json === true
+		});
+		const outputDir = options.outputDir !== void 0 ? resolve(options.outputDir) : void 0;
+		const downloaded = outputDir !== void 0 ? await downloadAll({
+			urls: [result.image.url ?? result.image.mynth_url],
+			directory: outputDir,
+			fallbackPrefix: taskId
+		}) : [];
+		if (options.json) {
+			printJson({
+				taskId,
+				cost,
+				...result,
+				...outputDir !== void 0 ? { downloadedFiles: downloaded } : {}
+			});
+			return;
+		}
+		renderUploads(uploads);
+		renderRemoveBackground({
+			taskId,
+			cost,
+			...result
+		});
+		if (outputDir !== void 0) renderDownloads(downloaded, outputDir);
+	});
+	return command;
+};
+//#endregion
+//#region src/commands/image/upload.ts
+const uploadCommand = (app) => new Command("upload").description("Upload local images to Mynth's temporary input storage").argument("<files...>", `Local image files (${SUPPORTED_IMAGE_EXTENSIONS.join(", ")})`).addOption(jsonOption()).action(async (files, options) => {
+	if (files.length > 10) throw new UsageError(`too many files: ${files.length} (max 10)`);
+	const uploaded = await uploadImages(app.api, files);
+	if (options.json) {
+		printJson({ images: uploaded });
+		return;
+	}
+	print(`${glyph.ok} Uploaded ${plural(uploaded.length, "image")}`);
+	for (const { path, url } of uploaded) {
+		print(`  ${path}`);
+		print(`    -> ${url}`);
+	}
+});
+//#endregion
+//#region src/commands/image/index.ts
+const imageCommand = (app) => {
+	const image = new Command("image").description("Generate, upload, analyze, and remove backgrounds from images");
+	image.addCommand(generateCommand(app));
+	image.addCommand(uploadCommand(app));
+	image.addCommand(removeBackgroundCommand(app));
+	for (const command of analysisCommands(app)) image.addCommand(command);
+	return image;
+};
+//#endregion
+//#region src/api/models.ts
+/** The model catalog is public — no credentials required. */
+const listModels = (client) => client.fetch("models list", "/models", z.array(model), { auth: false });
+//#endregion
+//#region src/commands/models.ts
+/** The catalog names modes `txt->img`; the flag spells them the way a shell can. */
+const MODE_BY_CAPABILITY = {
+	txt2img: "txt->img",
+	img2img: "img->img",
+	txt2vid: "txt->vid",
+	img2vid: "img->vid"
+};
+/** Model IDs are `org/name`, so the org is the id prefix — the API has no separate field. */
+const orgOf = (model) => model.id.split("/")[0];
+const isImagePricing = (pricing) => "perImage" in pricing;
+/** Image models are priced per image, video models per second of output. */
+const rateUnit = (model) => model.type === "video" ? "/s" : "";
+const rates = (model) => {
+	const pricing = model.pricing;
+	if (pricing === null) return [];
+	return isImagePricing(pricing) ? [pricing.perImage.base] : Object.values(pricing.perSecond);
+};
+/**
+* The cheapest rate a model charges, so one price column and one pair of price
+* filters span both media types. The raw string is kept for display, because it
+* carries the precision the catalog published.
+*/
+const cheapestRate = (model) => {
+	let best;
+	for (const raw of rates(model)) {
+		const value = Number.parseFloat(raw);
+		if (Number.isFinite(value) && (best === void 0 || value < best.value)) best = {
+			raw,
+			value
+		};
+	}
+	return best;
+};
+const basePrice = (model) => cheapestRate(model)?.value;
+const priceLabel = (model) => {
+	const rate = cheapestRate(model);
+	return rate === void 0 ? "-" : `${rate.raw}${rateUnit(model)}`;
+};
+const price4k = (model) => {
+	const pricing = model.pricing;
+	if (pricing === null) return void 0;
+	return isImagePricing(pricing) ? pricing.perImage["4k"] : pricing.perSecond["4k"];
+};
+const price4kLabel = (model) => {
+	const raw = price4k(model);
+	return raw === void 0 ? "-" : `${raw}${rateUnit(model)}`;
+};
+const inputFee = (model) => {
+	const pricing = model.pricing;
+	if (pricing === null || !isImagePricing(pricing)) return void 0;
+	return pricing.perInput;
+};
+const parsePrice = (label) => (value) => {
+	const parsed = Number.parseFloat(value);
+	if (!Number.isFinite(parsed) || parsed < 0) throw new UsageError(`invalid ${label}: "${value}" (expected a non-negative number)`);
+	return parsed;
+};
+/**
+* Fuzzy rather than substring so `bfl flux`, `qwen3`, or `gemini flash` all land
+* on the right model. Matching runs over the id and the display name; the id
+* carries the org, so one query covers both name and vendor.
+*
+* fuzzysort only scores targets the query is a subsequence of, so nonsense
+* matches nothing regardless of threshold. 0.3 exists solely to keep typos
+* (`sedream` scores 0.36) while intentional queries score 0.7-0.95.
+*/
+const SEARCH_THRESHOLD = .3;
+const search = (models, query) => fuzzysort.go(query, models, {
+	keys: ["id", "displayName"],
+	threshold: SEARCH_THRESHOLD
+}).map((result) => result.obj);
+/** `--org bfl` should find black-forest-labs, so the org is fuzzy-matched too. */
+const matchOrgs = (models, query) => {
+	const orgs = [...new Set(models.map(orgOf))];
+	if (orgs.includes(query)) return /* @__PURE__ */ new Set([query]);
+	return new Set(fuzzysort.go(query, orgs, { threshold: SEARCH_THRESHOLD }).map((r) => r.target));
+};
+const applyFilters = (models, flags) => {
+	let result = models;
+	if (flags.org !== void 0) {
+		const orgs = matchOrgs(result, flags.org);
+		result = result.filter((model) => orgs.has(orgOf(model)));
+	}
+	if (flags.type !== void 0) {
+		const type = flags.type;
+		result = result.filter((model) => model.type === type);
+	}
+	if (flags["4k"]) result = result.filter((model) => price4k(model) !== void 0);
+	if (flags.capability !== void 0) {
+		const mode = MODE_BY_CAPABILITY[flags.capability];
+		result = result.filter((model) => mode in model.modes);
+	}
+	if (flags.maxPrice !== void 0) {
+		const max = flags.maxPrice;
+		result = result.filter((model) => (basePrice(model) ?? Infinity) <= max);
+	}
+	if (flags.minPrice !== void 0) {
+		const min = flags.minPrice;
+		result = result.filter((model) => (basePrice(model) ?? -Infinity) >= min);
+	}
+	if (flags.search !== void 0) result = search(result, flags.search);
+	return result;
+};
+const modelsCommand = (app) => {
+	const models = new Command("models").description("Browse the public Mynth model catalog");
+	models.command("list").description("List available generation models and their pricing").option("-s, --search <query>", "Fuzzy match against model ID (which includes the org) and name").option("--org <org>", "Only models from this org, fuzzy matched (e.g. bfl, google)").option("--type <type>", "Only models of this media type (image, video)").option("--max-price <usd>", "Only models at or below this price (per image, or per second for video)", parsePrice("--max-price")).option("--min-price <usd>", "Only models at or above this price (per image, or per second for video)", parsePrice("--min-price")).option("--4k", "Only models with 4K pricing").addOption(new Option("--capability <capability>", "Only models serving this generation mode").choices(Object.keys(MODE_BY_CAPABILITY))).addOption(jsonOption()).action(async (options) => {
+		const data = applyFilters(await listModels(app.api), options);
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		printTable(data, [
+			{
+				header: "ID",
+				value: (model) => model.id
+			},
+			{
+				header: "Name",
+				value: (model) => model.displayName ?? "-"
+			},
+			{
+				header: "Type",
+				value: (model) => model.type
+			},
+			{
+				header: "Modes",
+				value: (model) => Object.keys(model.modes).join(",") || "-"
+			},
+			{
+				header: "Price",
+				value: (model) => priceLabel(model)
+			},
+			{
+				header: "4K",
+				value: (model) => price4kLabel(model)
+			},
+			{
+				header: "Input fee",
+				value: (model) => inputFee(model) ?? "-"
+			}
+		], "No models matched the filters.");
+	});
+	return models;
+};
+//#endregion
+//#region src/commands/task.ts
+const DEFAULT_WAIT_TIMEOUT_SECONDS = DEFAULT_WAIT_TIMEOUT_MS / 1e3;
+const detailedOption = (command) => command.option("--detailed", "Include the full task record instead of a compact summary");
+const taskCommand = (app) => {
+	const task = new Command("task").description("Inspect and await Mynth tasks");
+	task.command("get").description("Fetch a task by ID").argument("<id>", "Task ID").addOption(jsonOption()).action(async (id, options) => {
+		const data = await getTask(app.api, id);
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		renderTask(data);
+	});
+	task.command("result").description("Print a task's result payload as JSON").argument("<id>", "Task ID").action(async (id) => {
+		printJson((await getTaskResult(app.api, id)).result);
+	});
+	const wait = task.command("wait").description("Block until a task completes or fails, then print it").argument("<id>", "Task ID").option("--timeout <seconds>", `Max seconds to wait before giving up (default: ${DEFAULT_WAIT_TIMEOUT_SECONDS})`, parsePositiveInteger("--timeout")).addOption(jsonOption());
+	detailedOption(wait).action(async (id, options) => {
+		const pending = waitForTask(app.api, id, (options.timeout ?? DEFAULT_WAIT_TIMEOUT_SECONDS) * 1e3);
+		const data = options.json ? await pending : await withSpinner(pending);
+		if (data.status === "failed") process.exitCode = exitCodeForFailedTask(data);
+		if (options.json) {
+			const compact = !options.detailed && isImageGenerateTask(data);
+			printJson(compact ? summarizeTask(data) : data);
+			return;
+		}
+		renderTaskResult(data);
+	});
+	task.command("list").description("List recent tasks, newest first").option("--limit <number>", "Max tasks to return (1-100, default: 20)", parsePositiveInteger("--limit")).option("--after <id>", "Cursor: return tasks created before this task ID").addOption(jsonOption()).action(async (options) => {
+		const tasks = await listTasks(app.api, {
+			...options.limit !== void 0 ? { limit: options.limit } : {},
+			...options.after !== void 0 ? { after: options.after } : {}
+		});
+		if (options.json) {
+			printJson({ tasks });
+			return;
+		}
+		printTable(tasks, [
+			{
+				header: "",
+				value: (item) => glyphForStatus(item.status)
+			},
+			{
+				header: "ID",
+				value: (item) => item.id
+			},
+			{
+				header: "Type",
+				value: (item) => item.type
+			},
+			{
+				header: "Status",
+				value: (item) => item.status
+			},
+			{
+				header: "Cost",
+				value: (item) => item.cost ?? "-"
+			},
+			{
+				header: "Created",
+				value: (item) => item.createdAt
+			}
+		], "No tasks found.");
+	});
+	return task;
+};
+//#endregion
+//#region src/api/webhooks.ts
+const createWebhook = (client, body) => client.fetch("webhook create", "/webhook", createdWebhook, { body });
+const updateWebhook = (client, id, body) => client.fetch("webhook update", `/webhook/${id}`, updatedWebhook, {
+	method: "PUT",
+	body
+});
+const deleteWebhook = (client, id) => client.call("webhook delete", `/webhook/${id}`, { method: "DELETE" });
+//#endregion
+//#region src/commands/webhook.ts
+/** Mirrors `webhook_event` in the API's database schema, minus the `all` shorthand. */
+const SUBSCRIBABLE_EVENTS = [
+	"task.completed",
+	"task.failed",
+	"task.image.generate.completed",
+	"task.image.generate.failed",
+	"task.image.rate.completed",
+	"task.image.rate.failed",
+	"task.image.alt.completed",
+	"task.image.alt.failed",
+	"task.image.review.completed",
+	"task.image.review.failed",
+	"task.image.remove_background.completed",
+	"task.image.remove_background.failed",
+	"task.video.generate.completed",
+	"task.video.generate.failed"
+];
+/**
+* `all` is a server-side shorthand and must be the whole subscription; every
+* other value is checked here so a typo fails before the request.
+*/
+const resolveEvents = (raw) => {
+	if (raw === void 0 || raw.length === 0) throw new UsageError("at least one --event is required");
+	if (raw.includes("all")) return "all";
+	for (const event of raw) if (!SUBSCRIBABLE_EVENTS.includes(event)) throw new UsageError(`unknown event "${event}". Valid events: all, ${SUBSCRIBABLE_EVENTS.join(", ")}`);
+	return raw;
+};
+const resolveEnabled = (options) => {
+	if (options.enabled === true && options.disabled === true) throw new UsageError("--enabled and --disabled are mutually exclusive");
+	return options.disabled !== true;
+};
+const toBody = (options) => ({
+	enabled: resolveEnabled(options),
+	url: options.url,
+	events: resolveEvents(options.event),
+	...options.apiKeyId !== void 0 ? { apiKeyIds: options.apiKeyId } : {},
+	...options.oauthEvents === true ? { oauthEnabled: true } : {}
+});
+const eventsLabel = (events) => Array.isArray(events) ? events.join(", ") : String(events);
+const addSharedOptions = (command) => command.requiredOption("--url <url>", "Destination URL for webhook deliveries").option("-e, --event <name>", `Event to subscribe to (repeatable). Use \`all\` for every event. One of: ${SUBSCRIBABLE_EVENTS.join(", ")}`, collect).option("--api-key-id <id>", "Only deliver tasks created by this API key (repeatable). Omit to deliver for every key.", collect).option("--oauth-events", "Also deliver tasks that have no API key, such as playground runs. Off by default.").addOption(jsonOption());
+const webhookCommand = (app) => {
+	const webhook = new Command("webhook").description("Manage registered webhooks");
+	const create = webhook.command("create").description("Register a webhook. The signing secret is shown once, on success.").option("--disabled", "Create the webhook disabled (default: enabled)");
+	addSharedOptions(create).action(async (options) => {
+		const data = await createWebhook(app.api, toBody(options));
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		print(`${glyph.ok} Webhook ${data.id} created`);
+		print(`  URL:     ${data.url}`);
+		print(`  Enabled: ${data.enabled}`);
+		print(`  Events:  ${eventsLabel(data.events)}`);
+		if (data.oauthEnabled !== void 0) print(`  OAuth:   ${data.oauthEnabled}`);
+		print("");
+		print(`  Signing secret: ${data.secret}`);
+		print("  Save this now — it is shown only once and cannot be retrieved again.");
+	});
+	const update = webhook.command("update").description("Replace a webhook's configuration. Every field is sent, so pass them all.").argument("<id>", "Webhook ID").option("--enabled", "Enable the webhook").option("--disabled", "Disable the webhook");
+	addSharedOptions(update).action(async (id, options) => {
+		const data = await updateWebhook(app.api, id, toBody(options));
+		if (options.json) {
+			printJson(data);
+			return;
+		}
+		print(`${glyph.ok} Webhook ${data.id} updated`);
+		print(`  URL:     ${data.url}`);
+		if (data.enabled !== void 0) print(`  Enabled: ${data.enabled}`);
+		print(`  Events:  ${eventsLabel(data.events)}`);
+		if (data.oauthEnabled !== void 0) print(`  OAuth:   ${data.oauthEnabled}`);
+	});
+	webhook.command("delete").description("Delete a webhook").argument("<id>", "Webhook ID").addOption(yesOption()).addOption(jsonOption()).action(async (id, options) => {
+		if (options.yes !== true) throw new UsageError("refusing to delete without --yes");
+		await deleteWebhook(app.api, id);
+		if (options.json) {
+			printJson({ deleted: id });
+			return;
+		}
+		print(`${glyph.ok} Deleted webhook ${id}`);
+	});
+	return webhook;
+};
+//#endregion
+//#region src/program.ts
+const HELP_WIDTH = 100;
+const EXIT_CODE_HELP = `
 Exit codes:
   0  success
   1  error (network, server, or unexpected failure)
@@ -19,5 +2553,64 @@ Environment:
   MYNTH_API_KEY      API key; takes precedence over stored credentials
   MYNTH_DESTINATION  default --destination for image generation
   MYNTH_DEBUG=1      print error causes and stack details to stderr
-  XDG_CONFIG_HOME    where credentials are stored (default: ~/.config)`,Ge=class extends Help{optionTerm(t){return `(${t.flags.replaceAll("<","").replaceAll(">","")})`}subcommandTerm(t){let n=t.registeredArguments.map(o=>o.required?`${o.name()}${o.variadic?"...":""}`:`[${o.name()}]`).join(" ");return n.length>0?`${t.name()} ${n}`:t.name()}},zn=e=>{e.configureHelp({helpWidth:ri}),e.createHelp=()=>new Ge,e.exitOverride();for(let t of e.commands)zn(t);},Wn=()=>{let e=Rt(),t=new Command("mynth").description("Official Mynth CLI").version(Ze).addHelpText("before",({error:n})=>(n?process.stderr.isTTY:process.stdout.isTTY)?`${Ct()}
-`:"").addHelpText("after",ii);for(let n of [jt(e),Yt(e),Ht(e),Zt(e),ln(e),cn(e),An(e),Sn(e),Dn(e),Kn(e),Re(e)])t.addCommand(n);return zn(t),t};var Bn=e=>e instanceof Error?e.message:String(e);try{await Wn().parseAsync(process.argv);}catch(e){let t=e?.code;t==="commander.helpDisplayed"||t==="commander.version"||((typeof t!="string"||!t.startsWith("commander."))&&(T(Bn(e)),q().debug&&e instanceof Error&&(T("=== MYNTH_DEBUG ==="),T(e.stack??e.message),e.cause!==void 0&&T(`cause: ${Bn(e.cause)}`))),process.exitCode=Qe(e));}
+  XDG_CONFIG_HOME    where credentials are stored (default: ~/.config)`;
+/**
+* Renders options as `(--flag value)` and subcommands with their arguments,
+* which reads better than Commander's default in a dense command tree.
+*/
+var MynthHelp = class extends Help {
+	optionTerm(option) {
+		return `(${option.flags.replaceAll("<", "").replaceAll(">", "")})`;
+	}
+	subcommandTerm(command) {
+		const args = command.registeredArguments.map((argument) => argument.required ? `${argument.name()}${argument.variadic ? "..." : ""}` : `[${argument.name()}]`).join(" ");
+		return args.length > 0 ? `${command.name()} ${args}` : command.name();
+	}
+};
+/** Commander does not inherit help config or exitOverride into `addCommand`ed subtrees. */
+const applyToTree = (command) => {
+	command.configureHelp({ helpWidth: HELP_WIDTH });
+	command.createHelp = () => new MynthHelp();
+	command.exitOverride();
+	for (const child of command.commands) applyToTree(child);
+};
+const createProgram = () => {
+	const app = createApp();
+	const program = new Command("mynth").description("Official Mynth CLI").version(CLI_VERSION).addHelpText("before", ({ error }) => (error ? process.stderr.isTTY : process.stdout.isTTY) ? `${logo()}\n` : "").addHelpText("after", EXIT_CODE_HELP);
+	for (const command of [
+		apiKeyCommand(app),
+		authCommand(app),
+		balanceCommand(app),
+		configCommand(app),
+		destinationCommand(app),
+		docsCommand(app),
+		imageCommand(app),
+		modelsCommand(app),
+		taskCommand(app),
+		webhookCommand(app),
+		whoamiCommand(app)
+	]) program.addCommand(command);
+	applyToTree(program);
+	return program;
+};
+//#endregion
+//#region src/bin.ts
+const message = (error) => error instanceof Error ? error.message : String(error);
+try {
+	await createProgram().parseAsync(process.argv);
+} catch (error) {
+	const code = error?.code;
+	if (code === "commander.helpDisplayed" || code === "commander.version") {} else {
+		if (typeof code !== "string" || !code.startsWith("commander.")) {
+			printErr(message(error));
+			if (loadConfig().debug && error instanceof Error) {
+				printErr("=== MYNTH_DEBUG ===");
+				printErr(error.stack ?? error.message);
+				if (error.cause !== void 0) printErr(`cause: ${message(error.cause)}`);
+			}
+		}
+		process.exitCode = exitCodeForError(error);
+	}
+}
+//#endregion
+export {};