@native-marketing/sdk 0.3.6 → 0.3.8

package/dist/index.js

@@ -2570,6 +2570,7 @@ var permissionSchema = z32.enum([
   "feedback.manage",
   "recommendation.create",
   "package.download",
+  "presentation.share",
   "source.read",
   "source.ingest",
   "source.content.read"
@@ -6934,7 +6935,13 @@ var surveyRejections = [
   "PERSONAL_SURVEY_DRAFT_TRANSITION_IMMUTABLE"
 ];
 function isKnownCapabilityRejection(code2, name) {
-  return capabilityRejectedErrorCodes.includes(code2) || name === "cf_repair_knowledge_reference" && [
+  return name === "cf_issue_human_read_link" && [
+    "HUMAN_TARGET_NOT_FOUND",
+    "HUMAN_CONTENT_TOO_LARGE",
+    "HUMAN_LINK_REQUEST_CONFLICT",
+    "HUMAN_LINK_LIMIT",
+    "HUMAN_LINK_SECRET_UNAVAILABLE"
+  ].includes(code2) || name === "cf_revoke_human_read_link" && code2 === "HUMAN_LINK_REQUEST_CONFLICT" || name === "cf_cleanup_human_read_links" && code2 === "HUMAN_CLEANUP_INPUT_INVALID" || capabilityRejectedErrorCodes.includes(code2) || name === "cf_repair_knowledge_reference" && [
     "KNOWLEDGE_REFERENCE_REPAIR_CONFLICT",
     "KNOWLEDGE_REFERENCE_REPAIR_NOT_SUPPORTED",
     "KNOWLEDGE_REFERENCE_REPAIR_IDENTITY_MISMATCH",
@@ -7008,6 +7015,8 @@ function capabilityRecovery(code2, outcome, name) {
   const change2 = changeCapabilityRecovery(code2, outcome, name);
   if (change2) return change2;
   if (outcome === "UNKNOWN") {
+    if (name === "cf_issue_human_read_link") return "FIND_ORIGINAL_RECEIPT";
+    if (name === "cf_revoke_human_read_link") return "READ_ORIGINAL_LINK_STATE";
     if ([
       "cf_material_verification_start",
       "cf_material_verification_advance",
@@ -7305,6 +7314,110 @@ var knowledgeReferenceRepairCommandSchema = knowledgeReferenceRepairQuerySchema.
 }).strict();
 var knowledgeReferenceRepairReceiptQuerySchema = knowledgeAdoptionReceiptQuerySchema;
 
+// packages/contracts/src/agent/human-presentation.ts
+import { z as z103 } from "zod";
+var reference = z103.string().min(1).max(512);
+var digest = z103.string().regex(/^[a-f0-9]{64}$/u);
+var webUrl = z103.string().url().max(4096).refine((value) => {
+  try {
+    const url = new URL(value);
+    return !url.username && !url.password && !url.search && (url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
+  } catch {
+    return false;
+  }
+});
+var packageCode = z103.string().regex(/^PKG-[0-9]{6,}$/u);
+var humanPresentationCapability = "com.native-marketing/human-presentation";
+var humanPresentationFeatures = Object.freeze({
+  version: 1,
+  subjects: ["CONTENT_PACKAGE"],
+  interactions: ["CONTENT_PACKAGE_REVIEW"],
+  links: ["AUTHENTICATED", "TEMPORARY_PUBLIC_READ"],
+  publicRead: "SNAPSHOT"
+});
+var humanPresentationInputSchema = z103.object({ packageCode }).strict();
+var common3 = {
+  linkRef: reference,
+  kind: z103.literal("READABLE_CONTENT"),
+  title: z103.string().min(1).max(500),
+  subjectRef: reference,
+  url: webUrl
+};
+var humanReadLinkSchema = z103.discriminatedUnion("access", [
+  z103.object({
+    ...common3,
+    access: z103.literal("AUTHENTICATED"),
+    representation: z103.literal("CURRENT_VIEW"),
+    expiresAt: z103.null()
+  }).strict(),
+  z103.object({
+    ...common3,
+    access: z103.literal("TEMPORARY_PUBLIC_READ"),
+    representation: z103.literal("SNAPSHOT"),
+    snapshotRef: reference,
+    contentSha256: digest,
+    createdAt: z103.string().datetime(),
+    expiresAt: z103.string().datetime()
+  }).strict()
+]);
+var humanInteractionSchema = z103.object({
+  interactionRef: reference,
+  kind: z103.literal("CONTENT_PACKAGE_REVIEW"),
+  subjectRef: reference,
+  title: z103.string().min(1).max(500),
+  summary: z103.string().max(2e3),
+  state: z103.enum(["PENDING", "APPROVED", "REJECTED", "RESOLVED"]),
+  sourceState: z103.string().min(1).max(80),
+  actionDigest: digest,
+  expiresAt: z103.null(),
+  reviewUrl: webUrl,
+  canReview: z103.boolean()
+}).strict();
+var humanPresentationSchema = z103.object({
+  schemaVersion: z103.literal(1),
+  interactions: z103.array(humanInteractionSchema).max(16),
+  links: z103.array(humanReadLinkSchema).max(16)
+}).strict();
+var humanReadableDocumentSchema = z103.object({
+  schemaVersion: z103.literal(1),
+  title: z103.string().min(1).max(500),
+  subjectRef: reference,
+  manifestHash: digest,
+  sections: z103.array(
+    z103.object({ heading: z103.string().min(1).max(500), text: z103.string().max(131072) }).strict()
+  ).min(1).max(128)
+}).strict();
+var issueHumanReadLinkInputSchema = z103.object({
+  requestId: z103.string().min(1).max(128),
+  packageCode,
+  expectedManifestHash: digest,
+  access: z103.literal("TEMPORARY_PUBLIC_READ"),
+  targetKeys: z103.array(z103.string().min(1).max(64)).min(1).max(32).refine((keys) => new Set(keys).size === keys.length),
+  ttlSeconds: z103.number().int().min(60).max(86400).default(3600)
+}).strict();
+var humanReadLinkLookupSchema = z103.object({ linkRef: z103.string().uuid() }).strict();
+var humanReadLinkReceiptQuerySchema = z103.object({ requestId: z103.string().min(1).max(128) }).strict();
+var revokeHumanReadLinkInputSchema = humanReadLinkLookupSchema.extend({ requestId: z103.string().min(1).max(128) }).strict();
+var humanReadLinkResultSchema = z103.object({
+  linkRef: z103.string().uuid(),
+  issuanceRequestId: z103.string().min(1).max(128),
+  state: z103.enum(["ACTIVE", "EXPIRED", "REVOKED", "UNAVAILABLE"]),
+  packageCode,
+  manifestHash: digest,
+  expiresAt: z103.string().datetime(),
+  human: humanPresentationSchema
+}).strict();
+var humanReadLinkReceiptSchema = z103.discriminatedUnion("status", [
+  z103.object({ status: z103.literal("FOUND"), receipt: humanReadLinkResultSchema }).strict(),
+  z103.object({ status: z103.literal("NOT_FOUND") }).strict()
+]);
+var cleanupHumanReadLinksInputSchema = z103.object({ limit: z103.number().int().min(1).max(32).default(16) }).strict();
+var cleanupHumanReadLinksResultSchema = z103.object({
+  reclaimed: z103.number().int().nonnegative().max(32),
+  limit: z103.number().int().min(1).max(32)
+}).strict();
+var humanPresentationResultSchema = z103.object({ human: humanPresentationSchema }).strict();
+
 // packages/contracts/src/agent/capability-receipts.ts
 var rule = (capability, schema2, operation, keys = [], field) => ({ capability, schema: schema2, operation, keys, field });
 var foundation = (operation, field) => rule(
@@ -7531,6 +7644,18 @@ var rules = {
 };
 var object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
 function capabilityReceiptRead(name, input) {
+  if (name === "cf_issue_human_read_link") {
+    const parsed2 = humanReadLinkReceiptQuerySchema.safeParse({
+      requestId: object(input).requestId
+    });
+    if (!parsed2.success) return void 0;
+    return {
+      capability: "cf_get_human_read_link_receipt",
+      arguments: parsed2.data,
+      requiresDescription: true,
+      requiresCurrentAuthorization: true
+    };
+  }
   const r = name && Object.hasOwn(rules, name) ? rules[name] : void 0;
   if (!r) return void 0;
   const raw = object(input), source = r.field ? object(Object.hasOwn(raw, r.field) ? raw[r.field] : void 0) : raw;
@@ -7553,13 +7678,18 @@ function capabilityReceiptRead(name, input) {
 }
 
 // packages/contracts/src/agent/capability-status.ts
-import { z as z103 } from "zod";
+import { z as z104 } from "zod";
 var verification = {
   capability: "cf_material_verification_status",
   schema: materialVerificationIdSchema,
   key: "jobId"
 };
 var rules2 = {
+  cf_revoke_human_read_link: {
+    capability: "cf_get_human_read_link",
+    schema: humanReadLinkLookupSchema,
+    key: "linkRef"
+  },
   cf_material_verification_start: { ...verification, from: "requestId" },
   cf_material_verification_advance: verification,
   cf_material_verification_retry: verification,
@@ -7571,7 +7701,7 @@ var rules2 = {
   },
   cf_tenant_material_scan_advance: {
     capability: "cf_tenant_material_scan_status",
-    schema: z103.object({}).strict()
+    schema: z104.object({}).strict()
   },
   cf_sync_materials: {
     capability: "cf_reconcile_materials",
@@ -7598,6 +7728,218 @@ function capabilityStatusRead(name, input) {
   };
 }
 
+// packages/contracts/src/client-lifecycle.ts
+import { z as z105 } from "zod";
+
+// packages/contracts/src/generated/client-release.ts
+var nativeClientRelease = {
+  schemaVersion: 1,
+  product: "native-marketing",
+  version: "0.3.8",
+  packages: {
+    sdk: "@native-marketing/sdk",
+    cli: "@native-marketing/cli"
+  },
+  contractVersion: 1,
+  minimumClientVersion: "0.3.6",
+  apiMajor: 1,
+  nodeMajor: 24,
+  changes: [
+    "Unified typed human interaction cards and authenticated reading links across SDK, CLI and MCP.",
+    "Explicitly authorized expiring public read-only package text snapshots with original request recovery and revocation.",
+    "Bound human presentation responses to the configured Project, original issuance request and source version."
+  ]
+};
+
+// packages/contracts/src/client-lifecycle.ts
+var nativeReleaseCapability = "com.native-marketing/client-release";
+var releaseVersionSchema = z105.string().max(128).regex(
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+);
+var clientIdentitySchema = z105.object({
+  version: releaseVersionSchema,
+  contractVersion: z105.number().int().positive(),
+  apiMajor: z105.number().int().positive()
+});
+var clientReleaseSchema = z105.object({
+  schemaVersion: z105.literal(1),
+  product: z105.literal("native-marketing"),
+  version: releaseVersionSchema,
+  packages: z105.object({
+    sdk: z105.literal("@native-marketing/sdk"),
+    cli: z105.literal("@native-marketing/cli")
+  }),
+  contractVersion: z105.number().int().positive(),
+  minimumClientVersion: releaseVersionSchema,
+  apiMajor: z105.number().int().positive(),
+  nodeMajor: z105.number().int().positive(),
+  changes: z105.array(z105.string().min(1).max(240)).max(8).default([])
+});
+var updatePolicySchema = z105.object({
+  mode: z105.enum(["off", "notify", "auto"]).default("notify"),
+  channel: z105.enum(["latest", "next", "beta"]).default("latest"),
+  pin: releaseVersionSchema.nullable().default(null),
+  intervalHours: z105.number().int().min(1).max(168).default(24)
+}).strict();
+var defaultUpdatePolicy = updatePolicySchema.parse({});
+function compareReleaseVersions(left, right) {
+  const parse = (raw) => releaseVersionSchema.parse(raw).split("+")[0].split(/-(.*)/s);
+  const a = parse(left), b = parse(right);
+  const numbers = (x, y) => BigInt(x) < BigInt(y) ? -1 : BigInt(x) > BigInt(y) ? 1 : 0;
+  const ac = a[0].split("."), bc = b[0].split(".");
+  for (let i = 0; i < 3; i++) {
+    const order = numbers(ac[i], bc[i]);
+    if (order) return order;
+  }
+  if (a[1] === b[1]) return 0;
+  if (!a[1] || !b[1]) return a[1] ? -1 : 1;
+  const ap = a[1].split("."), bp = b[1].split(".");
+  for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
+    const x = ap[i], y = bp[i];
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    if (x === y) continue;
+    const xn = /^\d+$/.test(x), yn = /^\d+$/.test(y);
+    return xn && yn ? numbers(x, y) : xn !== yn ? xn ? -1 : 1 : x < y ? -1 : 1;
+  }
+  return 0;
+}
+function assessNativeCompatibility(client, server) {
+  client = clientIdentitySchema.parse(client);
+  const result2 = (status, reason) => ({ status, reason, client, server: server ?? null });
+  if (!server) return result2("UNKNOWN", "SERVER_METADATA_UNAVAILABLE");
+  server = clientReleaseSchema.parse(server);
+  if (client.contractVersion !== server.contractVersion)
+    return result2("INCOMPATIBLE", "CONTRACT_MISMATCH");
+  if (client.apiMajor !== server.apiMajor) return result2("INCOMPATIBLE", "API_MISMATCH");
+  if (compareReleaseVersions(client.version, server.minimumClientVersion) < 0)
+    return result2("INCOMPATIBLE", "CLIENT_TOO_OLD");
+  return compareReleaseVersions(client.version, server.version) < 0 ? result2("UPGRADE_RECOMMENDED", "NEWER_CLIENT_AVAILABLE") : result2("COMPATIBLE", "CURRENT");
+}
+
+// packages/contracts/src/client-update-policy.ts
+import { z as z106 } from "zod";
+var registryReleaseSchema = z106.object({
+  name: z106.enum(["@native-marketing/sdk", "@native-marketing/cli"]),
+  version: releaseVersionSchema,
+  deprecated: z106.string().optional(),
+  nativeMarketing: z106.object({
+    contractVersion: z106.number().int().positive(),
+    apiMajor: z106.number().int().positive(),
+    nodeMajor: z106.number().int().positive(),
+    changes: z106.array(z106.string().min(1).max(240)).max(8).optional()
+  }).optional(),
+  dist: z106.object({
+    integrity: z106.string().max(512).regex(/^sha512-[A-Za-z0-9+/]{86}==$/)
+  })
+});
+var clientUpdateStateSchema = z106.object({
+  schemaVersion: z106.literal(1),
+  policy: updatePolicySchema,
+  lastCheck: z106.object({
+    at: z106.number().int().nonnegative(),
+    selector: z106.string().max(160),
+    target: registryReleaseSchema
+  }).strict().optional(),
+  lastAttempt: z106.object({ at: z106.number().int().nonnegative(), selector: z106.string().max(160) }).strict().optional()
+}).strict();
+function planNativeUpdate(input) {
+  const target = registryReleaseSchema.parse(input.target);
+  const current = releaseVersionSchema.parse(input.currentVersion ?? nativeClientRelease.version);
+  const policy = updatePolicySchema.parse(input.policy ?? {});
+  const spec = `${target.name}@${target.version}`;
+  const cli = target.name === nativeClientRelease.packages.cli;
+  const result2 = (status, reason, eligible = false) => ({
+    package: target.name,
+    currentVersion: current,
+    targetVersion: target.version,
+    status,
+    reason,
+    eligibleForAutoUpdate: eligible,
+    policy,
+    commands: {
+      npm: [
+        "npm",
+        "install",
+        ...cli ? ["--global"] : ["--save-exact"],
+        spec,
+        "--ignore-scripts",
+        "--registry=https://registry.npmjs.org/",
+        "--@native-marketing:registry=https://registry.npmjs.org/"
+      ],
+      pnpm: ["pnpm", "add", ...cli ? ["--global"] : ["--save-exact"], spec, "--ignore-scripts"],
+      yarn: cli ? null : ["yarn", "add", "--exact", spec]
+    }
+  });
+  if (policy.pin && policy.pin !== target.version) return result2("BLOCKED", "PIN_MISMATCH");
+  if (!policy.pin && policy.channel === "latest" && target.version.split("+")[0].includes("-"))
+    return result2("BLOCKED", "CHANNEL_MISMATCH");
+  const order = compareReleaseVersions(target.version, current);
+  if (order < 0) return result2("BLOCKED", "DOWNGRADE_FORBIDDEN");
+  if (target.deprecated !== void 0) return result2("BLOCKED", "DEPRECATED");
+  if (!target.nativeMarketing) return result2("BLOCKED", "METADATA_UNAVAILABLE");
+  const metadata = target.nativeMarketing;
+  if (metadata.nodeMajor !== (input.nodeMajor ?? nativeClientRelease.nodeMajor))
+    return result2("BLOCKED", "NODE_MISMATCH");
+  if (metadata.contractVersion !== nativeClientRelease.contractVersion || metadata.apiMajor !== nativeClientRelease.apiMajor)
+    return result2("BLOCKED", "CONTRACT_MISMATCH");
+  if (input.server && assessNativeCompatibility(
+    {
+      version: target.version,
+      contractVersion: metadata.contractVersion,
+      apiMajor: metadata.apiMajor
+    },
+    input.server
+  ).status === "INCOMPATIBLE")
+    return result2("BLOCKED", "SERVER_INCOMPATIBLE");
+  if (order === 0) return result2("CURRENT", "CURRENT");
+  const from = current.split(/[.+-]/), to = target.version.split(/[.+-]/);
+  const compatibleLine = from[0] === to[0] && (from[0] !== "0" || from[1] === to[1]);
+  const stable = !current.split("+")[0].includes("-") && !target.version.split("+")[0].includes("-");
+  return compatibleLine && stable ? result2("UPDATE_AVAILABLE", "COMPATIBLE_UPDATE", true) : result2("UPDATE_AVAILABLE", "REVIEW_REQUIRED");
+}
+
+// packages/contracts/src/agent/human-presentation-validation.ts
+function validateHumanPresentationResource(human, resource, packageCode2) {
+  try {
+    const base2 = new URL(resource);
+    const project = /^\/mcp\/projects\/(PRJ-[0-9]{6,})$/u.exec(base2.pathname)?.[1];
+    if (!project || base2.username || base2.password || base2.search || base2.hash) return false;
+    const review = (raw) => {
+      const url = new URL(raw);
+      return url.origin === base2.origin && !url.username && !url.password && !url.search && !url.hash && (packageCode2 ? url.pathname === `/projects/${project}/packages/${packageCode2}` : new RegExp(`^/projects/${project}/packages/PKG-[0-9]{6,}$`, "u").test(url.pathname));
+    };
+    return human.interactions.every((item) => review(item.reviewUrl)) && human.links.every((link) => {
+      if (link.access === "AUTHENTICATED") return review(link.url);
+      const url = new URL(link.url);
+      return url.origin === base2.origin && !url.username && !url.password && !url.search && url.pathname === `/api/v1/human-read/${link.linkRef}` && /^#[A-Za-z0-9_-]{43}$/u.test(url.hash) && link.snapshotRef === `sha256:${link.contentSha256}` && Date.parse(link.expiresAt) > Date.parse(link.createdAt);
+    });
+  } catch {
+    return false;
+  }
+}
+function validateHumanPresentationResponse(parsed, resource, input, operation) {
+  const value = parsed.status === "FOUND" ? parsed.receipt : parsed;
+  if (!("human" in value)) return true;
+  const human = value.human;
+  if (!validateHumanPresentationResource(
+    human,
+    resource,
+    typeof value.packageCode === "string" ? value.packageCode : input.packageCode
+  ))
+    return false;
+  if (input.packageCode && value.packageCode && value.packageCode !== input.packageCode)
+    return false;
+  if (input.expectedManifestHash && value.manifestHash !== input.expectedManifestHash) return false;
+  if (input.linkRef && value.linkRef !== input.linkRef) return false;
+  if (input.requestId && operation !== "cf_revoke_human_read_link" && value.issuanceRequestId !== input.requestId)
+    return false;
+  const links = human.links;
+  if (value.state === "ACTIVE" && (links.length !== 1 || links[0]?.access !== "TEMPORARY_PUBLIC_READ" || links[0].linkRef !== value.linkRef || links[0].expiresAt !== value.expiresAt))
+    return false;
+  if (value.state && value.state !== "ACTIVE" && links.length) return false;
+  return true;
+}
+
 // packages/cli-client/src/errors.ts
 var CliError = class extends Error {
   constructor(code2, message, outcome = "NOT_SENT", details) {
@@ -7650,6 +7992,9 @@ function verifyCapabilityDefinition(raw, name, expectedHash) {
 }
 var CapabilityDefinitionCache = class {
   values = /* @__PURE__ */ new Map();
+  clear() {
+    this.values.clear();
+  }
   remember(value) {
     const verified = verifyCapabilityDefinition(value, value.definition.name);
     const key2 = `${verified.definition.name}:AGENT_V3:${verified.schemaSha256}`;
@@ -7988,13 +8333,106 @@ function object2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 
+// packages/cli-client/src/updates/version.ts
+import { readFile, realpath } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+function getNativeClientVersion() {
+  return clientReleaseSchema.parse(nativeClientRelease);
+}
+async function getNativeCliVersion(executablePath) {
+  const identity = { ...getNativeClientVersion(), sdkVersion: nativeClientRelease.version };
+  if (!executablePath) return identity;
+  try {
+    const root = dirname(dirname(await realpath(executablePath)));
+    const manifest = JSON.parse(await readFile(join2(root, "package.json"), "utf8"));
+    if (manifest.name === nativeClientRelease.packages.cli)
+      return { ...identity, version: releaseVersionSchema.parse(manifest.version) };
+  } catch {
+  }
+  return identity;
+}
+function readNativeServerVersion(client) {
+  const raw = client.getServerCapabilities()?.experimental?.[nativeReleaseCapability];
+  let server;
+  if (raw !== void 0) {
+    const parsed = clientReleaseSchema.safeParse(raw);
+    if (!parsed.success)
+      throw new CliError(
+        "INVALID_SERVER_RELEASE",
+        "The advertised Native Marketing release contract is invalid."
+      );
+    server = parsed.data;
+  }
+  return {
+    client: getNativeClientVersion(),
+    serverInfo: client.getServerVersion() ?? null,
+    mcpProtocolVersion: client.getNegotiatedProtocolVersion() ?? null,
+    compatibility: assessNativeCompatibility(nativeClientRelease, server)
+  };
+}
+function assertNativeCompatibility(result2, required = false) {
+  if (result2.compatibility.status === "INCOMPATIBLE" || required && result2.compatibility.status === "UNKNOWN")
+    throw new CliError(
+      "CLIENT_INCOMPATIBLE",
+      "Check version --server and update the client or connect to a compatible service. No business operation was sent.",
+      "NOT_SENT",
+      { compatibility: result2.compatibility }
+    );
+}
+async function refreshNativeServerVersion(client, timeout) {
+  const reply = await client.callTool(
+    { name: "cf_get_client_release", arguments: {} },
+    {
+      timeout,
+      allowInputRequired: true,
+      toolDefinition: {
+        name: "cf_get_client_release",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false },
+        annotations: { readOnlyHint: true }
+      }
+    }
+  ).catch(() => {
+    throw new CliError(
+      "VERSION_CHECK_UNAVAILABLE",
+      "Cannot refresh the service release. Reconnect or refresh again before continuing."
+    );
+  });
+  const text3 = reply.content?.find((item) => item.type === "text");
+  let server;
+  try {
+    if (reply.isError) throw new Error();
+    server = clientReleaseSchema.parse(
+      reply.structuredContent ?? (text3?.type === "text" ? JSON.parse(text3.text) : null)
+    );
+  } catch {
+    throw new CliError("INVALID_SERVER_RELEASE", "Cannot verify the current server release.");
+  }
+  const result2 = {
+    ...readNativeServerVersion(client),
+    compatibility: assessNativeCompatibility(nativeClientRelease, server)
+  };
+  return result2;
+}
+
 // packages/cli-client/src/transport.ts
-async function withClient(profile, timeout, operation) {
+var resources = /* @__PURE__ */ new WeakMap();
+async function withClient(profile, timeout, operation, options = {}) {
   const resource = resourceUrl(profile.resource);
   const accessToken = tokenText(profile.accessToken);
   const client = new Client(
-    { name: "content-factory-agent-cli", version: "0.1.0" },
-    { inputRequired: { autoFulfill: false } }
+    { name: "@native-marketing/sdk", version: nativeClientRelease.version },
+    {
+      inputRequired: { autoFulfill: false },
+      capabilities: {
+        experimental: {
+          [nativeReleaseCapability]: {
+            version: nativeClientRelease.version,
+            contractVersion: nativeClientRelease.contractVersion,
+            apiMajor: nativeClientRelease.apiMajor
+          }
+        }
+      }
+    }
   );
   const transport = new StreamableHTTPClientTransport(resource, {
     authProvider: { token: async () => accessToken },
@@ -8006,6 +8444,7 @@ async function withClient(profile, timeout, operation) {
       reconnectionDelayGrowFactor: 1
     }
   });
+  resources.set(client, resource.href);
   try {
     try {
       await client.connect(transport, { timeout });
@@ -8015,8 +8454,13 @@ async function withClient(profile, timeout, operation) {
         "Cannot authenticate/connect to the configured CF resource. No business operation was sent."
       );
     }
+    const version = readNativeServerVersion(client);
+    if (!options.allowIncompatible)
+      assertNativeCompatibility(version, options.requireCompatibility);
+    options.onVersion?.(version);
     return await operation(client);
   } finally {
+    resources.delete(client);
     await client.close().catch(() => void 0);
   }
 }
@@ -8024,13 +8468,14 @@ async function callTool(client, tool5, input, timeout, readOnly, errorToolName =
   if (["cf_call_capability", "cf_read_capability", "cf_write_capability"].includes(tool5.name) && errorToolName === tool5.name && typeof input.name === "string" && /^cf_[a-z0-9_]{1,100}$/.test(input.name))
     errorToolName = input.name;
   const original = ["cf_call_capability", "cf_read_capability", "cf_write_capability"].includes(tool5.name) && input.name === errorToolName ? input.arguments : input;
-  const unknown = (code2, message) => {
+  const unknown = (code2, message, human) => {
     const receipt = capabilityReceiptRead(errorToolName, original);
     const status = capabilityStatusRead(errorToolName, original);
     return new CliError(code2, message, "UNKNOWN", {
       recovery: capabilityRecovery(code2, "UNKNOWN", errorToolName),
       ...receipt ? { receipt } : {},
-      ...status ? { status } : {}
+      ...status ? { status } : {},
+      ...human ? { human } : {}
     });
   };
   let result2;
@@ -8052,16 +8497,21 @@ async function callTool(client, tool5, input, timeout, readOnly, errorToolName =
     );
   }
   if ("resultType" in result2 && result2.resultType === "input_required") {
+    const raw = result2._meta?.[humanPresentationCapability];
+    const parsed = raw && Buffer.byteLength(JSON.stringify(raw)) <= 128 * 1024 ? humanPresentationSchema.safeParse(raw) : null;
+    const resource = resources.get(client);
+    const human = parsed?.success && resource && validateHumanPresentationResource(parsed.data, resource) ? parsed.data : void 0;
     if (!readOnly)
       throw unknown(
         "INPUT_REQUIRED",
-        "Resolve additional input explicitly after confirming the original outcome. No automatic fulfilment or retry was made."
+        "Resolve additional input explicitly after confirming the original outcome. No automatic fulfilment or retry was made.",
+        human
       );
     throw new CliError(
       "INPUT_REQUIRED",
       "Resolve additional input explicitly; no automatic fulfilment or retry was made.",
       "REJECTED",
-      { recovery: "RESOLVE_INPUT_EXPLICITLY" }
+      { recovery: "RESOLVE_INPUT_EXPLICITLY", ...human ? { human } : {} }
     );
   }
   if (result2.isError) {
@@ -8825,6 +9275,185 @@ async function uploadNativeMaterial(connection, file, timeout = 3e4) {
   return materialUploadCommandResultSchema.parse(await uploadFile(connection, file, timeout));
 }
 
+// packages/cli-client/src/human-presentation.ts
+var humanCommands = {
+  "human show": {
+    name: "cf_get_human_presentation",
+    input: humanPresentationInputSchema,
+    output: humanPresentationResultSchema,
+    readOnly: true
+  },
+  "human issue-link": {
+    name: "cf_issue_human_read_link",
+    input: issueHumanReadLinkInputSchema,
+    output: humanReadLinkResultSchema,
+    readOnly: false
+  },
+  "human link": {
+    name: "cf_get_human_read_link",
+    input: humanReadLinkLookupSchema,
+    output: humanReadLinkResultSchema,
+    readOnly: true
+  },
+  "human receipt": {
+    name: "cf_get_human_read_link_receipt",
+    input: humanReadLinkReceiptQuerySchema,
+    output: humanReadLinkReceiptSchema,
+    readOnly: true
+  },
+  "human revoke-link": {
+    name: "cf_revoke_human_read_link",
+    input: revokeHumanReadLinkInputSchema,
+    output: humanReadLinkResultSchema,
+    readOnly: false
+  },
+  "human cleanup-links": {
+    name: "cf_cleanup_human_read_links",
+    input: cleanupHumanReadLinksInputSchema,
+    output: cleanupHumanReadLinksResultSchema,
+    readOnly: false
+  }
+};
+function invalid6() {
+  return new CliError(
+    "INVALID_HUMAN_PRESENTATION",
+    "The human presentation cannot be verified against this exact product resource."
+  );
+}
+async function invoke2(client, resource, raw, name, inputSchema, outputSchema, readOnly, timeout) {
+  const request = inputSchema.safeParse(raw);
+  if (!request.success)
+    throw new CliError("INVALID_HUMAN_INPUT", "Use the exact human presentation input schema.");
+  const capability = client.getServerCapabilities()?.experimental?.[humanPresentationCapability];
+  if (capability?.version !== 1)
+    throw new CliError(
+      "HUMAN_PRESENTATION_UNSUPPORTED",
+      "This service has not declared human presentation version 1."
+    );
+  const tool5 = {
+    name,
+    inputSchema: {
+      type: "object",
+      ...inputSchema["~standard"].jsonSchema.input({ target: "draft-2020-12" })
+    },
+    annotations: { readOnlyHint: readOnly }
+  };
+  const result2 = await callTool(client, tool5, request.data, timeout, readOnly);
+  try {
+    const parsed = outputSchema.parse(result2);
+    if (Buffer.byteLength(JSON.stringify(parsed)) > 128 * 1024) throw invalid6();
+    if (!validateHumanPresentationResponse(
+      parsed,
+      resource,
+      request.data,
+      name
+    ))
+      throw invalid6();
+    return parsed;
+  } catch {
+    const outcome = readOnly ? "REJECTED" : "UNKNOWN";
+    const receipt = capabilityReceiptRead(name, request.data);
+    const status = capabilityStatusRead(name, request.data);
+    throw new CliError(
+      "INVALID_HUMAN_PRESENTATION",
+      "Cannot verify this exact response. Query the original request before another write.",
+      outcome,
+      {
+        recovery: capabilityRecovery("INVALID_HUMAN_PRESENTATION", outcome, name),
+        ...!readOnly && receipt ? { receipt } : {},
+        ...!readOnly && status ? { status } : {},
+        ...request.data.requestId ? { requestId: request.data.requestId } : {},
+        ...request.data.linkRef ? { linkRef: request.data.linkRef } : {}
+      }
+    );
+  }
+}
+function getNativeHumanPresentation(client, resource, input, timeout = 3e4) {
+  return invoke2(
+    client,
+    resource,
+    input,
+    "cf_get_human_presentation",
+    humanPresentationInputSchema,
+    humanPresentationResultSchema,
+    true,
+    timeout
+  );
+}
+function issueNativeHumanReadLink(client, resource, input, timeout = 3e4) {
+  return invoke2(
+    client,
+    resource,
+    input,
+    "cf_issue_human_read_link",
+    issueHumanReadLinkInputSchema,
+    humanReadLinkResultSchema,
+    false,
+    timeout
+  );
+}
+function getNativeHumanReadLink(client, resource, input, timeout = 3e4) {
+  return invoke2(
+    client,
+    resource,
+    input,
+    "cf_get_human_read_link",
+    humanReadLinkLookupSchema,
+    humanReadLinkResultSchema,
+    true,
+    timeout
+  );
+}
+function getNativeHumanReadLinkReceipt(client, resource, input, timeout = 3e4) {
+  return invoke2(
+    client,
+    resource,
+    input,
+    "cf_get_human_read_link_receipt",
+    humanReadLinkReceiptQuerySchema,
+    humanReadLinkReceiptSchema,
+    true,
+    timeout
+  );
+}
+function revokeNativeHumanReadLink(client, resource, input, timeout = 3e4) {
+  return invoke2(
+    client,
+    resource,
+    input,
+    "cf_revoke_human_read_link",
+    revokeHumanReadLinkInputSchema,
+    humanReadLinkResultSchema,
+    false,
+    timeout
+  );
+}
+function cleanupNativeHumanReadLinks(client, resource, input = {}, timeout = 3e4) {
+  return invoke2(
+    client,
+    resource,
+    input,
+    "cf_cleanup_human_read_links",
+    cleanupHumanReadLinksInputSchema,
+    cleanupHumanReadLinksResultSchema,
+    false,
+    timeout
+  );
+}
+async function runHumanCommand(client, resource, name, input, timeout) {
+  const spec = humanCommands[name];
+  return invoke2(
+    client,
+    resource,
+    input,
+    spec.name,
+    spec.input,
+    spec.output,
+    spec.readOnly,
+    timeout
+  );
+}
+
 // packages/cli-client/src/business-search.ts
 var tool4 = (name, schema2) => ({
   name,
@@ -8839,17 +9468,17 @@ var document = tool4("cf_read_business_document", businessDocumentInputSchema);
 async function searchNativeBusiness(client, raw = {}, timeout = 3e4) {
   checkTimeout3(timeout);
   const input = businessSearchQuerySchema.safeParse(raw);
-  if (!input.success) throw invalid6("INVALID_BUSINESS_SEARCH_QUERY", "NOT_SENT");
+  if (!input.success) throw invalid7("INVALID_BUSINESS_SEARCH_QUERY", "NOT_SENT");
   const value = await callTool(client, search, input.data, timeout, true);
   const parsed = businessSearchPageSchema.safeParse(value);
   if (!parsed.success || Buffer.byteLength(JSON.stringify(value)) > 16 * 1024)
-    throw invalid6("INVALID_BUSINESS_SEARCH_REPLY");
+    throw invalid7("INVALID_BUSINESS_SEARCH_REPLY");
   return parsed.data;
 }
 async function readNativeBusinessPage(client, raw, timeout = 3e4) {
   checkTimeout3(timeout);
   const input = businessContentPageReadSchema.safeParse(raw);
-  if (!input.success) throw invalid6("INVALID_BUSINESS_CONTENT_QUERY", "NOT_SENT");
+  if (!input.success) throw invalid7("INVALID_BUSINESS_CONTENT_QUERY", "NOT_SENT");
   const { offset, expectedDocumentHash, ...sourceInput } = input.data;
   const args = businessDocumentInputSchema.parse({
     sourceTool: "cf_read_business_content",
@@ -8860,18 +9489,18 @@ async function readNativeBusinessPage(client, raw, timeout = 3e4) {
   const value = await callTool(client, document, args, timeout, true);
   const parsed = businessContentPageSchema.safeParse(value);
   if (!parsed.success || Buffer.byteLength(JSON.stringify(value)) > 6e3)
-    throw invalid6("INVALID_BUSINESS_CONTENT_REPLY");
+    throw invalid7("INVALID_BUSINESS_CONTENT_REPLY");
   const p = parsed.data;
   if (p.sourceInput.ref !== sourceInput.ref || p.sourceInput.expectedVersion !== sourceInput.expectedVersion || p.offset !== offset || expectedDocumentHash && p.documentHash !== expectedDocumentHash || (p.hasMore ? p.nextOffset !== offset + [...p.text].length : p.nextOffset !== null) || p.hasMore !== offset + [...p.text].length < p.totalCharacters)
-    throw invalid6("INVALID_BUSINESS_CONTENT_REPLY");
+    throw invalid7("INVALID_BUSINESS_CONTENT_REPLY");
   return p;
 }
-function invalid6(code2, outcome = "REJECTED") {
+function invalid7(code2, outcome = "REJECTED") {
   return new CliError(code2, "Use the exact bounded search or content-page contract.", outcome);
 }
 function checkTimeout3(value) {
   if (!Number.isInteger(value) || value < 100 || value > 12e4)
-    throw invalid6("INVALID_TIMEOUT", "NOT_SENT");
+    throw invalid7("INVALID_TIMEOUT", "NOT_SENT");
 }
 
 // packages/cli-client/src/client.ts
@@ -8882,43 +9511,103 @@ async function withNativeAgentClient(connection, action, options = {}) {
   return withClient(
     connection,
     timeout,
-    (client) => action({
-      readPackageFile: (input) => readNativePackageFile(connection, input, timeout),
-      readProjectMediaFile: (input) => readNativeProjectMediaFile(connection, input, timeout),
-      uploadProjectMedia: (file) => uploadNativeProjectMedia(connection, file, timeout),
-      uploadMaterial: (file) => uploadNativeMaterial(connection, file, timeout),
-      inspectTool: (name) => inspectNativeTool(client, name, timeout, definitions),
-      callTool: (name, input = {}, options2) => callNativeTool(client, name, input, connection.resource, options2, timeout, definitions),
-      listToolsPage: (input = {}) => listNativeToolsPage(client, input, timeout),
-      readCapabilitySchemaPage: (input) => readNativeCapabilitySchemaPage(client, input, timeout),
-      readDocumentPage: (input) => readNativeDocumentPage(client, input, timeout),
-      getBusinessSummary: (input) => getNativeBusinessSummary(client, input, timeout),
-      callCapability: (input) => callNativeCapability(client, input, timeout),
-      readCapability: (input) => readNativeCapability(client, input, timeout),
-      writeCapability: (input) => writeNativeCapability(client, input, timeout),
-      describeCapabilitySummary: (name) => readNativeCapabilityDescriptor(client, name, timeout),
-      searchBusiness: (input) => searchNativeBusiness(client, input, timeout),
-      readBusinessPage: (input) => readNativeBusinessPage(client, input, timeout),
-      findCapabilities: (input) => findNativeCapabilities(client, input, timeout),
-      discoverCapabilities: async (input) => {
-        const page2 = await findAgentCapabilities(client, input, timeout);
-        for (const item of page2.items) if (item.definition) definitions.remember(item.definition);
-        return page2;
-      },
-      describeCapability: async (name, expectedHash) => {
-        const cached = expectedHash ? definitions.get(name, expectedHash) : void 0;
-        if (cached) return cached;
-        const definition = await describeNativeCapability(client, name, timeout);
-        if (expectedHash && definition.schemaSha256 !== expectedHash)
-          throw new CliError(
-            "CAPABILITY_SCHEMA_CHANGED",
-            "Discover the current definition again.",
-            "REJECTED"
-          );
-        definitions.remember(definition);
-        return definition;
-      }
-    })
+    (client) => {
+      let version = readNativeServerVersion(client);
+      let versionUnverified = false;
+      client.setNotificationHandler("notifications/tools/list_changed", () => {
+        definitions.clear();
+      });
+      return action(
+        new Proxy(
+          {
+            getHumanPresentation: (input) => getNativeHumanPresentation(client, connection.resource, input, timeout),
+            issueHumanReadLink: (input) => issueNativeHumanReadLink(client, connection.resource, input, timeout),
+            getHumanReadLink: (input) => getNativeHumanReadLink(client, connection.resource, input, timeout),
+            getHumanReadLinkReceipt: (input) => getNativeHumanReadLinkReceipt(client, connection.resource, input, timeout),
+            revokeHumanReadLink: (input) => revokeNativeHumanReadLink(client, connection.resource, input, timeout),
+            cleanupHumanReadLinks: (input = {}) => cleanupNativeHumanReadLinks(client, connection.resource, input, timeout),
+            getVersion: () => structuredClone(version),
+            refreshVersion: async () => {
+              definitions.clear();
+              try {
+                version = await refreshNativeServerVersion(client, timeout);
+                versionUnverified = false;
+              } catch (error) {
+                version = { ...version, compatibility: assessNativeCompatibility(version.client) };
+                versionUnverified = true;
+                throw error;
+              }
+              assertNativeCompatibility(version, options.requireCompatibility);
+              options.onVersion?.(version);
+              return structuredClone(version);
+            },
+            readPackageFile: (input) => readNativePackageFile(connection, input, timeout),
+            readProjectMediaFile: (input) => readNativeProjectMediaFile(connection, input, timeout),
+            uploadProjectMedia: (file) => uploadNativeProjectMedia(connection, file, timeout),
+            uploadMaterial: (file) => uploadNativeMaterial(connection, file, timeout),
+            inspectTool: (name) => inspectNativeTool(client, name, timeout, definitions),
+            callTool: (name, input = {}, options2) => callNativeTool(
+              client,
+              name,
+              input,
+              connection.resource,
+              options2,
+              timeout,
+              definitions
+            ),
+            listToolsPage: (input = {}) => listNativeToolsPage(client, input, timeout),
+            readCapabilitySchemaPage: (input) => readNativeCapabilitySchemaPage(client, input, timeout),
+            readDocumentPage: (input) => readNativeDocumentPage(client, input, timeout),
+            getBusinessSummary: (input) => getNativeBusinessSummary(client, input, timeout),
+            callCapability: (input) => callNativeCapability(client, input, timeout),
+            readCapability: (input) => readNativeCapability(client, input, timeout),
+            writeCapability: (input) => writeNativeCapability(client, input, timeout),
+            describeCapabilitySummary: (name) => readNativeCapabilityDescriptor(client, name, timeout),
+            searchBusiness: (input) => searchNativeBusiness(client, input, timeout),
+            readBusinessPage: (input) => readNativeBusinessPage(client, input, timeout),
+            findCapabilities: (input) => findNativeCapabilities(client, input, timeout),
+            discoverCapabilities: async (input) => {
+              const page2 = await findAgentCapabilities(client, input, timeout);
+              for (const item of page2.items)
+                if (item.definition) definitions.remember(item.definition);
+              return page2;
+            },
+            describeCapability: async (name, expectedHash) => {
+              const cached = expectedHash ? definitions.get(name, expectedHash) : void 0;
+              if (cached) return cached;
+              const definition = await describeNativeCapability(client, name, timeout);
+              if (expectedHash && definition.schemaSha256 !== expectedHash)
+                throw new CliError(
+                  "CAPABILITY_SCHEMA_CHANGED",
+                  "Discover the current definition again.",
+                  "REJECTED"
+                );
+              definitions.remember(definition);
+              return definition;
+            }
+          },
+          {
+            get(target, name, receiver) {
+              const method = Reflect.get(target, name, receiver);
+              if (typeof method !== "function" || name === "getVersion" || name === "refreshVersion")
+                return method;
+              return async (...args) => {
+                if (versionUnverified)
+                  throw new CliError(
+                    "CLIENT_VERSION_UNVERIFIED",
+                    "Verify the service release again or reconnect before continuing. No business operation was sent.",
+                    "NOT_SENT",
+                    { compatibility: version.compatibility }
+                  );
+                assertNativeCompatibility(version, options.requireCompatibility);
+                return Reflect.apply(method, target, args);
+              };
+            }
+          }
+        )
+      );
+    },
+    options
   );
 }
 function checkTimeout4(timeout) {
@@ -9073,9 +9762,22 @@ var values = /* @__PURE__ */ new Set([
   "scope",
   "job",
   "view",
-  "schema-hash"
+  "schema-hash",
+  "mode",
+  "channel",
+  "pin",
+  "interval-hours"
+]);
+var flags = /* @__PURE__ */ new Set([
+  "json",
+  "stdin",
+  "help",
+  "version",
+  "server",
+  "strict",
+  "allow-breaking",
+  "dry-run"
 ]);
-var flags = /* @__PURE__ */ new Set(["json", "stdin", "help"]);
 function parseArgs(args) {
   const options = {};
   const words = [];
@@ -9154,8 +9856,8 @@ async function login(store, rawResource, scope2, timeout, notify) {
     const state = randomBytes(32).toString("base64url");
     let resolveCode;
     let rejectCode;
-    const codePromise = new Promise((resolve, reject) => {
-      resolveCode = resolve;
+    const codePromise = new Promise((resolve2, reject) => {
+      resolveCode = resolve2;
       rejectCode = reject;
     });
     void codePromise.catch(() => void 0);
@@ -9186,9 +9888,9 @@ async function login(store, rawResource, scope2, timeout, notify) {
     });
     let timer;
     try {
-      await new Promise((resolve, reject) => {
+      await new Promise((resolve2, reject) => {
         server.once("error", reject);
-        server.listen(0, "127.0.0.1", resolve);
+        server.listen(0, "127.0.0.1", resolve2);
       });
       const address = server.address();
       if (!address || typeof address === "string")
@@ -9258,7 +9960,7 @@ Waiting up to 5 minutes. For remote/headless Agents, use auth import with a prov
     } finally {
       if (timer) clearTimeout(timer);
       server.closeAllConnections();
-      await new Promise((resolve) => server.close(() => resolve()));
+      await new Promise((resolve2) => server.close(() => resolve2()));
     }
   });
 }
@@ -9333,6 +10035,10 @@ var fullHelp = {
   executable: "cf-agent",
   transport: "OAuth-authenticated HTTPS MCP; no local database",
   commands: [
+    "version [--server [--strict] [--profile <name>]]",
+    "update check [--channel latest|next|beta] [--pin <exact-version>|none]",
+    "update apply [--dry-run] [--allow-breaking] [--channel latest|next|beta] [--pin <exact-version>|none]",
+    "update policy [--mode off|notify|auto] [--channel latest|next|beta] [--pin <exact-version>|none] [--interval-hours <1..168>]",
     "auth login --resource <url> [--scope <scopes>] [--profile <name>]",
     "auth import --resource <url> --token-file <private-file> [--profile <name>]",
     "auth status|refresh|logout [--profile <name>]",
@@ -9355,6 +10061,7 @@ var fullHelp = {
     "tools inspect <cf_tool>",
     "tools call <cf_tool> [--input-file <file>|--stdin]",
     ...Object.keys(commandTools).map((name) => `${name} [--input-file <file>|--stdin]`),
+    ...Object.keys(humanCommands).map((name) => `${name} [--input-file <file>|--stdin]`),
     "task read <kind> --job JOB-000001",
     "result submit <kind> (--input-file <file>|--stdin)"
   ],
@@ -9376,6 +10083,8 @@ var help = {
   executable: "cf-agent",
   transport: "OAuth-authenticated MCP; no local database",
   commands: [
+    "version [--server [--strict]]",
+    "update check|apply|policy (help update for channels, pins and automatic updates)",
     "auth login --resource <url> [--scope <scopes>]",
     "search [<text>] [--input-file <query.json>|--stdin]",
     "business read (--input-file <ref-and-page.json>|--stdin)",
@@ -9412,6 +10121,13 @@ function groupHelp(group) {
 function resolveBaseCommand(parsed) {
   const { words, options } = parsed;
   const name = words.join(" ");
+  if (Object.hasOwn(humanCommands, name)) {
+    if (Object.keys(options).some(
+      (key2) => !["input-file", "stdin", "profile", "json", "timeout-ms"].includes(key2)
+    ))
+      throw new CliError("INVALID_OPTION", "Unsupported human presentation option.");
+    return { mode: "human" };
+  }
   if (name === "media file" || name === "packages file") {
     if (Object.keys(options).some(
       (k) => !["output-file", "profile", "input-file", "stdin", "timeout-ms", "json"].includes(k)
@@ -9520,6 +10236,21 @@ function resolveBaseCommand(parsed) {
   throw new CliError("INVALID_COMMAND", "Run help for supported commands.");
 }
 function resolveCommand(parsed) {
+  if ([
+    "mode",
+    "channel",
+    "pin",
+    "interval-hours",
+    "version",
+    "server",
+    "strict",
+    "allow-breaking",
+    "dry-run"
+  ].some((key2) => parsed.options[key2]))
+    throw new CliError(
+      "INVALID_OPTION",
+      "Version/update options apply only to version/update commands."
+    );
   const removed = {
     doctor: "context",
     "knowledge sync-all": "knowledge discover",
@@ -9550,6 +10281,14 @@ function resolveCommand(parsed) {
 async function businessCommand(client, parsed, input, resource) {
   const resolved = resolveCommand(parsed);
   const { timeout, options } = parsed;
+  if (resolved.mode === "human")
+    return runHumanCommand(
+      client,
+      resource,
+      parsed.words.join(" "),
+      input,
+      timeout
+    );
   if (resolved.mode === "document")
     return readNativeDocumentPage(
       client,
@@ -9617,6 +10356,8 @@ async function businessCommand(client, parsed, input, resource) {
 // packages/cli-client/src/cli/command-input.ts
 function validateCommandInput(parsed, input) {
   const mode = resolveCommand(parsed).mode;
+  if (mode === "human" && !humanCommands[parsed.words.join(" ")].input.safeParse(input).success)
+    throw new CliError("INVALID_HUMAN_INPUT", "Use the exact human presentation JSON input.");
   if (mode === "upload" && parsed.words.join(" ") === "media upload" && !projectMediaWebUploadSchema.omit({ requestId: true }).safeParse(input).success)
     throw new CliError("INVALID_UPLOAD_INPUT", "Supply explicit real-media provenance JSON.");
   const schemas = {
@@ -9654,14 +10395,430 @@ function validateCommandInput(parsed, input) {
     throw new CliError("INVALID_PAGINATION", "Supply only an optional nonempty cursor.");
 }
 
+// packages/cli-client/src/updates/registry.ts
+async function checkNativeUpdates(options = {}) {
+  const policy = updatePolicySchema.parse(options.policy ?? {});
+  const current = releaseVersionSchema.safeParse(
+    options.currentVersion ?? nativeClientRelease.version
+  );
+  if (!current.success)
+    throw new CliError(
+      "INVALID_UPDATE_VERSION",
+      "The installed version must be an exact semantic version."
+    );
+  const timeout = options.timeoutMs ?? 5e3;
+  if (!Number.isInteger(timeout) || timeout < 100 || timeout > 12e4)
+    throw new CliError("INVALID_TIMEOUT", "Timeout must be 100\u2013120000 milliseconds.");
+  const name = nativeClientRelease.packages[options.package ?? "sdk"];
+  if (!name) throw new CliError("INVALID_UPDATE_PACKAGE", "Choose sdk or cli.");
+  const selector = policy.pin ?? policy.channel;
+  const url = `https://registry.npmjs.org/${encodeURIComponent(name)}/${encodeURIComponent(selector)}`;
+  let target;
+  try {
+    const response = await (options.fetch ?? fetch)(url, {
+      redirect: "error",
+      credentials: "omit",
+      signal: AbortSignal.timeout(timeout),
+      headers: { accept: "application/json" }
+    });
+    if (!response.ok || !response.body) throw new Error();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 128 * 1024) throw new Error();
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel().catch(() => void 0);
+      reader.releaseLock();
+    }
+    target = registryReleaseSchema.parse(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+    if (target.name !== name || policy.pin && target.version !== policy.pin) throw new Error();
+  } catch {
+    throw new CliError(
+      "UPDATE_CHECK_UNAVAILABLE",
+      "Cannot verify release metadata from the public npm registry. Existing software and credentials are unchanged."
+    );
+  }
+  return {
+    checkedAt: Date.now(),
+    target,
+    plan: planNativeUpdate({
+      target,
+      policy,
+      nodeMajor: Number(process.versions.node.split(".")[0]),
+      currentVersion: current.data,
+      ...options.server ? { server: options.server } : {}
+    })
+  };
+}
+
+// packages/cli-client/src/updates/store.ts
+import { lstat as lstat2, open as open6, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+var UpdateStore = class {
+  files;
+  constructor(env) {
+    const base2 = new ProfileStore(env).directory;
+    this.files = new ProfileStore({ CF_AGENT_CONFIG_DIR: join3(base2, "client-lifecycle") }, "state");
+  }
+  async read() {
+    try {
+      await lstat2(this.files.path);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return { schemaVersion: 1, policy: updatePolicySchema.parse({}) };
+      throw error;
+    }
+    let raw;
+    try {
+      raw = JSON.parse(await readFileBounded(this.files.path, true));
+    } catch {
+      throw new CliError(
+        "INVALID_UPDATE_CONFIGURATION",
+        "Update state is unreadable. Inspect the client-lifecycle configuration."
+      );
+    }
+    const parsed = clientUpdateStateSchema.safeParse(raw);
+    if (!parsed.success)
+      throw new CliError(
+        "INVALID_UPDATE_CONFIGURATION",
+        "Update state is invalid. Inspect the client-lifecycle configuration."
+      );
+    return parsed.data;
+  }
+  locked(action) {
+    return this.files.locked(action);
+  }
+  async change(action) {
+    return this.locked(async () => {
+      const state = clientUpdateStateSchema.parse(action(await this.read()));
+      const temporary = `${this.files.path}.${randomUUID3()}.tmp`;
+      const file = await open6(temporary, "wx", 384);
+      try {
+        try {
+          await file.writeFile(JSON.stringify(state) + "\n");
+          await file.sync();
+        } finally {
+          await file.close();
+        }
+        await rename2(temporary, this.files.path);
+      } finally {
+        await unlink2(temporary).catch(() => void 0);
+      }
+      return state;
+    });
+  }
+};
+function effectiveUpdatePolicy(policy, env) {
+  const parsed = updatePolicySchema.safeParse({
+    ...policy,
+    ...env.CF_AGENT_UPDATE_MODE ? { mode: env.CF_AGENT_UPDATE_MODE } : {},
+    ...env.CF_AGENT_UPDATE_CHANNEL ? { channel: env.CF_AGENT_UPDATE_CHANNEL } : {},
+    ...env.CF_AGENT_UPDATE_PIN ? { pin: env.CF_AGENT_UPDATE_PIN === "none" ? null : env.CF_AGENT_UPDATE_PIN } : {}
+  });
+  if (!parsed.success)
+    throw new CliError("INVALID_UPDATE_CONFIGURATION", "Invalid update environment policy.");
+  return parsed.data;
+}
+
+// packages/cli-client/src/updates/install.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { readFile as readFile2, realpath as realpath2 } from "node:fs/promises";
+import { dirname as dirname2, join as join4, resolve } from "node:path";
+var execute = promisify(execFile);
+async function installCliUpdate(input) {
+  const plan = planNativeUpdate({
+    target: input.target,
+    ...input.currentVersion ? { currentVersion: input.currentVersion } : {},
+    policy: input.policy,
+    nodeMajor: Number(process.versions.node.split(".")[0])
+  });
+  if (plan.package !== nativeClientRelease.packages.cli || plan.status !== "UPDATE_AVAILABLE" || !plan.eligibleForAutoUpdate && !input.allowBreaking)
+    throw new CliError(
+      "UPDATE_POLICY_BLOCKED",
+      "This release cannot be installed under the selected policy.",
+      "NOT_SENT",
+      { plan }
+    );
+  if (!input.executablePath || process.platform === "win32")
+    throw new CliError(
+      "MANAGED_UPDATE_UNAVAILABLE",
+      "Use the package manager that owns this installation.",
+      "NOT_SENT",
+      { plan }
+    );
+  const environment = Object.fromEntries(
+    Object.entries(input.env).filter(
+      ([key2, value]) => value !== void 0 && !/^(?:CF_AGENT_|CONTENT_FACTORY_)/i.test(key2)
+    )
+  );
+  environment.CF_AGENT_UPDATE_MODE = "off";
+  environment.NODE_OPTIONS = "--max-old-space-size=384";
+  const options = { env: environment, timeout: input.timeoutMs, maxBuffer: 128 * 1024 };
+  let packageRoot, prefix;
+  try {
+    packageRoot = dirname2(dirname2(await realpath2(input.executablePath)));
+    const manifest = JSON.parse(await readFile2(join4(packageRoot, "package.json"), "utf8"));
+    const root = await realpath2(
+      (await execute("npm", ["root", "--global"], options)).stdout.trim()
+    );
+    prefix = await realpath2((await execute("npm", ["prefix", "--global"], options)).stdout.trim());
+    if (manifest.name !== nativeClientRelease.packages.cli || manifest.version !== plan.currentVersion || packageRoot !== await realpath2(join4(root, "@native-marketing/cli")) || packageRoot !== resolve(prefix, "lib/node_modules/@native-marketing/cli"))
+      throw new Error();
+  } catch {
+    throw new CliError(
+      "MANAGED_UPDATE_UNAVAILABLE",
+      "Automatic installation supports the active npm global installation. Use the owning project/package manager for other installs.",
+      "NOT_SENT",
+      { plan }
+    );
+  }
+  const args = [
+    "install",
+    "--global",
+    "--prefix",
+    prefix,
+    `${plan.package}@${plan.targetVersion}`,
+    "--registry=https://registry.npmjs.org/",
+    "--@native-marketing:registry=https://registry.npmjs.org/",
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund"
+  ];
+  const recovery = [
+    "npm",
+    "install",
+    "--global",
+    "--prefix",
+    prefix,
+    `${plan.package}@${plan.currentVersion}`,
+    "--ignore-scripts",
+    "--registry=https://registry.npmjs.org/",
+    "--@native-marketing:registry=https://registry.npmjs.org/"
+  ];
+  const store = new UpdateStore(input.env);
+  return store.locked(async () => {
+    if (input.automatic) {
+      const latest = effectiveUpdatePolicy((await store.read()).policy, input.env);
+      if (latest.mode !== "auto" || (latest.pin ?? latest.channel) !== (input.policy.pin ?? input.policy.channel) || !planNativeUpdate({
+        target: input.target,
+        currentVersion: plan.currentVersion,
+        policy: latest,
+        nodeMajor: Number(process.versions.node.split(".")[0])
+      }).eligibleForAutoUpdate)
+        throw new CliError(
+          "UPDATE_POLICY_CHANGED",
+          "Automatic update policy changed. No installation or business operation was sent."
+        );
+    }
+    const before = JSON.parse(await readFile2(join4(packageRoot, "package.json"), "utf8"));
+    if (before.name !== plan.package || before.version !== plan.currentVersion)
+      throw new CliError(
+        "UPDATE_INSTALLATION_CHANGED",
+        "The installed version changed. Check version before updating again."
+      );
+    try {
+      await execute("npm", args, { ...options, cwd: prefix });
+      const installed = JSON.parse(await readFile2(join4(packageRoot, "package.json"), "utf8"));
+      if (installed.name !== plan.package || releaseVersionSchema.parse(installed.version) !== plan.targetVersion)
+        throw new Error();
+      const verified = await execute(
+        process.execPath,
+        [join4(packageRoot, "dist/cf.js"), "version", "--json"],
+        options
+      );
+      const result2 = JSON.parse(verified.stdout);
+      if (!result2.ok || result2.data?.version !== plan.targetVersion || result2.data?.sdkVersion !== plan.targetVersion)
+        throw new Error();
+      return {
+        state: "UPDATED",
+        package: plan.package,
+        previousVersion: plan.currentVersion,
+        installedVersion: plan.targetVersion,
+        restartRequired: true,
+        originalCommandExecuted: false,
+        recovery
+      };
+    } catch {
+      throw new CliError(
+        "UPDATE_OUTCOME_UNKNOWN",
+        "The installation may have changed. Inspect version before another update; use the recovery command if needed. The original business command was not sent.",
+        "UNKNOWN",
+        { expectedVersion: plan.targetVersion, recovery, originalCommandExecuted: false }
+      );
+    }
+  });
+}
+
+// packages/cli-client/src/updates/commands.ts
+function validateOptions(parsed, names) {
+  if (Object.keys(parsed.options).some((name) => !["json", "timeout-ms", ...names].includes(name)))
+    throw new CliError("INVALID_OPTION", "Unsupported version/update option. Use help update.");
+}
+function selectedPolicy(saved, parsed) {
+  const options = parsed.options;
+  const result2 = updatePolicySchema.safeParse({
+    ...saved,
+    ...options.mode ? { mode: options.mode } : {},
+    ...options.channel ? { channel: options.channel } : {},
+    ...options.pin ? { pin: options.pin === "none" ? null : options.pin } : {},
+    ...options["interval-hours"] ? { intervalHours: Number(options["interval-hours"]) } : {}
+  });
+  if (!result2.success)
+    throw new CliError(
+      "INVALID_UPDATE_POLICY",
+      "Use mode off/notify/auto, channel latest/next/beta, an exact pin or none, and interval-hours 1\u2013168."
+    );
+  return result2.data;
+}
+async function runLifecycleCommand(parsed, env, executablePath) {
+  const { words, options, timeout } = parsed;
+  if (options.version || words[0] === "version") {
+    if (options.version && words.length !== 0 || !options.version && words.length !== 1)
+      throw new CliError("INVALID_COMMAND", "Use version or --version.");
+    validateOptions(parsed, ["version", "server", "strict", "profile"]);
+    if (options.strict && !options.server)
+      throw new CliError("INVALID_OPTION", "--strict requires version --server.");
+    if (options.profile && !options.server)
+      throw new CliError("INVALID_OPTION", "--profile requires version --server.");
+    return options.server ? null : { command: "version", data: await getNativeCliVersion(executablePath) };
+  }
+  if (words[0] !== "update") return null;
+  if (words.length !== 2 || !["check", "apply", "policy"].includes(words[1]))
+    throw new CliError("INVALID_COMMAND", "Use update check/apply/policy.");
+  const policyCommand = words[1] === "policy";
+  validateOptions(
+    parsed,
+    policyCommand ? ["mode", "channel", "pin", "interval-hours"] : ["channel", "pin", ...words[1] === "apply" ? ["allow-breaking", "dry-run"] : []]
+  );
+  const store = new UpdateStore(env);
+  const state = await store.read();
+  if (policyCommand) {
+    const changes = Object.keys(options).some(
+      (name) => ["mode", "channel", "pin", "interval-hours"].includes(name)
+    );
+    const saved = changes ? await store.change((current) => ({
+      ...current,
+      policy: selectedPolicy(current.policy, parsed)
+    })) : state;
+    return {
+      command: "update policy",
+      data: {
+        saved: saved.policy,
+        effective: effectiveUpdatePolicy(saved.policy, env),
+        lastCheckedAt: saved.lastCheck?.at ?? null
+      }
+    };
+  }
+  const policy = selectedPolicy(effectiveUpdatePolicy(state.policy, env), parsed);
+  const currentVersion = (await getNativeCliVersion(executablePath)).version;
+  const checked = await checkNativeUpdates({
+    package: "cli",
+    currentVersion,
+    policy,
+    timeoutMs: timeout
+  });
+  await store.change((current) => ({
+    ...current,
+    lastAttempt: { at: checked.checkedAt, selector: policy.pin ?? policy.channel },
+    lastCheck: {
+      at: checked.checkedAt,
+      selector: policy.pin ?? policy.channel,
+      target: checked.target
+    }
+  }));
+  if (words[1] === "check" || options["dry-run"] || checked.plan.status === "CURRENT")
+    return { command: words.join(" "), data: checked };
+  const data = await installCliUpdate({
+    target: checked.target,
+    currentVersion,
+    policy,
+    timeoutMs: timeout,
+    env,
+    allowBreaking: Boolean(options["allow-breaking"]),
+    ...executablePath ? { executablePath } : {}
+  });
+  return { command: "update apply", data };
+}
+async function maybeAutoUpdate(env, io, timeout) {
+  if (!io.executablePath || env.CF_AGENT_UPDATE_MODE === "off" || env.CI && !env.CF_AGENT_UPDATE_MODE)
+    return null;
+  const notify = io.notify ?? ((message) => process.stderr.write(message + "\n"));
+  try {
+    const store = new UpdateStore(env);
+    const state = await store.read();
+    const policy = effectiveUpdatePolicy(state.policy, env);
+    if (policy.mode === "off") return null;
+    const now = Date.now(), selector = policy.pin ?? policy.channel;
+    const age = state.lastAttempt ? now - state.lastAttempt.at : Infinity;
+    if (state.lastAttempt?.selector === selector && age >= 0 && age < policy.intervalHours * 36e5)
+      return null;
+    let claimed = false;
+    await store.change((current) => {
+      const age2 = current.lastAttempt ? now - current.lastAttempt.at : Infinity;
+      if (current.lastAttempt?.selector === selector && age2 >= 0 && age2 < policy.intervalHours * 36e5)
+        return current;
+      claimed = true;
+      return { ...current, lastAttempt: { at: now, selector } };
+    });
+    if (!claimed) return null;
+    const currentVersion = (await getNativeCliVersion(io.executablePath)).version;
+    const checked = await checkNativeUpdates({
+      package: "cli",
+      currentVersion,
+      policy,
+      timeoutMs: Math.min(timeout, 2e3)
+    });
+    await store.change((current) => ({
+      ...current,
+      lastCheck: { at: checked.checkedAt, selector, target: checked.target }
+    }));
+    if (checked.plan.status === "CURRENT" || checked.plan.reason === "DOWNGRADE_FORBIDDEN" && !policy.pin)
+      return null;
+    if (policy.mode === "auto" && checked.plan.eligibleForAutoUpdate) {
+      const data = await installCliUpdate({
+        target: checked.target,
+        currentVersion,
+        automatic: true,
+        policy,
+        executablePath: io.executablePath,
+        env,
+        timeoutMs: timeout
+      });
+      notify(
+        `Native Marketing updated to ${checked.plan.targetVersion}. Run the original command again.`
+      );
+      return { command: "update auto", data };
+    }
+    notify(
+      `Native Marketing ${nativeClientRelease.version}: update ${checked.plan.targetVersion} (${checked.plan.reason}). Use update check or update apply.`
+    );
+  } catch (error) {
+    if (error instanceof CliError && error.code === "UPDATE_OUTCOME_UNKNOWN") throw error;
+    notify("Native Marketing update check/install is unavailable; use update check for details.");
+  }
+  return null;
+}
+
 // packages/cli-client/src/cli/run.ts
 async function runNetworkCli(args, env = process.env, io = {}, executable = "cf") {
   let command5 = executable;
   try {
     const parsed = parseArgs(args);
     const { words, options, timeout } = parsed;
-    if (!words.length || words[0] === "help" || options.help)
+    if ((!words.length || words[0] === "help" || options.help) && !options.version)
       return success("help", { ...commandHelp(words), executable });
+    const local = await runLifecycleCommand(parsed, env, io.executablePath);
+    if (local) return success(local.command, local.data);
+    const remoteVersion = (words.join(" ") === "version" || options.version && !words.length) && options.server;
     const store = new ProfileStore(env, String(options.profile ?? "default"));
     if (words[0] === "auth") {
       if (words.length !== 2)
@@ -9733,10 +10890,14 @@ async function runNetworkCli(args, env = process.env, io = {}, executable = "cf"
         "AUTH_OPTION_MISUSE",
         "Resource/token/scope options belong to auth commands. Business commands use the bound profile or CF_AGENT_RESOURCE and CF_AGENT_ACCESS_TOKEN together."
       );
-    resolveCommand(parsed);
-    command5 = words[0] === "search" ? "search" : words[0] === "capabilities" ? words.slice(0, 2).join(" ") : words.join(" ");
+    if (!remoteVersion) resolveCommand(parsed);
+    command5 = remoteVersion ? "version" : words[0] === "search" ? "search" : words[0] === "capabilities" ? words.slice(0, 2).join(" ") : words.join(" ");
+    if (!remoteVersion) {
+      const automatic = await maybeAutoUpdate(env, io, timeout);
+      if (automatic) return success(automatic.command, automatic.data);
+    }
     const input = options.stdin ? objectJson(await readStream(io.stdin ?? process.stdin)) : typeof options["input-file"] === "string" ? objectJson(await readFileBounded(options["input-file"])) : {};
-    validateCommandInput(parsed, input);
+    if (!remoteVersion) validateCommandInput(parsed, input);
     let profile;
     if (env.CF_AGENT_ACCESS_TOKEN || env.CF_AGENT_RESOURCE) {
       if (options.profile || !env.CF_AGENT_ACCESS_TOKEN || !env.CF_AGENT_RESOURCE)
@@ -9749,7 +10910,18 @@ async function runNetworkCli(args, env = process.env, io = {}, executable = "cf"
         accessToken: tokenText(env.CF_AGENT_ACCESS_TOKEN)
       };
     } else profile = await refreshProfile(store, timeout);
-    const data = resolveCommand(parsed).mode === "package-file" ? await downloadPackageFile(profile, input, String(options["output-file"]), timeout) : resolveCommand(parsed).mode === "media-file" ? await downloadProjectMedia(profile, input, String(options["output-file"]), timeout) : resolveCommand(parsed).mode === "upload" ? await uploadLocalMaterial(
+    const data = remoteVersion ? await withClient(
+      profile,
+      timeout,
+      async (client) => ({
+        ...readNativeServerVersion(client),
+        cli: await getNativeCliVersion(io.executablePath)
+      }),
+      {
+        allowIncompatible: !options.strict,
+        requireCompatibility: Boolean(options.strict)
+      }
+    ) : resolveCommand(parsed).mode === "package-file" ? await downloadPackageFile(profile, input, String(options["output-file"]), timeout) : resolveCommand(parsed).mode === "media-file" ? await downloadProjectMedia(profile, input, String(options["output-file"]), timeout) : resolveCommand(parsed).mode === "upload" ? await uploadLocalMaterial(
       profile,
       String(options.file),
       String(options["request-id"]),
@@ -9758,7 +10930,15 @@ async function runNetworkCli(args, env = process.env, io = {}, executable = "cf"
     ) : await withClient(
       profile,
       timeout,
-      (client) => businessCommand(client, parsed, input, profile.resource)
+      (client) => businessCommand(client, parsed, input, profile.resource),
+      {
+        onVersion: (version) => {
+          if (version.compatibility.status === "UPGRADE_RECOMMENDED")
+            (io.notify ?? ((message) => process.stderr.write(message + "\n")))(
+              `The service recommends Native Marketing ${version.compatibility.server.version}. Use update check.`
+            );
+        }
+      }
     );
     return success(command5, data);
   } catch (error) {
@@ -9768,16 +10948,57 @@ async function runNetworkCli(args, env = process.env, io = {}, executable = "cf"
 function success(command5, data) {
   return { exitCode: 0, envelope: { ok: true, command: command5, data, error: null } };
 }
+
+// packages/cli-client/src/cli/output.ts
+function formatNetworkCliResult(result2, json = false) {
+  const { envelope } = result2;
+  if (!json && envelope.ok && envelope.command.startsWith("human ")) {
+    const data = envelope.data;
+    const value = data.status === "FOUND" ? data.receipt : data;
+    const parsed = humanPresentationSchema.safeParse(value.human);
+    if (parsed.success) {
+      const lines = [envelope.command, ...value.state ? [`\u72B6\u6001\uFF1A${value.state}`] : []];
+      for (const card of parsed.data.interactions)
+        lines.push(
+          `${card.title} \xB7 ${card.state}`,
+          card.summary,
+          `\u6B63\u5F0F\u5BA1\u6838\u5165\u53E3\uFF08\u9700\u8981\u767B\u5F55\uFF09\uFF1A${card.reviewUrl}`
+        );
+      for (const link of parsed.data.links)
+        lines.push(
+          `${link.title} \xB7 \u9605\u8BFB`,
+          link.access === "TEMPORARY_PUBLIC_READ" ? `\u4E34\u65F6\u516C\u5F00\u53EA\u8BFB\u5FEB\u7167\uFF1B\u6301\u94FE\u63A5\u8005\u65E0\u9700\u767B\u5F55\u3002\u5230\u671F\uFF1A${link.expiresAt}` : "\u5F53\u524D\u5185\u5BB9\uFF1B\u9700\u8981\u767B\u5F55\u3002",
+          link.url
+        );
+      if (value.issuanceRequestId) lines.push(`\u539F\u7B7E\u53D1\u8BF7\u6C42\uFF1A${value.issuanceRequestId}`);
+      if (!parsed.data.links.length && !parsed.data.interactions.length)
+        lines.push("\u5F53\u524D\u65E0\u53EF\u7528\u9605\u8BFB\u94FE\u63A5\u6216\u4EA4\u4E92\u3002");
+      return lines.join("\n") + "\n";
+    }
+  }
+  return JSON.stringify(envelope, null, json ? void 0 : 2) + "\n";
+}
 export {
   CliError as NativeAgentClientError,
+  assessNativeCompatibility,
   callNativeCapability,
   callNativeTool,
+  checkNativeUpdates,
+  cleanupNativeHumanReadLinks,
+  defaultUpdatePolicy,
   describeNativeCapability,
   findAgentCapabilities,
   findNativeCapabilities,
+  formatNetworkCliResult,
   getNativeBusinessSummary,
+  getNativeClientVersion,
+  getNativeHumanPresentation,
+  getNativeHumanReadLink,
+  getNativeHumanReadLinkReceipt,
   inspectNativeTool,
+  issueNativeHumanReadLink,
   listNativeToolsPage,
+  planNativeUpdate,
   projectMediaFileQuerySchema,
   readNativeBusinessPage,
   readNativeCapability,
@@ -9786,6 +11007,7 @@ export {
   readNativeDocumentPage,
   readNativePackageFile,
   readNativeProjectMediaFile,
+  revokeNativeHumanReadLink,
   runNetworkCli,
   searchNativeBusiness,
   uploadNativeMaterial,