@openbkn/bkn-sdk 0.1.1-alpha.1 → 0.1.1-alpha.11

package/dist/cli.js

@@ -1,47 +1,56 @@
 #!/usr/bin/env node
 import {
+  DEFAULT_BUSINESS_DOMAIN,
   DEFAULT_LIST_LIMIT,
   DEFAULT_QUERY_LIMIT,
+  HttpError,
   InputError,
   activePlatform,
+  attachNoAuth,
   attachToken,
-  changePassword,
   createClient,
+  credentialDeviceLogin,
   currentToken,
+  currentTokenFresh,
+  decodeJwt,
   deletePlatform,
+  deviceLogin,
   exportCreds,
+  fetchAuthStatus,
   formatError,
+  getUserSafe,
+  isHeadless,
   listPlatforms,
   logout,
+  openBrowser,
   parseEmbeddingFields,
   parsePkMap,
   rawCall,
   readPlatformConfig,
-  renderOrgTree,
   renderReportMarkdown,
+  request,
   resolveContext,
   setActivePlatform,
   status,
   switchUser,
   toExitCode,
   use,
-  usersOf,
   whoami,
   writePlatformConfig
-} from "./chunk-ADZ23DPF.js";
+} from "./chunk-SEKM54NB.js";
 
 // src/cli.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 
 // package.json
 var package_default = {
   name: "@openbkn/bkn-sdk",
-  version: "0.1.1-alpha.1",
+  version: "0.1.1-alpha.11",
   description: "Unified TypeScript SDK + CLI for the BKN (Business Knowledge Network) platform.",
   type: "module",
   license: "Apache-2.0",
   engines: {
-    node: ">=22"
+    node: ">=18"
   },
   bin: {
     openbkn: "./dist/cli.js"
@@ -76,6 +85,7 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^0.9.1",
+    "@openbkn/bkn-sdk": "^0.1.1-alpha.3",
     chalk: "^5.4.1",
     commander: "^13.1.0",
     "csv-parse": "^6.2.1",
@@ -148,6 +158,19 @@ function installGroupedHelp(root) {
   apply(root);
 }
 
+// src/utils/org-tree.ts
+function renderOrgTree(nodes, prefix = "") {
+  const lines = [];
+  nodes.forEach((node, i) => {
+    const last = i === nodes.length - 1;
+    lines.push(`${prefix}${last ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${node.name} (id: ${node.id})`);
+    if (node.children.length) {
+      lines.push(renderOrgTree(node.children, `${prefix}${last ? "    " : "\u2502   "}`));
+    }
+  });
+  return lines.join("\n");
+}
+
 // src/utils/output.ts
 function printJson(value, opts = {}) {
   if (opts.json || opts.compact) {
@@ -157,10 +180,11 @@ function printJson(value, opts = {}) {
   }
   const rows = toRows(value);
   if (rows) {
-    const columns = opts.full ? columnsOf(rows).filter((c) => rows.some((r) => stringifyCell(r[c]) !== "")) : selectColumns(rows);
+    const fullColumns = columnsOf(rows).filter((c) => rows.some((r) => stringifyCell(r[c]) !== ""));
+    const columns = opts.full ? fullColumns : selectColumns(rows);
     if (columns.length > 0) {
       printTable(rows, columns);
-      const hidden = columnsOf(rows).length - columns.length;
+      const hidden = fullColumns.length - columns.length;
       if (hidden > 0 && !opts.full) {
         process.stdout.write(`\u2026 ${hidden} more column(s); use --full or --json for everything
 `);
@@ -168,10 +192,32 @@ function printJson(value, opts = {}) {
       return;
     }
   }
+  if (isEmptyEnvelope(value)) {
+    process.stdout.write("(no results)\n");
+    return;
+  }
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
-var ROW_ENVELOPES = ["entries", "data", "cases", "reports", "results", "list", "recurringRules"];
+function isEmptyEnvelope(value) {
+  if (!value || typeof value !== "object") return false;
+  const o = value;
+  return ROW_ENVELOPES.some((k) => Array.isArray(o[k]) && o[k].length === 0);
+}
+var ROW_ENVELOPES = [
+  "entries",
+  "data",
+  "cases",
+  "reports",
+  "results",
+  "list",
+  "recurringRules",
+  "users",
+  "roles",
+  "departments",
+  "members",
+  "keys"
+];
 function toRows(value) {
   const isRowArray = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => x !== null && typeof x === "object" && !Array.isArray(x));
   if (isRowArray(value)) return value;
@@ -255,6 +301,25 @@ function stringifyCell(v) {
   return s.length > CELL_MAX ? `${s.slice(0, CELL_MAX - 1)}\u2026` : s;
 }
 
+// src/utils/prompt.ts
+import { createInterface } from "readline";
+function promptLine(query, hidden = false) {
+  return new Promise((resolve2) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    if (hidden) {
+      const mutable = rl;
+      mutable._writeToOutput = (s) => {
+        if (s.startsWith(query)) process.stdout.write(query);
+      };
+    }
+    rl.question(query, (answer) => {
+      rl.close();
+      if (hidden) process.stdout.write("\n");
+      resolve2(answer.trim());
+    });
+  });
+}
+
 // src/commands/_shared.ts
 import { readFileSync } from "fs";
 function clientFrom(cmd) {
@@ -286,350 +351,212 @@ function readBody(opts) {
 }
 
 // src/commands/auth.ts
-import { readFileSync as readFileSync2 } from "fs";
 import { Command } from "commander";
 
-// src/auth/oauth.ts
-import { spawn } from "child_process";
-import { createHash, constants as cryptoConstants, publicEncrypt, randomBytes } from "crypto";
-import { createServer } from "http";
-var DEFAULT_REDIRECT_PORT = 9010;
-var DEFAULT_SCOPE = "openid offline all";
-var STUDIOWEB_LOGIN_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyOstgbYuubBi2PUqeVj
-GKlkwVUY6w1Y8d4k116dI2SkZI8fxcjHALv77kItO4jYLVplk9gO4HAtsisnNE2o
-wlYIqdmyEPMwupaeFFFcg751oiTXJiYbtX7ABzU5KQYPjRSEjMq6i5qu/mL67XTk
-hvKwrC83zme66qaKApmKupDODPb0RRkutK/zHfd1zL7sciBQ6psnNadh8pE24w8O
-2XVy1v2bgSNkGHABgncR7seyIg81JQ3c/Axxd6GsTztjLnlvGAlmT1TphE84mi99
-fUaGD2A1u1qdIuNc+XuisFeNcUW6fct0+x97eS2eEGRr/7qxWmO/P20sFVzXc2bF
-1QIDAQAB
------END PUBLIC KEY-----`;
-function normalizeBaseUrl(value) {
-  return value.replace(/\/+$/, "");
-}
-function generatePkce() {
-  const verifier = randomBytes(48).toString("base64url");
-  return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
-}
-function buildAuthorizeUrl(base, clientId, redirectUri, state, codeChallenge, scope = DEFAULT_SCOPE) {
-  const params = new URLSearchParams({
-    response_type: "code",
-    client_id: clientId,
-    redirect_uri: redirectUri,
-    scope,
-    state,
-    "x-forwarded-prefix": "",
-    lang: "zh-cn",
-    product: "adp",
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256"
-  });
-  return `${base}/oauth2/auth?${params.toString()}`;
-}
-function mapToken(data) {
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    idToken: data.id_token
-  };
-}
-async function registerClient(base, redirectUri, scope = DEFAULT_SCOPE) {
-  const res = await fetch(`${base}/oauth2/clients`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      client_name: "openbkn-cli",
-      grant_types: ["authorization_code", "implicit", "refresh_token"],
-      response_types: ["token id_token", "code", "token"],
-      scope,
-      redirect_uris: [redirectUri],
-      post_logout_redirect_uris: [redirectUri.replace("/callback", "/successful-logout")],
-      metadata: { device: { name: "openbkn-cli", client_type: "web", description: "openbkn CLI" } }
-    })
-  });
-  if (!res.ok) {
-    throw new Error(
-      `Client registration failed (${res.status}): ${await res.text() || res.statusText}`
-    );
-  }
-  const data = await res.json();
-  return { clientId: data.client_id, clientSecret: data.client_secret };
-}
-async function exchangeCode(base, code, redirectUri, client, codeVerifier) {
-  const params = {
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: codeVerifier
-  };
-  const headers = {
-    "Content-Type": "application/x-www-form-urlencoded",
-    Accept: "application/json"
-  };
-  if (client.clientSecret) {
-    headers.Authorization = `Basic ${Buffer.from(`${client.clientId}:${client.clientSecret}`).toString("base64")}`;
-  } else {
-    params.client_id = client.clientId;
-  }
-  const res = await fetch(`${base}/oauth2/token`, {
+// src/api/eacp-crypto.ts
+import {
+  constants,
+  createPrivateKey,
+  createPublicKey,
+  publicEncrypt
+} from "crypto";
+
+// src/api/admin.ts
+async function changePasswordSafe(ctx, account, oldPassword, newPassword) {
+  await request(ctx, "/api/safe/v1/auth/change-password", {
     method: "POST",
-    headers,
-    body: new URLSearchParams(params).toString()
+    body: { account, old_password: oldPassword, new_password: newPassword }
   });
-  if (!res.ok) {
-    throw new Error(
-      `Token exchange failed (${res.status}): ${await res.text() || res.statusText}`
-    );
-  }
-  return mapToken(await res.json());
+  return { ok: true };
 }
-function startCallbackServer(port) {
-  return new Promise((resolve2, reject) => {
-    const server = createServer((req2, res) => {
-      const u = new URL(req2.url ?? "/", `http://127.0.0.1:${port}`);
-      if (u.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      const code = u.searchParams.get("code");
-      const error = u.searchParams.get("error");
-      if (error) {
-        res.writeHead(400, { "content-type": "text/html" });
-        res.end(`<h1>Login failed</h1><p>${error}</p>`);
-        server.close(() => reject(new Error(`OAuth error: ${error}`)));
-        return;
-      }
-      if (!code) {
-        res.writeHead(400);
-        res.end("missing code");
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end("<h1>Login successful</h1><p>You can close this window.</p>");
-      resolve2({
-        code,
-        state: u.searchParams.get("state") ?? void 0,
-        close: () => server.close()
-      });
-    });
-    server.on("error", reject);
-    server.listen(port, "127.0.0.1");
-  });
-}
-function openBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+
+// src/commands/auth.ts
+async function resolveAccount(baseUrl, accessToken, insecure, idToken) {
+  const sub = decodeJwt(idToken ?? accessToken)?.sub;
+  if (!sub) return void 0;
   try {
-    spawn(cmd, [url], {
-      stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32"
-    }).unref();
+    const u = await getUserSafe(
+      { baseUrl, token: accessToken, businessDomain: DEFAULT_BUSINESS_DOMAIN, insecure },
+      sub
+    );
+    return u.account;
   } catch {
+    return void 0;
   }
 }
-async function browserLogin(baseUrl, opts = {}) {
-  const base = normalizeBaseUrl(baseUrl);
-  const port = opts.port ?? DEFAULT_REDIRECT_PORT;
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const scope = opts.scope ?? DEFAULT_SCOPE;
-  const client = opts.clientId ? { clientId: opts.clientId } : await registerClient(base, redirectUri, scope);
-  const { verifier, challenge } = generatePkce();
-  const state = randomBytes(12).toString("hex");
-  const authUrl = buildAuthorizeUrl(base, client.clientId, redirectUri, state, challenge, scope);
-  const waiter = startCallbackServer(port);
-  if (opts.noBrowser) {
-    process.stderr.write(`Open this URL to log in:
-${authUrl}
-`);
-  } else {
-    process.stderr.write(`Opening browser for login\u2026
-If it doesn't open, visit:
-${authUrl}
-`);
-    openBrowser(authUrl);
+function renderSessions(items) {
+  const byPlatform = /* @__PURE__ */ new Map();
+  for (const it of items) {
+    const arr = byPlatform.get(it.baseUrl) ?? [];
+    arr.push(it);
+    byPlatform.set(it.baseUrl, arr);
   }
-  const { code, state: returned, close } = await waiter;
-  close();
-  if (returned && returned !== state) throw new Error("OAuth state mismatch \u2014 possible CSRF.");
-  return exchangeCode(base, code, redirectUri, client, verifier);
-}
-function mergeCookies(existing, res) {
-  const setCookies = typeof res.headers.getSetCookie === "function" ? res.headers.getSetCookie() : res.headers.get("set-cookie") ? [res.headers.get("set-cookie")] : [];
-  const map = /* @__PURE__ */ new Map();
-  const add = (pair) => {
-    const eq = pair.indexOf("=");
-    if (eq > 0) map.set(pair.slice(0, eq), pair.slice(eq + 1));
-  };
-  for (const p of existing.split(";").map((s) => s.trim()).filter(Boolean))
-    add(p);
-  for (const sc of setCookies) add(sc.split(";")[0]?.trim() ?? "");
-  return [...map.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
-}
-function parseSigninProps(html) {
-  const m = html.match(/<script[^>]*\bid=["']__NEXT_DATA__["'][^>]*>([\s\S]*?)<\/script>/i);
-  if (!m?.[1]) throw new Error("Could not find __NEXT_DATA__ on /oauth2/signin.");
-  const data = JSON.parse(m[1]);
-  const pp = data.props?.pageProps;
-  const csrftoken = pp?.csrftoken ?? pp?._csrf;
-  if (typeof csrftoken !== "string") throw new Error("Sign-in page did not expose csrftoken.");
-  return {
-    csrftoken,
-    challenge: typeof pp?.challenge === "string" ? pp.challenge : void 0,
-    remember: pp?.remember === true || pp?.remember === "true"
-  };
-}
-async function followToCallback(startUrl, jar0, state, redirectUri) {
-  let url = startUrl;
-  let jar = jar0;
-  const cb = new URL(redirectUri);
-  for (let hop = 0; hop < 40; hop++) {
-    const resp = await fetch(url, {
-      headers: { Cookie: jar, Accept: "text/html,*/*;q=0.8" },
-      redirect: "manual"
-    });
-    jar = mergeCookies(jar, resp);
-    if (![302, 303, 307, 308].includes(resp.status)) {
-      throw new Error(`Unexpected OAuth response (HTTP ${resp.status}).`);
-    }
-    const loc = resp.headers.get("location");
-    if (!loc) throw new Error(`OAuth redirect missing Location (HTTP ${resp.status}).`);
-    const next = new URL(loc, url);
-    if (next.origin === cb.origin && next.pathname === cb.pathname) {
-      const err = next.searchParams.get("error");
-      if (err) throw new Error(`Authorization failed: ${err}`);
-      const code = next.searchParams.get("code");
-      if (next.searchParams.get("state") !== state) throw new Error("OAuth state mismatch.");
-      if (!code) throw new Error("Callback missing authorization code.");
-      return code;
-    }
-    url = next.href;
+  const lines = [];
+  for (const [platform, users] of byPlatform) {
+    lines.push(platform);
+    for (const u of users) lines.push(`  ${u.active ? "*" : " "} ${u.username ?? u.userId}`);
   }
-  throw new Error("Too many OAuth redirects.");
+  return lines.join("\n") || "(no saved sessions)";
 }
-async function passwordLogin(baseUrl, username, password, opts = {}) {
-  const base = normalizeBaseUrl(baseUrl);
-  const port = opts.port ?? DEFAULT_REDIRECT_PORT;
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const scope = opts.scope ?? DEFAULT_SCOPE;
-  const client = opts.clientId ? { clientId: opts.clientId } : await registerClient(base, redirectUri, scope);
-  const { verifier, challenge } = generatePkce();
-  const state = randomBytes(12).toString("hex");
-  let jar = "";
-  const authResp = await fetch(
-    buildAuthorizeUrl(base, client.clientId, redirectUri, state, challenge, scope),
-    { redirect: "manual" }
-  );
-  jar = mergeCookies(jar, authResp);
-  const authLoc = authResp.headers.get("location");
-  if (!authLoc) throw new Error(`/oauth2/auth did not redirect (HTTP ${authResp.status}).`);
-  const signinUrl = new URL(authLoc, base);
-  if (!signinUrl.pathname.includes("signin")) {
-    throw new Error(`Expected a sign-in redirect, got: ${authLoc}`);
-  }
-  const pageResp = await fetch(signinUrl.href, {
-    headers: { Cookie: jar, Accept: "text/html,*/*;q=0.8" },
-    redirect: "manual"
-  });
-  jar = mergeCookies(jar, pageResp);
-  const props = parseSigninProps(await pageResp.text());
-  const loginChallenge = signinUrl.searchParams.get("login_challenge")?.trim() || props.challenge?.trim();
-  if (!loginChallenge) throw new Error("Could not resolve the login challenge.");
-  const cipher = publicEncrypt(
-    {
-      key: opts.signinPublicKeyPem ?? STUDIOWEB_LOGIN_PUBLIC_KEY_PEM,
-      padding: cryptoConstants.RSA_PKCS1_PADDING
-    },
-    Buffer.from(password, "utf8")
-  ).toString("base64");
-  const postResp = await fetch(`${base}/oauth2/signin`, {
-    method: "POST",
-    headers: {
-      Cookie: jar,
-      "Content-Type": "application/json",
-      Accept: "application/json, text/plain, */*",
-      Origin: new URL(base).origin,
-      Referer: signinUrl.href
-    },
-    body: JSON.stringify({
-      _csrf: props.csrftoken,
-      challenge: loginChallenge,
-      account: username,
-      password: cipher,
-      vcode: { id: "", content: "" },
-      dualfactorauthinfo: { validcode: { vcode: "" }, OTP: { OTP: "" } },
-      remember: props.remember ?? false,
-      device: { name: "", description: "", client_type: "console_web", udids: [] }
-    }),
-    redirect: "manual"
-  });
-  jar = mergeCookies(jar, postResp);
-  let code;
-  if ([302, 303, 307].includes(postResp.status)) {
-    const loc = postResp.headers.get("location");
-    if (!loc) throw new Error("Sign-in response missing Location.");
-    code = await followToCallback(new URL(loc, base).href, jar, state, redirectUri);
-  } else if (postResp.status === 200) {
-    const text = await postResp.text();
-    let json = null;
-    try {
-      json = JSON.parse(text);
-    } catch {
-    }
-    const redir = json && typeof json.redirect === "string" ? json.redirect : "";
-    if (!redir) {
-      const msg = json && typeof json.message === "string" ? json.message : text.slice(0, 300);
-      throw new InputError(`Sign-in failed: ${msg}`);
-    }
-    code = await followToCallback(new URL(redir, base).href, jar, state, redirectUri);
-  } else {
-    throw new InputError(
-      `Sign-in failed (HTTP ${postResp.status}): ${(await postResp.text()).slice(0, 300)}`
-    );
-  }
-  return exchangeCode(base, code, redirectUri, client, verifier);
-}
-
-// src/commands/auth.ts
 function registerAuthLeaves(cmd) {
-  cmd.command("login <url>").description("Log in to a platform (attach a token, or browser/password OAuth)").option("-u, --username <name>", "username for password signin").option("-p, --password <pwd>", "password for password signin").option("--token <token>", "provide a token directly (CI / headless)").option("--client-id <id>", "use a fixed OAuth2 client id (skip dynamic registration)").option("--client-secret <secret>", "OAuth2 client secret (omit for public/PKCE)").option("--port <n>", "local callback port", (v) => Number.parseInt(v, 10)).option(
-    "--signin-public-key-file <path>",
-    "override the RSA public key (PEM) for password signin"
-  ).option("--product <name>", "OAuth product query (default 'adp')").option("--no-browser", "headless: print the authorize URL instead of opening a browser").action(async (url, opts, cmd2) => {
+  cmd.command("login <url>").description("Log in to a platform (attach a token, or browser/password OAuth)").option("-u, --username <name>", "username for password signin").option("-p, --password <pwd>", "password for password signin").option("--token <token>", "provide a token directly (CI / headless)").option("--client-id <id>", "use a fixed OAuth2 client id (skip dynamic registration)").option("--client-secret <secret>", "OAuth2 client secret (omit for public/PKCE)").option(
+    "--port <n>",
+    "loopback redirect port for the auth_code flow",
+    (v) => Number.parseInt(v, 10)
+  ).option("--device", "headless device-code login (RFC 8628) \u2014 no callback server, no password").option("--audience <aud>", "device-code token audience", "bkn-safe").option(
+    "--timeout <s>",
+    "device-login wait before timing out",
+    (v) => Number.parseInt(v, 10),
+    120
+  ).option("--no-browser", "(legacy) print the URL instead of opening a browser").option("--product <name>", "(legacy) ISF OAuth product query").option("--signin-public-key-file <path>", "(legacy) RSA public key for ISF /oauth2/signin").option("--no-auth", "register the platform with no authentication (no bkn-safe)").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
     if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+    const out = outputOptions(cmd2);
+    const report = (r) => {
+      if (out.json || out.compact) {
+        printJson({ loggedIn: true, ...r }, out);
+      } else if (r.noAuth) {
+        process.stdout.write(`Registered ${r.baseUrl ?? url} (no authentication)
+`);
+      } else {
+        process.stdout.write(`Logged in to ${r.baseUrl ?? url} as ${r.username ?? r.userId}
+`);
+      }
+    };
     const token = opts.token ?? g.token;
     if (token) {
-      const r2 = attachToken(url, token, { insecure: g.insecure });
-      printJson({ loggedIn: true, ...r2 }, outputOptions(cmd2));
+      report(attachToken(url, token, { insecure: g.insecure }));
       return;
     }
-    const signinKey = opts.signinPublicKeyFile ? readFileSync2(opts.signinPublicKeyFile, "utf8") : void 0;
-    const tokens = opts.username ? await passwordLogin(url, opts.username, opts.password ?? "", {
-      clientId: opts.clientId,
-      port: opts.port,
-      signinPublicKeyPem: signinKey
-    }) : await browserLogin(url, {
-      clientId: opts.clientId,
-      port: opts.port,
-      noBrowser: opts.browser === false
-    });
-    const r = attachToken(url, tokens.accessToken, {
-      refreshToken: tokens.refreshToken,
-      idToken: tokens.idToken,
-      insecure: g.insecure
-    });
-    printJson({ loggedIn: true, ...r }, outputOptions(cmd2));
+    if (opts.auth === false) {
+      report(attachNoAuth(url, { insecure: g.insecure }));
+      return;
+    }
+    const authStatus = await fetchAuthStatus(url);
+    if (authStatus && !authStatus.enabled) {
+      process.stderr.write(
+        `Platform auth is disabled (stack: ${authStatus.stack ?? "none"}) \u2014 registering without auth.
+`
+      );
+      report(attachNoAuth(url, { insecure: g.insecure }));
+      return;
+    }
+    let tokens;
+    let account;
+    try {
+      if (opts.username || opts.password) {
+        const username = opts.username ?? await promptLine("Username: ");
+        account = username;
+        const password = opts.password ?? await promptLine("Password: ", true);
+        tokens = await credentialDeviceLogin(url, username, password, {
+          clientId: opts.clientId,
+          audience: opts.audience,
+          timeoutMs: opts.timeout * 1e3
+        });
+      } else {
+        const headless = isHeadless();
+        const openInBrowser = !opts.device && opts.browser !== false && !headless;
+        tokens = await deviceLogin(url, {
+          clientId: opts.clientId,
+          audience: opts.audience,
+          timeoutMs: opts.timeout * 1e3,
+          onPrompt: ({ userCode, verificationUri, verificationUriComplete }) => {
+            const target = verificationUriComplete ?? verificationUri;
+            process.stderr.write(
+              `
+Open this URL to sign in and authorize:
+  ${target}
+User code: ${userCode}
+`
+            );
+            if (openInBrowser) openBrowser(target);
+            else if (headless && !opts.device && opts.browser !== false)
+              process.stderr.write("(headless \u2014 approve on any machine with a browser)\n");
+            process.stderr.write("Waiting for authorization\u2026\n");
+          }
+        });
+      }
+    } catch (e) {
+      if (e instanceof Error && /Device auth failed \(404\)/.test(e.message)) {
+        process.stderr.write("No auth endpoint found \u2014 registering platform without auth.\n");
+        report(attachNoAuth(url, { insecure: g.insecure }));
+        return;
+      }
+      throw e;
+    }
+    if (!account) {
+      account = await resolveAccount(
+        url,
+        tokens.accessToken,
+        Boolean(g.insecure),
+        tokens.idToken
+      );
+    }
+    report(
+      attachToken(url, tokens.accessToken, {
+        refreshToken: tokens.refreshToken,
+        idToken: tokens.idToken,
+        insecure: g.insecure,
+        username: account
+      })
+    );
   });
   cmd.command("status").description("Show base URL and whether a token is configured").action((_opts, cmd2) => printJson(status(), outputOptions(cmd2)));
-  cmd.command("token").description("Print the current access token (keep secret)").action(() => {
-    process.stdout.write(`${currentToken()}
+  cmd.command("token").description("Print the current access token, refreshing it if expired (keep secret)").option("--no-refresh", "print the stored token as-is, without refreshing").action(async (opts, cmd2) => {
+    const g = cmd2.optsWithGlobals();
+    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+    const token = opts.refresh === false ? currentToken() : await currentTokenFresh();
+    process.stdout.write(`${token}
+`);
+  });
+  cmd.command("whoami [url]").description("Show current user identity (from the token)").option("--no-lookup", "skip the backend identity fallback (eacp/user/get)").action(async (_url, opts, cmd2) => {
+    const g = cmd2.optsWithGlobals();
+    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+    const me = whoami();
+    if (opts.lookup !== false && me.baseUrl && me.sub) {
+      try {
+        const u = await getUserSafe(
+          {
+            baseUrl: me.baseUrl,
+            token: currentToken(),
+            businessDomain: DEFAULT_BUSINESS_DOMAIN,
+            insecure: Boolean(g.insecure)
+          },
+          me.sub
+        );
+        if (u.account) me.username = u.account;
+        if (u.name) me.name = u.name;
+      } catch {
+      }
+    }
+    const out = outputOptions(cmd2);
+    if (out.json || out.compact || out.full) {
+      printJson(me, out);
+      return;
+    }
+    const expMs = typeof me.exp === "number" ? me.exp * 1e3 : void 0;
+    const expired = expMs !== void 0 && expMs < Date.now();
+    const rows = [
+      ["User", String(me.username ?? me.sub ?? "(unknown)")],
+      ...me.name && me.name !== me.username ? [["Name", String(me.name)]] : [],
+      ["ID", String(me.userId ?? me.sub ?? "-")],
+      ["Platform", String(me.baseUrl ?? "-")],
+      ...expMs !== void 0 ? [["Expires", `${new Date(expMs).toISOString()}${expired ? " (expired)" : ""}`]] : []
+    ];
+    const pad2 = Math.max(...rows.map(([k]) => k.length));
+    process.stdout.write(
+      `${rows.map(([k, v]) => `${k.padEnd(pad2)}  ${v}`).join("\n")}
+\u2026 use --full or --json for all claims
+`
+    );
+  });
+  cmd.command("list").alias("ls").description("List saved sessions (platform \u2192 users; * = active)").action((_opts, cmd2) => {
+    const items = listPlatforms();
+    const out = outputOptions(cmd2);
+    if (out.json || out.compact) printJson(items, out);
+    else process.stdout.write(`${renderSessions(items)}
 `);
   });
-  cmd.command("whoami [url]").description("Show current user identity (from the token)").option("--no-lookup", "skip the backend identity fallback (eacp/user/get)").action(
-    (_url, _opts, cmd2) => printJson(whoami(), outputOptions(cmd2))
-  );
-  cmd.command("list").alias("ls").description("List platforms with a saved session").action((_opts, cmd2) => printJson(listPlatforms(), outputOptions(cmd2)));
   cmd.command("use <url>").description("Switch the active platform").action((url, _opts, cmd2) => {
     use(url);
     printJson(status(), outputOptions(cmd2));
@@ -638,28 +565,56 @@ function registerAuthLeaves(cmd) {
   cmd.command("delete <url>").description("Delete saved credentials for a platform").action(
     (url, _opts, cmd2) => printJson({ deleted: deletePlatform(url) }, outputOptions(cmd2))
   );
-  cmd.command("switch <url> <user-id>").description("Switch the active user for a platform").action((url, userId, _opts, cmd2) => {
-    printJson(switchUser(url, userId), outputOptions(cmd2));
+  cmd.command("switch <url> <user>").description("Switch the active user for a platform (by username or user id)").action((url, user, _opts, cmd2) => {
+    const r = switchUser(url, user);
+    const out = outputOptions(cmd2);
+    if (out.json || out.compact) printJson(r, out);
+    else process.stdout.write(`Switched to ${r.username ?? r.userId} on ${r.baseUrl}
+`);
   });
-  cmd.command("users <url>").description("List saved user profiles for a platform").action((url, _opts, cmd2) => {
-    printJson(usersOf(url), outputOptions(cmd2));
+  cmd.command("users <url>").description("List saved users for a platform (* = active)").action((url, _opts, cmd2) => {
+    const norm = url.replace(/\/+$/, "");
+    const items = listPlatforms().filter((i) => i.baseUrl === norm);
+    const out = outputOptions(cmd2);
+    if (out.json || out.compact) printJson(items, out);
+    else process.stdout.write(`${renderSessions(items)}
+`);
   });
   cmd.command("export").description("Export the active session's tokens (for a headless host)").action((_opts, cmd2) => {
     printJson(exportCreds(), outputOptions(cmd2));
   });
-  cmd.command("change-password [url]").description("Change your account password (EACP, RSA-encrypted in transit)").requiredOption("-a, --account <name>", "account / login name").requiredOption("--old-password <pwd>", "current password").requiredOption("--new-password <pwd>", "new password").option("--public-key-file <path>", "override the RSA public key (PEM) for password encryption").action(async (_url, opts, cmd2) => {
+  cmd.command("change-password [url]").description("Change your account password (bkn-safe self-service; no browser)").option("-a, --account <name>", "account / login name (the login column, e.g. admin)").option("--old-password <pwd>", "current password").option("--new-password <pwd>", "new password").option("--public-key-file <path>", "(legacy) RSA public key for ISF password encryption").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
+    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
     const ctx = resolveContext({
-      baseUrl: g.baseUrl,
+      baseUrl: url ?? g.baseUrl,
       token: g.token,
       user: g.user,
       businessDomain: g.bizDomain,
       insecure: g.insecure
     });
-    printJson(
-      await changePassword(ctx, opts.account, opts.oldPassword, opts.newPassword),
-      outputOptions(cmd2)
-    );
+    const account = opts.account ?? await promptLine("Account: ");
+    const oldPassword = opts.oldPassword ?? await promptLine("Current password: ", true);
+    let newPassword = opts.newPassword;
+    if (!newPassword) {
+      newPassword = await promptLine("New password: ", true);
+      const confirm = await promptLine("Confirm new password: ", true);
+      if (newPassword !== confirm) throw new Error("New passwords do not match.");
+    }
+    try {
+      printJson(
+        await changePasswordSafe(ctx, account, oldPassword, newPassword),
+        outputOptions(cmd2)
+      );
+    } catch (e) {
+      if (e instanceof HttpError && e.status === 401) {
+        throw new InputError("Wrong account or current password.");
+      }
+      if (e instanceof HttpError && e.status === 400) {
+        throw new InputError("New password must differ from the current one.");
+      }
+      throw e;
+    }
   });
 }
 function authCommand() {
@@ -670,6 +625,7 @@ function authCommand() {
 
 // src/commands/admin.ts
 var int = (v) => Number.parseInt(v, 10);
+var DEFAULT_RESET_PASSWORD = "openbkn";
 function adminCommand() {
   const admin = new Command2("admin").description(
     "Operator CLI (kweaver-admin): org, user, role, models, audit"
@@ -802,12 +758,25 @@ function adminCommand() {
   user.command("delete <id>").description("Delete a user").action(async (id, _opts, cmd) => {
     printJson(await clientFrom(cmd).admin.userDelete(id), outputOptions(cmd));
   });
-  user.command("reset-password [id]").description("Reset a user's password (RSA-encrypted in transit)").option("--id <userId>", "explicit user UUID (alt to the positional id)").option("--user <account>", "resolve the user by account / login name").option("--password <s>", "the new password").option("--new-password <s>", "the new password (alias of --password)").option("--prompt-password", "prompt for the new password interactively").option("-y, --yes", "skip confirmation").action(async (id, opts, cmd) => {
+  user.command("reset-password [id]").description("Reset a user's password (defaults to the platform initial password)").option("--id <userId>", "explicit user UUID (alt to the positional id)").option("--user <account>", "resolve the user by account / login name").option("--password <s>", "the new password (default: platform initial 'openbkn')").option("--new-password <s>", "the new password (alias of --password)").option("--prompt-password", "type the new password interactively (input hidden)").option("-y, --yes", "skip confirmation").action(async (id, opts, cmd) => {
     const userId = id ?? opts.id ?? opts.user;
-    const pwd = opts.password ?? opts.newPassword;
     if (!userId) throw new Error("Provide a user id (positional or --id).");
-    if (!pwd) throw new Error("Provide --password / --new-password.");
-    printJson(await clientFrom(cmd).admin.userResetPassword(userId, pwd), outputOptions(cmd));
+    let explicit = opts.password ?? opts.newPassword;
+    if (!explicit && opts.promptPassword) {
+      explicit = await promptLine("New password: ", true);
+      if (!explicit) throw new InputError("No password entered.");
+    }
+    const pwd = explicit ?? DEFAULT_RESET_PASSWORD;
+    const r = await clientFrom(cmd).admin.userResetPassword(userId, pwd);
+    const out = outputOptions(cmd);
+    if (out.json || out.compact) printJson(r, out);
+    else if (explicit) process.stdout.write(`Password reset for ${userId}.
+`);
+    else
+      process.stdout.write(
+        `Password reset for ${userId} to the initial password '${DEFAULT_RESET_PASSWORD}' (must change on next login).
+`
+      );
   });
   const role = admin.command("role").description("Role management");
   role.command("list").description("List roles").option("--keyword <s>", "filter by keyword").option("--limit <n>", "page size", int, 100).option("--offset <n>", "page offset", int, 0).option("--source <s>", "role source filter (business | user)").action(async (opts, cmd) => {
@@ -840,6 +809,41 @@ function adminCommand() {
       outputOptions(cmd)
     );
   });
+  role.command("create").description("Create a custom role (bkn-safe; built-in roles are read-only)").requiredOption("--name <name>", "role name").option("--description <text>", "role description").action(async (opts, cmd) => {
+    printJson(
+      await clientFrom(cmd).admin.roleCreate(opts.name, opts.description),
+      outputOptions(cmd)
+    );
+  });
+  role.command("update <role>").description("Update a custom role's name/description (403 on built-in)").option("--name <name>", "new name").option("--description <text>", "new description").action(async (roleId, opts, cmd) => {
+    printJson(
+      await clientFrom(cmd).admin.roleUpdate(roleId, {
+        name: opts.name,
+        description: opts.description
+      }),
+      outputOptions(cmd)
+    );
+  });
+  role.command("delete <role>").description("Delete a custom role (403 on built-in)").option("-y, --yes", "skip confirmation").action(async (roleId, _opts, cmd) => {
+    printJson(await clientFrom(cmd).admin.roleDelete(roleId), outputOptions(cmd));
+  });
+  for (const [verb, grant] of [
+    ["grant-perm", true],
+    ["revoke-perm", false]
+  ]) {
+    role.command(`${verb} <role>`).description(`${grant ? "Grant" : "Revoke"} a permission on a custom role (403 on built-in)`).requiredOption("--resource-type <t>", "resource type (e.g. catalog)").option("--resource-id <id>", "resource id ('*' = whole type)", "*").requiredOption("--operations <list>", "comma-separated operations").action(async (roleId, opts, cmd) => {
+      printJson(
+        await clientFrom(cmd).admin.rolePermission(
+          roleId,
+          grant,
+          opts.resourceType,
+          opts.resourceId,
+          csv(opts.operations) ?? []
+        ),
+        outputOptions(cmd)
+      );
+    });
+  }
   const modelBody = (opts) => {
     if (opts.body || opts.bodyFile) return readBody(opts);
     const mc = {};
@@ -1071,11 +1075,78 @@ function agentCommand() {
   return group(cmd, "DECISION AGENT");
 }
 
-// src/commands/bkn.ts
+// src/commands/appkey.ts
 import { Command as Command4 } from "commander";
+var int3 = (v) => Number.parseInt(v, 10);
+var DAY_MS = 864e5;
+function printNewKey(created, out) {
+  if (out.json || out.compact) {
+    printJson(created, out);
+    return;
+  }
+  process.stderr.write(
+    "\u26A0\uFE0F  Copy this key now \u2014 the plaintext is shown only once and cannot be retrieved again.\n\n"
+  );
+  const fields = [
+    ["key", created.key],
+    ["name", created.name],
+    ["id", `${created.id}  (use this to revoke/regenerate)`],
+    ["key_id", created.key_id],
+    ["expires_at", created.expires_at ?? "never"]
+  ];
+  const w = Math.max(...fields.map(([k]) => k.length));
+  for (const [k, v] of fields) process.stdout.write(`  ${k.padEnd(w)}  ${v}
+`);
+}
+function appkeyCommand() {
+  const appkey = new Command4("appkey").description(
+    "AppKeys \u2014 user-issued long-lived credentials (bak_) for the Context Loader"
+  );
+  appkey.command("list").description("List your own AppKeys (no secrets)").action(async (_opts, cmd) => {
+    printJson(await clientFrom(cmd).appKeys.list(), outputOptions(cmd));
+  });
+  appkey.command("create").description("Issue an AppKey \u2014 the plaintext key is shown ONCE, on create").requiredOption("--name <s>", "display name (to tell keys apart)").option("--expires-at <rfc3339>", "expiry as RFC3339 (e.g. 2027-01-01T00:00:00Z)").option("--expire-days <n>", "expiry in N days from now (alternative to --expires-at)", int3).option("--never-expire", "never expire (wins over --expires-at/--expire-days)").action(async (opts, cmd) => {
+    let expiresAt = opts.expiresAt;
+    if (opts.expireDays !== void 0) {
+      if (!Number.isFinite(opts.expireDays) || opts.expireDays <= 0) {
+        throw new InputError("--expire-days must be a positive integer.");
+      }
+      if (expiresAt) {
+        throw new InputError("Use either --expires-at or --expire-days, not both.");
+      }
+      expiresAt = new Date(Date.now() + opts.expireDays * DAY_MS).toISOString();
+    }
+    const created = await clientFrom(cmd).appKeys.create({
+      name: opts.name,
+      expiresAt,
+      neverExpire: Boolean(opts.neverExpire)
+    });
+    printNewKey(created, outputOptions(cmd));
+  });
+  appkey.command("regenerate <id>").alias("rotate").description("Rotate a key in place \u2014 mints a new plaintext; the old bak_ dies immediately").action(async (id, _opts, cmd) => {
+    const created = await clientFrom(cmd).appKeys.regenerate(id);
+    printNewKey(created, outputOptions(cmd));
+  });
+  appkey.command("revoke <id>").alias("delete").alias("rm").description("Revoke one of your AppKeys (immediate; use the `id`, not `key_id`)").action(async (id, _opts, cmd) => {
+    await clientFrom(cmd).appKeys.revoke(id);
+    printJson({ revoked: id }, outputOptions(cmd));
+  });
+  const admin = appkey.command("admin").description("Admin governance over all AppKeys");
+  admin.command("list").description("List all AppKeys, or one owner's (adds owner_user_id)").option("--owner-id <id>", "filter to a single owner").action(async (opts, cmd) => {
+    printJson(await clientFrom(cmd).appKeys.adminList(opts.ownerId), outputOptions(cmd));
+  });
+  admin.command("revoke <id>").alias("delete").alias("rm").description("Revoke any AppKey by id").action(async (id, _opts, cmd) => {
+    await clientFrom(cmd).appKeys.adminRevoke(id);
+    printJson({ revoked: id }, outputOptions(cmd));
+  });
+  return group(appkey, "AUTHENTICATION & CONFIG");
+}
+
+// src/commands/bkn.ts
+import { Command as Command5 } from "commander";
 
 // src/utils/bkn-validate.ts
-import { existsSync, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
+import { existsSync, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
 import { join, resolve } from "path";
 var BKN_OBJECT_NAME_MAX_LENGTH = 40;
 function parseFrontmatter(text) {
@@ -1128,7 +1199,7 @@ function validateBknDirectory(dirPath) {
   if (!existsSync(networkPath)) {
     errors.push("Missing network.bkn at the BKN root.");
   } else {
-    const fm = parseFrontmatter(readFileSync3(networkPath, "utf8"));
+    const fm = parseFrontmatter(readFileSync2(networkPath, "utf8"));
     if (!fm) errors.push("network.bkn has no frontmatter block.");
     else {
       if (fm.type !== "knowledge_network")
@@ -1140,7 +1211,7 @@ function validateBknDirectory(dirPath) {
   const otIds = /* @__PURE__ */ new Set();
   const otFiles = bknFiles(join(dir, "object_types"));
   for (const file of otFiles) {
-    const fm = parseFrontmatter(readFileSync3(file, "utf8"));
+    const fm = parseFrontmatter(readFileSync2(file, "utf8"));
     const rel = file.slice(dir.length + 1);
     if (!fm || fm.type !== "object_type") {
       errors.push(`${rel}: not a valid object_type (missing/wrong frontmatter type).`);
@@ -1160,7 +1231,7 @@ function validateBknDirectory(dirPath) {
   }
   const rtFiles = bknFiles(join(dir, "relation_types"));
   for (const file of rtFiles) {
-    const text = readFileSync3(file, "utf8");
+    const text = readFileSync2(file, "utf8");
     const fm = parseFrontmatter(text);
     const rel = file.slice(dir.length + 1);
     if (!fm || fm.type !== "relation_type") {
@@ -1190,10 +1261,10 @@ function validateBknDirectory(dirPath) {
 }
 
 // src/commands/bkn.ts
-var int3 = (v) => Number.parseInt(v, 10);
+var int4 = (v) => Number.parseInt(v, 10);
 function bknCommand() {
-  const bkn = new Command4("bkn").description("Knowledge networks \u2014 list, query, schema, instances");
-  bkn.command("list").description("List knowledge networks").option("--limit <n>", "page size", int3, DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int3, 0).option("--name-pattern <s>", "filter by name pattern").option("--tag <s>", "filter by tag").option("--sort <field>", "sort field", "update_time").option("--direction <dir>", "asc | desc", "desc").action(async (_opts, cmd) => {
+  const bkn = new Command5("bkn").description("Knowledge networks \u2014 list, query, schema, instances");
+  bkn.command("list").description("List knowledge networks").option("--limit <n>", "page size", int4, DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int4, 0).option("--name-pattern <s>", "filter by name pattern").option("--tag <s>", "filter by tag").option("--sort <field>", "sort field", "update_time").option("--direction <dir>", "asc | desc", "desc").action(async (_opts, cmd) => {
     const o = cmd.optsWithGlobals();
     const data = await clientFrom(cmd).kn.list({
       limit: o.limit,
@@ -1212,7 +1283,7 @@ function bknCommand() {
     });
     printJson(data, outputOptions(cmd));
   });
-  bkn.command("search <kn-id> <query>").description("Semantic search within a knowledge network").option("--max-concepts <n>", "max concepts to return", int3, 10).option("--mode <mode>", "retrieval mode", "keyword_vector_retrieval").action(async (knId, query, opts, cmd) => {
+  bkn.command("search <kn-id> <query>").description("Semantic search within a knowledge network").option("--max-concepts <n>", "max concepts to return", int4, 10).option("--mode <mode>", "retrieval mode", "keyword_vector_retrieval").action(async (knId, query, opts, cmd) => {
     const data = await clientFrom(cmd).kn.search(knId, query, {
       maxConcepts: opts.maxConcepts,
       mode: opts.mode
@@ -1301,7 +1372,7 @@ function bknCommand() {
     printJson(await clientFrom(cmd).kn.subgraph(knId, readBody(opts)), outputOptions(cmd));
   });
   const actionLog = bkn.command("action-log").description("Action logs \u2014 list/get/cancel");
-  actionLog.command("list <kn-id>").description("List action logs").option("--status <s>", "filter by status").option("--action-type-id <id>", "filter by action type").option("--limit <n>", "page size", int3, DEFAULT_LIST_LIMIT).action(async (knId, opts, cmd) => {
+  actionLog.command("list <kn-id>").description("List action logs").option("--status <s>", "filter by status").option("--action-type-id <id>", "filter by action type").option("--limit <n>", "page size", int4, DEFAULT_LIST_LIMIT).action(async (knId, opts, cmd) => {
     printJson(
       await clientFrom(cmd).kn.actionLogs(knId, {
         status: opts.status,
@@ -1481,7 +1552,7 @@ function bknCommand() {
     printJson(result, outputOptions(cmd));
     if (!result.valid) process.exitCode = 1;
   });
-  bkn.command("create-from-csv <catalog-id>").description("Import CSV files into a Vega catalog, then build a KN from them").requiredOption("--files <glob>", "CSV paths (comma-separated or glob)").requiredOption("--name <name>", "knowledge network name").option("--table-prefix <s>", "prefix for derived table names", "").option("--batch-size <n>", "rows per insert batch", int3, 500).option("--tables <list>", "subset of imported tables to include in the KN").option("--pk-map <map>", "explicit primary keys: '<table>:<col>[,...]'").option("--build", "submit a Vega build task per resource after creation").option(
+  bkn.command("create-from-csv <catalog-id>").description("Import CSV files into a Vega catalog, then build a KN from them").requiredOption("--files <glob>", "CSV paths (comma-separated or glob)").requiredOption("--name <name>", "knowledge network name").option("--table-prefix <s>", "prefix for derived table names", "").option("--batch-size <n>", "rows per insert batch", int4, 500).option("--tables <list>", "subset of imported tables to include in the KN").option("--pk-map <map>", "explicit primary keys: '<table>:<col>[,...]'").option("--build", "submit a Vega build task per resource after creation").option(
     "--embedding-fields <map>",
     "columns to vectorize per table (with --build): '<table>:<col>[+<col>...][,...]'"
   ).option("--embedding-model <id>", "embedding model id for the vector index (with --build)").option("--no-rollback", "keep a partially-created KN on failure").action(async (catalogId, opts, cmd) => {
@@ -1507,13 +1578,13 @@ function bknCommand() {
 }
 
 // src/commands/call.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 function collect(value, prev) {
   prev.push(value);
   return prev;
 }
 function callCommand() {
-  const cmd = new Command5("call").alias("curl").description("Call an API with curl-style flags and auto-injected auth headers").argument("<url>", "API path (e.g. /api/...) or absolute URL").option("-X, --request <method>", "HTTP method").option("-H, --header <header>", 'extra header "Name: value" (repeatable)', collect, []).option("-d, --data <body>", "request body (sets JSON content-type if unset)").option("--data-raw <body>", "alias for --data").option(
+  const cmd = new Command6("call").alias("curl").description("Call an API with curl-style flags and auto-injected auth headers").argument("<url>", "API path (e.g. /api/...) or absolute URL").option("-X, --request <method>", "HTTP method").option("-H, --header <header>", 'extra header "Name: value" (repeatable)', collect, []).option("-d, --data <body>", "request body (sets JSON content-type if unset)").option("--data-raw <body>", "alias for --data").option(
     "-F, --form <field>",
     "multipart field key=value or key=@file (repeatable)",
     collect,
@@ -1548,14 +1619,14 @@ function callCommand() {
 }
 
 // src/commands/config.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 function requireActive() {
   const baseUrl = activePlatform();
   if (!baseUrl) throw new InputError("No active platform. Run `openbkn auth login <url>` first.");
   return baseUrl;
 }
 function configCommand() {
-  const config = new Command6("config").description("Per-platform CLI configuration");
+  const config = new Command7("config").description("Per-platform CLI configuration");
   config.command("show").description("Show the active platform and business domain").action((_opts, cmd) => {
     const baseUrl = activePlatform();
     printJson(
@@ -1588,13 +1659,56 @@ function configCommand() {
 }
 
 // src/commands/context.ts
-import { Command as Command7 } from "commander";
-var int4 = (v) => Number.parseInt(v, 10);
+import { Command as Command8 } from "commander";
+var int5 = (v) => Number.parseInt(v, 10);
+var collectArg = (v, prev) => {
+  prev.push(v);
+  return prev;
+};
+function buildArgs(opts) {
+  let out = {};
+  if (opts.args) {
+    try {
+      out = JSON.parse(opts.args);
+    } catch {
+      throw new InputError("--args must be valid JSON");
+    }
+  }
+  for (const pair of opts.arg ?? []) {
+    const idx = pair.indexOf("=");
+    if (idx <= 0) throw new InputError(`--arg must be key=value (got: ${pair})`);
+    const key = pair.slice(0, idx);
+    const raw = pair.slice(idx + 1);
+    try {
+      out[key] = JSON.parse(raw);
+    } catch {
+      out[key] = raw;
+    }
+  }
+  return out;
+}
+function printToolList(res, out) {
+  if (out.json || out.compact) {
+    printJson(res, out);
+    return;
+  }
+  const r = res ?? {};
+  const arr = [res, r.tools, r.result?.tools, r.data].find(Array.isArray);
+  if (!arr) {
+    printJson(res, out);
+    return;
+  }
+  const rows = arr.map((t) => ({
+    name: t.name ?? t.tool_name ?? t.key ?? "",
+    description: typeof t.description === "string" ? t.description : ""
+  }));
+  printJson(rows, out);
+}
 function contextCommand() {
-  const cmd = new Command7("context").description(
+  const cmd = new Command8("context").description(
     "Context loader (MCP) \u2014 schema discovery, instance query, skill recall"
   );
-  cmd.command("search-schema <kn-id> <query>").description("Search object/relation/action/metric schemas").option("--scope <list>", "comma-separated scopes (object,relation,action,metric)").option("--max <n>", "max concepts", int4).action(async (knId, query, opts, cmd2) => {
+  cmd.command("search-schema <kn-id> <query>").description("Search object/relation/action/metric schemas").option("--scope <list>", "comma-separated scopes (object,relation,action,metric)").option("--max <n>", "max concepts", int5).action(async (knId, query, opts, cmd2) => {
     const data = await clientFrom(cmd2).context.searchSchema(knId, query, {
       searchScope: opts.scope ? String(opts.scope).split(",") : void 0,
       maxConcepts: opts.max
@@ -1610,23 +1724,41 @@ function contextCommand() {
     }
     printJson(await clientFrom(cmd2).context.queryObjectInstance(knId, args), outputOptions(cmd2));
   });
-  cmd.command("find-skills <kn-id> <object-type-id>").description("Recall skills for an object type").option("--top-k <n>", "max skills (1-20)", int4).action(async (knId, otId, opts, cmd2) => {
+  cmd.command("find-skills <kn-id> <object-type-id>").description("Recall skills for an object type").option("--top-k <n>", "max skills (1-20)", int5).action(async (knId, otId, opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).context.findSkills(knId, otId, opts.topK),
       outputOptions(cmd2)
     );
   });
-  cmd.command("tools <kn-id>").description("List MCP tools").action(async (knId, _opts, cmd2) => {
-    printJson(await clientFrom(cmd2).context.tools(knId), outputOptions(cmd2));
+  cmd.command("info").description("List the deploy's MCP tool catalog (global \u2014 no KN needed)").action(async (_opts, cmd2) => {
+    printToolList(await clientFrom(cmd2).context.info(), outputOptions(cmd2));
   });
-  cmd.command("tool-call <kn-id> <name>").description("Call any MCP tool directly (--args JSON)").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, name, opts, cmd2) => {
-    let args;
-    try {
-      args = JSON.parse(opts.args);
-    } catch {
-      throw new InputError("--args must be valid JSON");
-    }
-    printJson(await clientFrom(cmd2).context.toolCall(knId, name, args), outputOptions(cmd2));
+  cmd.command("tools <kn-id>").description("List MCP tools advertised for a KN session").action(async (knId, _opts, cmd2) => {
+    printToolList(await clientFrom(cmd2).context.tools(knId), outputOptions(cmd2));
+  });
+  cmd.command("tool-call <kn-id> <name>").description("Call any MCP tool by name \u2014 current or future (use `tools` to discover)").option("--args <json>", "tool arguments as JSON").option(
+    "--arg <key=value>",
+    "one argument (repeatable; value parsed as JSON, else string)",
+    collectArg,
+    []
+  ).action(async (knId, name, opts, cmd2) => {
+    printJson(
+      await clientFrom(cmd2).context.toolCall(knId, name, buildArgs(opts)),
+      outputOptions(cmd2)
+    );
+  });
+  cmd.command("call-method <kn-id> <method>").description(
+    "Call any MCP method by name (e.g. tools/list, resources/read) \u2014 current or future"
+  ).option("--args <json>", "method params as JSON").option(
+    "--arg <key=value>",
+    "one param (repeatable; value parsed as JSON, else string)",
+    collectArg,
+    []
+  ).action(async (knId, method, opts, cmd2) => {
+    printJson(
+      await clientFrom(cmd2).context.callMethod(knId, method, buildArgs(opts)),
+      outputOptions(cmd2)
+    );
   });
   cmd.command("resources <kn-id>").description("List MCP resources").action(async (knId, _opts, cmd2) => {
     printJson(await clientFrom(cmd2).context.resources(knId), outputOptions(cmd2));
@@ -1658,19 +1790,19 @@ function contextCommand() {
       throw new InputError("--args must be valid JSON");
     }
   };
-  cmd.command("query-instance-subgraph <kn-id>").description("Layer-2: query an instance subgraph across relation-type paths").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, opts, cmd2) => {
+  cmd.command("query-instance-subgraph <kn-id>").description("Query an instance subgraph across relation-type paths").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).context.queryInstanceSubgraph(knId, jsonArgs(opts.args)),
       outputOptions(cmd2)
     );
   });
-  cmd.command("get-logic-properties <kn-id>").description("Layer-3: compute logic-property values for instances").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, opts, cmd2) => {
+  cmd.command("get-logic-properties <kn-id>").description("Compute logic-property values for instances").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).context.logicProperties(knId, jsonArgs(opts.args)),
       outputOptions(cmd2)
     );
   });
-  cmd.command("get-action-info <kn-id>").description("Layer-3: fetch action info / dynamic tools for an instance").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, opts, cmd2) => {
+  cmd.command("get-action-info <kn-id>").description("Fetch action info / dynamic tools for an instance").requiredOption("--args <json>", "tool arguments as JSON").action(async (knId, opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).context.actionInfo(knId, jsonArgs(opts.args)),
       outputOptions(cmd2)
@@ -1680,10 +1812,10 @@ function contextCommand() {
 }
 
 // src/commands/dataflow.ts
-import { Command as Command8 } from "commander";
-var int5 = (v) => Number.parseInt(v, 10);
+import { Command as Command9 } from "commander";
+var int6 = (v) => Number.parseInt(v, 10);
 function dataflowCommand() {
-  const cmd = new Command8("dataflow").description("Dataflow document workflows \u2014 list, runs, logs");
+  const cmd = new Command9("dataflow").description("Dataflow document workflows \u2014 list, runs, logs");
   cmd.command("list").description("List all dataflows").action(async (_opts, cmd2) => {
     printJson(await clientFrom(cmd2).dataflows.list(), outputOptions(cmd2));
   });
@@ -1693,7 +1825,7 @@ function dataflowCommand() {
       outputOptions(cmd2)
     );
   });
-  cmd.command("logs <dagId> <instanceId>").description("Show logs for one run").option("--page <n>", "page", int5, 0).option("--limit <n>", "page size", int5, DEFAULT_LIST_LIMIT).action(async (dagId, instanceId, opts, cmd2) => {
+  cmd.command("logs <dagId> <instanceId>").description("Show logs for one run").option("--page <n>", "page", int6, 0).option("--limit <n>", "page size", int6, DEFAULT_LIST_LIMIT).action(async (dagId, instanceId, opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).dataflows.logs(dagId, instanceId, {
         page: opts.page,
@@ -1754,9 +1886,9 @@ function dataflowCommand() {
 }
 
 // src/commands/explore.ts
-import { createServer as createServer2 } from "http";
-import { Command as Command9 } from "commander";
-var int6 = (v) => Number.parseInt(v, 10);
+import { createServer } from "http";
+import { Command as Command10 } from "commander";
+var int7 = (v) => Number.parseInt(v, 10);
 var ROUTES = {
   "GET /api/bkn/meta": (c, q) => c.kn.get(req(q, "knId")),
   "POST /api/bkn/search": (c, _q, b) => c.kn.search(str(b.knId), str(b.query), {
@@ -1801,12 +1933,12 @@ var INDEX = `<!doctype html><meta charset="utf-8"><title>openbkn explore</title>
 <p>Read-only JSON endpoints for bkn + vega:</p>
 <ul>${Object.keys(ROUTES).map((r) => `<li><code>${r}</code></li>`).join("")}</ul>`;
 function exploreCommand() {
-  const cmd = new Command9("explore").description(
+  const cmd = new Command10("explore").description(
     "Start a local web server with read-only bkn + vega JSON endpoints"
   );
-  cmd.option("--port <n>", "port to listen on", int6, 7777).option("--host <h>", "host to bind", "127.0.0.1").action(async (opts, command) => {
+  cmd.option("--port <n>", "port to listen on", int7, 7777).option("--host <h>", "host to bind", "127.0.0.1").action(async (opts, command) => {
     const client = clientFrom(command);
-    const server = createServer2((reqMsg, res) => {
+    const server = createServer((reqMsg, res) => {
       void handle(client, reqMsg, res);
     });
     server.listen(opts.port, opts.host, () => {
@@ -1842,8 +1974,8 @@ async function handle(client, reqMsg, res) {
 }
 
 // src/commands/model.ts
-import { Command as Command10 } from "commander";
-var int7 = (v) => Number.parseInt(v, 10);
+import { Command as Command11 } from "commander";
+var int8 = (v) => Number.parseInt(v, 10);
 function addManagementCommands(parent, kind) {
   parent.command("add").description("Register a model (definition JSON via --body / --body-file)").option("--body <json>", "model definition JSON").option("--body-file <path>", "read model definition JSON from a file").action(async (opts, cmd) => {
     printJson(await clientFrom(cmd).models[kind].add(readBody(opts)), outputOptions(cmd));
@@ -1859,9 +1991,9 @@ function addManagementCommands(parent, kind) {
   });
 }
 function modelCommand() {
-  const model = new Command10("model").description("Model factory \u2014 LLM / small-model CRUD + chat");
+  const model = new Command11("model").description("Model factory \u2014 LLM / small-model CRUD + chat");
   const llm = model.command("llm").description("Large language models");
-  llm.command("list").description("List LLM models").option("--name <s>", "filter by name").option("--type <t>", "model type filter").option("--limit <n>", "page size", int7, DEFAULT_LIST_LIMIT).option("--page <n>", "page", int7, 1).action(async (opts, cmd) => {
+  llm.command("list").description("List LLM models").option("--name <s>", "filter by name").option("--type <t>", "model type filter").option("--limit <n>", "page size", int8, DEFAULT_LIST_LIMIT).option("--page <n>", "page", int8, 1).action(async (opts, cmd) => {
     printJson(
       await clientFrom(cmd).models.llm.list({
         name: opts.name,
@@ -1886,7 +2018,7 @@ function modelCommand() {
   });
   addManagementCommands(llm, "llm");
   const small = model.command("small").description("Small models (embedding / reranker)");
-  small.command("list").description("List small models").option("--name <s>", "filter by name").option("--type <t>", "model type filter").option("--limit <n>", "page size", int7, DEFAULT_LIST_LIMIT).option("--page <n>", "page", int7, 1).action(async (opts, cmd) => {
+  small.command("list").description("List small models").option("--name <s>", "filter by name").option("--type <t>", "model type filter").option("--limit <n>", "page size", int8, DEFAULT_LIST_LIMIT).option("--page <n>", "page", int8, 1).action(async (opts, cmd) => {
     printJson(
       await clientFrom(cmd).models.small.list({
         name: opts.name,
@@ -1917,11 +2049,11 @@ function modelCommand() {
 }
 
 // src/commands/resource.ts
-import { Command as Command11 } from "commander";
-var int8 = (v) => Number.parseInt(v, 10);
+import { Command as Command12 } from "commander";
+var int9 = (v) => Number.parseInt(v, 10);
 function resourceCommand() {
-  const cmd = new Command11("resource").alias("res").description("Resources \u2014 list, find, get, query, delete");
-  cmd.command("list").description("List resources under a catalog").option("--catalog-id <id>", "filter by catalog id").option("--datasource-id <id>", "alias of --catalog-id").option("--category <c>", "resource category (table | logicview | dataset)").option("--type <c>", "alias of --category").option("--limit <n>", "page size", int8, DEFAULT_LIST_LIMIT).action(async (opts, cmd2) => {
+  const cmd = new Command12("resource").alias("res").description("Resources \u2014 list, find, get, query, delete");
+  cmd.command("list").description("List resources under a catalog").option("--catalog-id <id>", "filter by catalog id").option("--datasource-id <id>", "alias of --catalog-id").option("--category <c>", "resource category (table | logicview | dataset)").option("--type <c>", "alias of --category").option("--limit <n>", "page size", int9, DEFAULT_LIST_LIMIT).action(async (opts, cmd2) => {
     const data = await clientFrom(cmd2).resource.list({
       datasourceId: opts.catalogId ?? opts.datasourceId,
       category: opts.category ?? opts.type,
@@ -1939,7 +2071,7 @@ function resourceCommand() {
   cmd.command("get <id>").description("Get resource details").action(async (id, _opts, cmd2) => {
     printJson(await clientFrom(cmd2).resource.get(id), outputOptions(cmd2));
   });
-  cmd.command("query <id>").description("Fetch data rows from a resource").option("--limit <n>", "row limit", int8, DEFAULT_QUERY_LIMIT).option("--offset <n>", "row offset", int8, 0).option("--need-total", "include total count").action(async (id, opts, cmd2) => {
+  cmd.command("query <id>").description("Fetch data rows from a resource").option("--limit <n>", "row limit", int9, DEFAULT_QUERY_LIMIT).option("--offset <n>", "row offset", int9, 0).option("--need-total", "include total count").action(async (id, opts, cmd2) => {
     const data = await clientFrom(cmd2).resource.query(id, {
       limit: opts.limit,
       offset: opts.offset,
@@ -1954,11 +2086,11 @@ function resourceCommand() {
 }
 
 // src/commands/skill.ts
-import { Command as Command12 } from "commander";
-var int9 = (v) => Number.parseInt(v, 10);
+import { Command as Command13 } from "commander";
+var int10 = (v) => Number.parseInt(v, 10);
 function skillCommand() {
-  const cmd = new Command12("skill").description("Skill registry and market");
-  const listOpts = (c) => c.option("--name <s>", "filter by name").option("--source <s>", "filter by source").option("--status <s>", "filter by status").option("--limit <n>", "page size", int9, DEFAULT_LIST_LIMIT).option("--page <n>", "page", int9, 1);
+  const cmd = new Command13("skill").description("Skill registry and market");
+  const listOpts = (c) => c.option("--name <s>", "filter by name").option("--source <s>", "filter by source").option("--status <s>", "filter by status").option("--limit <n>", "page size", int10, DEFAULT_LIST_LIMIT).option("--page <n>", "page", int10, 1);
   listOpts(cmd.command("list").description("List skills")).option("--create-user <s>", "filter by creator").action(async (opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).skills.list({
@@ -2044,11 +2176,11 @@ function skillCommand() {
 }
 
 // src/commands/toolbox.ts
-import { Command as Command13 } from "commander";
-var int10 = (v) => Number.parseInt(v, 10);
+import { Command as Command14 } from "commander";
+var int11 = (v) => Number.parseInt(v, 10);
 function toolboxCommand() {
-  const cmd = new Command13("toolbox").description("Agent toolbox lifecycle");
-  cmd.command("list").description("List toolboxes").option("--keyword <s>", "filter by keyword").option("--limit <n>", "page size", int10, DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int10, 0).action(async (opts, cmd2) => {
+  const cmd = new Command14("toolbox").description("Agent toolbox lifecycle");
+  cmd.command("list").description("List toolboxes").option("--keyword <s>", "filter by keyword").option("--limit <n>", "page size", int11, DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int11, 0).action(async (opts, cmd2) => {
     printJson(
       await clientFrom(cmd2).toolboxes.list({
         keyword: opts.keyword,
@@ -2089,7 +2221,7 @@ function toolboxCommand() {
   return group(cmd, "DECISION AGENT");
 }
 function toolCommand() {
-  const cmd = new Command13("tool").description("Tools inside a toolbox");
+  const cmd = new Command14("tool").description("Tools inside a toolbox");
   cmd.command("list").description("List tools in a toolbox").requiredOption("--toolbox <box-id>", "toolbox id").action(async (opts, cmd2) => {
     printJson(await clientFrom(cmd2).toolboxes.tools(opts.toolbox), outputOptions(cmd2));
   });
@@ -2105,7 +2237,7 @@ function toolCommand() {
       outputOptions(cmd2)
     );
   });
-  const invokeOpts = (c) => c.requiredOption("--toolbox <box-id>", "toolbox id").option("--body <json>", "request body JSON").option("--header <json>", "headers map JSON").option("--query <json>", "query params JSON").option("--path <json>", "path params JSON").option("--timeout <s>", "per-call timeout seconds", int10);
+  const invokeOpts = (c) => c.requiredOption("--toolbox <box-id>", "toolbox id").option("--body <json>", "request body JSON").option("--header <json>", "headers map JSON").option("--query <json>", "query params JSON").option("--path <json>", "path params JSON").option("--timeout <s>", "per-call timeout seconds", int11);
   const parseJson = (s, label) => {
     if (!s) return void 0;
     try {
@@ -2147,11 +2279,11 @@ function toolCommand() {
 }
 
 // src/commands/trace.ts
-import { readFileSync as readFileSync5, writeFileSync } from "fs";
-import { Command as Command14 } from "commander";
+import { readFileSync as readFileSync4, writeFileSync } from "fs";
+import { Command as Command15 } from "commander";
 
 // src/trace-ai/schema-validate.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { extname } from "path";
 import yaml from "js-yaml";
 import { z } from "zod";
@@ -2188,7 +2320,7 @@ var DiagnosisRule = z.object({
   params: z.record(z.string(), z.unknown()).optional()
 });
 function parseFile(file) {
-  const text = readFileSync4(file, "utf8");
+  const text = readFileSync3(file, "utf8");
   const ext = extname(file).toLowerCase();
   if (ext === ".yaml" || ext === ".yml") return yaml.load(text);
   return JSON.parse(text);
@@ -2226,7 +2358,7 @@ function validateSchemaFile(file, kind) {
 
 // src/commands/trace.ts
 function traceCommand() {
-  const cmd = new Command14("trace").description(
+  const cmd = new Command15("trace").description(
     "Trace AI \u2014 fetch spans, diagnose (symbolic + LLM rubric), scan, eval-set, schema validate"
   );
   cmd.command("get <conversation-id>").description("Fetch all trace spans for a conversation").option("--max-spans <n>", "max spans", (v) => Number.parseInt(v, 10)).action(async (conversationId, opts, cmd2) => {
@@ -2255,7 +2387,7 @@ function traceCommand() {
   });
   const evalSet = cmd.command("eval-set").description("Build + run trace eval sets");
   evalSet.command("build <queries-file>").description("Build eval cases from a queries JSON file").option("--out <file>", "write the cases JSON here (default: stdout)").action(async (queriesFile, opts, cmd2) => {
-    const raw = JSON.parse(readFileSync5(queriesFile, "utf8"));
+    const raw = JSON.parse(readFileSync4(queriesFile, "utf8"));
     const cases = clientFrom(cmd2).trace.evalSetBuild(raw);
     if (opts.out) {
       writeFileSync(opts.out, JSON.stringify({ cases }, null, 2));
@@ -2265,7 +2397,7 @@ function traceCommand() {
     }
   });
   evalSet.command("test <cases-file>").description("Run an eval set against an agent (--llm enables semantic_match)").requiredOption("--agent <id>", "agent id to run the queries against").option("--version <v>", "agent version", "v0").option("--llm", "enable semantic_match assertions via the local `claude` CLI").action(async (casesFile, opts, cmd2) => {
-    const raw = JSON.parse(readFileSync5(casesFile, "utf8"));
+    const raw = JSON.parse(readFileSync4(casesFile, "utf8"));
     const cases = clientFrom(cmd2).trace.evalSetBuild(raw);
     const result = await clientFrom(cmd2).trace.evalSetTest(opts.agent, cases, {
       version: opts.version,
@@ -2284,9 +2416,10 @@ function traceCommand() {
 }
 
 // src/commands/vega.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
+var int12 = (v) => Number.parseInt(v, 10);
 function vegaCommand() {
-  const vega = new Command15("vega").description(
+  const vega = new Command16("vega").description(
     "Vega observability \u2014 catalog, resources, index build tasks"
   );
   const catalog = vega.command("catalog").description("Catalog entries");
@@ -2339,6 +2472,38 @@ function vegaCommand() {
   connector.command("get <type>").description("Get a connector type").action(async (type, _opts, cmd) => {
     printJson(await clientFrom(cmd).vega.connectorType(type), outputOptions(cmd));
   });
+  vega.command("sql").description("Run SQL / OpenSearch DSL directly against a vega-backend data source").option(
+    "--resource-type <type>",
+    "source type (mysql | postgresql | opensearch | \u2026); optional \u2014 inferred from the {{<id>}} placeholder"
+  ).option(
+    "--query <sql>",
+    "SQL string; reference a resource with a {{<resource-id>}} placeholder"
+  ).option("--stream-size <n>", "streaming batch size (100\u201310000)", int12).option("--query-timeout <s>", "query timeout in seconds (1\u20133600)", int12).option(
+    "-d, --data <json>",
+    "full request body as JSON (advanced; wins over --query/--resource-type)"
+  ).action(async (opts, cmd) => {
+    let body;
+    if (opts.data) {
+      try {
+        body = JSON.parse(opts.data);
+      } catch {
+        throw new InputError("--data must be valid JSON");
+      }
+    } else {
+      if (!opts.query) {
+        throw new InputError("Provide --query (and optionally --resource-type), or --data.");
+      }
+      body = {
+        query: opts.query,
+        // Optional — the backend infers the type from the {{<id>}} placeholder's
+        // catalog connector when omitted.
+        ...opts.resourceType ? { resource_type: opts.resourceType } : {},
+        ...opts.streamSize !== void 0 ? { stream_size: opts.streamSize } : {},
+        ...opts.queryTimeout !== void 0 ? { query_timeout: opts.queryTimeout } : {}
+      };
+    }
+    printJson(await clientFrom(cmd).vega.sql(body), outputOptions(cmd));
+  });
   const resource = vega.command("resource").description("Vega-backend resources");
   resource.command("list").description("List resources").option("--datasource-id <id>", "filter by catalog/datasource id").option("--catalog-id <id>", "alias of --datasource-id").option("--type <category>", "resource category").option("--category <category>", "alias of --type").option("--limit <n>", "page size", (v) => Number.parseInt(v, 10), DEFAULT_LIST_LIMIT).action(async (opts, cmd) => {
     printJson(
@@ -2386,11 +2551,12 @@ function vegaCommand() {
 }
 
 // src/cli.ts
-var program = new Command16();
+var program = new Command17();
 program.name("openbkn").description("Operate the BKN platform from the CLI").version(package_default.version, "-V, --version", "output the version number").option("--base-url <url>", "platform base URL (env: BKN_BASE_URL)").option("--token <value>", "access token (env: BKN_TOKEN)").option("--user <id|name>", "use specific user credentials (env: BKN_USER)").option("--json", "machine-readable JSON output").option("--compact", "single-line JSON output").option("--full", "human view: show all columns (default trims to the key ones)").option("--biz-domain <s>", "business domain (alias: -bd)").option("-k, --insecure", "skip TLS verification (dev / self-signed only)").showHelpAfterError();
 program.addCommand(authCommand());
 program.addCommand(callCommand());
 program.addCommand(configCommand());
+program.addCommand(appkeyCommand());
 program.addCommand(vegaCommand());
 program.addCommand(bknCommand());
 program.addCommand(resourceCommand());