@openwop/cli 0.3.0 → 0.18.2

package/dist/openwop.js

@@ -151,8 +151,8 @@ function signalAvailable(env) {
   if (probe.status === 0) return { channel: "signal", available: true, detail: (probe.stdout || "").trim() || "signal-cli present" };
   return { channel: "signal", available: false, detail: "signal-cli not found on PATH \u2014 install from https://github.com/AsamK/signal-cli (or set OPENWOP_SIGNAL_DAEMON_URL)" };
 }
-function joinUrl(base, path) {
-  return new URL(path.replace(/^\//, ""), base.endsWith("/") ? base : `${base}/`);
+function joinUrl(base8, path) {
+  return new URL(path.replace(/^\//, ""), base8.endsWith("/") ? base8 : `${base8}/`);
 }
 async function signalDaemonRpc(baseUrl, method, params) {
   const res = await fetch(joinUrl(baseUrl, "api/v1/rpc"), {
@@ -523,7 +523,7 @@ function errText(err) {
 }
 
 // src/constants.ts
-var VERSION = "0.3.0";
+var VERSION = "0.18.2";
 var DEFAULT_BASE_URL = "http://localhost:8080";
 var DEFAULT_REGISTRY_URL = "https://packs.openwop.dev";
 var DEFAULT_API_KEY = "sample-token";
@@ -607,6 +607,7 @@ function extractGlobalOptions(argv, env = process.env) {
   const globals = {
     baseUrl: void 0,
     apiKey: void 0,
+    profile: void 0,
     json: false,
     quiet: false,
     verbose: false,
@@ -626,6 +627,10 @@ function extractGlobalOptions(argv, env = process.env) {
       globals.apiKey = value ?? takeValue(argv, ++i, "--api-key");
       continue;
     }
+    if (flag === "--profile") {
+      globals.profile = value ?? takeValue(argv, ++i, "--profile");
+      continue;
+    }
     if (arg === "--json") {
       globals.json = true;
       continue;
@@ -729,11 +734,11 @@ function saveConfig(path, config) {
   }
 }
 function mergeConfig(existing, next) {
-  const base = existing ?? {};
+  const base8 = existing ?? {};
   return {
-    ...base,
+    ...base8,
     ...next,
-    host: { ...base.host ?? {}, ...next.host ?? {} }
+    host: { ...base8.host ?? {}, ...next.host ?? {} }
   };
 }
 function getByPath(obj, path) {
@@ -1236,7 +1241,7 @@ async function runNotifications(ctx, argv) {
     write(ctx.io.stdout, NOTIFICATIONS_HELP);
     return 0;
   }
-  const base = "/v1/host/sample/notifications";
+  const base8 = "/v1/host/sample/notifications";
   const rest = argv.slice(1);
   switch (sub) {
     case "list": {
@@ -1245,7 +1250,7 @@ async function runNotifications(ctx, argv) {
       if (options.status) q.set("status", options.status);
       if (options.archived) q.set("includeArchived", "true");
       if (options.limit) q.set("limit", options.limit);
-      const res = await requestJson(ctx, `${base}${q.toString() ? `?${q}` : ""}`);
+      const res = await requestJson(ctx, `${base8}${q.toString() ? `?${q}` : ""}`);
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -1269,7 +1274,7 @@ async function runNotifications(ctx, argv) {
 `);
         return 2;
       }
-      const res = await requestJson(ctx, `${base}/${encodeURIComponent(rest[0])}/${sub}`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${base8}/${encodeURIComponent(rest[0])}/${sub}`, { method: "POST", body: {} });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -1278,7 +1283,7 @@ async function runNotifications(ctx, argv) {
       return 0;
     }
     case "mark-all-read": {
-      const res = await requestJson(ctx, `${base}:mark-all-read`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${base8}:mark-all-read`, { method: "POST", body: {} });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -1292,7 +1297,7 @@ async function runNotifications(ctx, argv) {
         write(ctx.io.stdout, "Usage: openwop notifications delete <id> [--json]\n");
         return 2;
       }
-      const res = await requestJson(ctx, `${base}/${encodeURIComponent(rest[0])}`, { method: "DELETE" });
+      const res = await requestJson(ctx, `${base8}/${encodeURIComponent(rest[0])}`, { method: "DELETE" });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -1377,9 +1382,14 @@ var PROMPTS_HELP = `Usage:
   openwop prompts list [--kind k] [--tag t] [--limit n] [--json]
   openwop prompts get <templateId> [--json]
   openwop prompts render <ref> [--variables-json '{...}'] [--json]
-
-Browse + render the host's prompt library (RFC 0029, /v1/prompts). \`render\`
-resolves a PromptRef (templateId[@version]) against the supplied variables.
+  openwop prompts create --template-id <id> --version <v> --kind <k> --text <t> [--json]
+  openwop prompts update <templateId> [--version v] [--kind k] [--text t] [--json]
+  openwop prompts delete <templateId> [--yes]
+
+Browse, render, and manage the host's prompt library (RFC 0029, /v1/prompts).
+\`render\` resolves a PromptRef (templateId[@version]) against the supplied
+variables. \`create\` posts a new PromptTemplate; \`update\` PUTs the fields you
+pass to an existing template; \`delete\` removes one.
 `;
 async function runPrompts(ctx, argv) {
   const sub = argv[0] ?? "list";
@@ -1438,6 +1448,44 @@ async function runPrompts(ctx, argv) {
       writeJson(ctx.io.stdout, res.body);
       return 0;
     }
+    case "create": {
+      const { options } = parseOptions(rest, { value: ["--template-id", "--version", "--kind", "--text"] });
+      if (!options.templateId || !options.version || !options.kind || !options.text) {
+        write(ctx.io.stderr, "Usage: openwop prompts create --template-id <id> --version <v> --kind <k> --text <t> [--json]\n");
+        return 2;
+      }
+      const body = { templateId: String(options.templateId), version: String(options.version), kind: String(options.kind), text: String(options.text) };
+      const res = await requestJson(ctx, "/v1/prompts", { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created prompt ${body.templateId}@${body.version}`);
+      return 0;
+    }
+    case "update": {
+      const { options, positionals } = parseOptions(rest, { value: ["--version", "--kind", "--text"] });
+      if (positionals.length !== 1) {
+        write(ctx.io.stdout, "Usage: openwop prompts update <templateId> [--version v] [--kind k] [--text t] [--json]\n");
+        return 2;
+      }
+      const body = {};
+      if (options.version) body.version = String(options.version);
+      if (options.kind) body.kind = String(options.kind);
+      if (options.text) body.text = String(options.text);
+      const res = await requestJson(ctx, `/v1/prompts/${encodeURIComponent(positionals[0])}`, { method: "PUT", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated prompt ${positionals[0]}`);
+      return 0;
+    }
+    case "delete": {
+      const { options, positionals } = parseOptions(rest, { bool: ["--yes"] });
+      if (positionals.length !== 1) {
+        write(ctx.io.stdout, "Usage: openwop prompts delete <templateId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete prompt ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `/v1/prompts/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted prompt ${positionals[0]}`);
+      return 0;
+    }
     default:
       throw new CliError(`Unknown prompts command: ${sub}
 Run \`openwop prompts --help\` for usage.`);
@@ -2074,6 +2122,10 @@ async function downloadAsset(ctx, assetUrl, outPath) {
 }
 
 // src/cli/shared.ts
+function requireOrg(org) {
+  if (!org) throw new CliError("This command is org-scoped \u2014 pass --org <orgId>.", 2);
+  return String(org);
+}
 function buildInputs(options) {
   const fromJson = options.inputsJson ? JSON.parse(options.inputsJson) : {};
   if (fromJson === null || typeof fromJson !== "object" || Array.isArray(fromJson)) {
@@ -2195,10 +2247,15 @@ async function runConfig(ctx, argv) {
 var CATALOG_HELP = `Usage:
   openwop catalog nodes [--search text] [--limit n] [--json]
   openwop catalog packs [--json]
+  openwop catalog tools [<toolId>] [--json]
+
+\`tools\` reads the portable tool catalog (RFC 0078 \xA7B) \u2014 GET /v1/tools, or
+GET /v1/tools/<toolId> for one descriptor. This is the tools an agent/workflow
+may call, distinct from the node catalog + installed packs.
 `;
 async function runCatalog(ctx, argv) {
   const sub = argv[0] ?? "nodes";
-  const args = argv.slice(sub === "nodes" || sub === "packs" ? 1 : 0);
+  const args = argv.slice(sub === "nodes" || sub === "packs" || sub === "tools" ? 1 : 0);
   if (sub === "--help" || sub === "-h") {
     write(ctx.io.stdout, CATALOG_HELP);
     return 0;
@@ -2208,10 +2265,35 @@ async function runCatalog(ctx, argv) {
       return runCatalogNodes(ctx, args);
     case "packs":
       return runCatalogPacks(ctx, args);
+    case "tools":
+      return runCatalogTools(ctx, args);
     default:
       throw new CliError(`Unknown catalog command: ${sub}`);
   }
 }
+async function runCatalogTools(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, CATALOG_HELP);
+    return 0;
+  }
+  const path = positionals.length === 1 ? `/v1/tools/${encodeURIComponent(positionals[0])}` : "/v1/tools";
+  const res = await requestJson(ctx, path);
+  if (ctx.json || positionals.length === 1) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const tools = Array.isArray(res.body?.tools) ? res.body.tools : Array.isArray(res.body) ? res.body : [];
+  if (tools.length === 0) {
+    writeLine(ctx.io.stdout, "No tools advertised.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    tools.map((t) => ({ toolId: t.toolId ?? t.id ?? "", title: t.title ?? t.name ?? "", effect: t.dataEffect ?? t.effect ?? "" })),
+    ["toolId", "title", "effect"]
+  ));
+  return 0;
+}
 async function runCatalogNodes(ctx, argv) {
   const { options } = parseOptions(argv, {
     bool: ["--help"],
@@ -2266,10 +2348,17 @@ var WORKFLOWS_HELP = `Usage:
   openwop workflows get <workflowId> [--json]
   openwop workflows register <workflow.json> [--json]
   openwop workflows delete <workflowId> [--json]
+  openwop workflows chains [--json]
+  openwop workflows from-chain <chainId> [--params-json '{...}'] [--json]
+  openwop workflows chain-pack-install --name <pack> [--version <v>] [--json]
+
+\`chains\` lists the host's workflow-chain templates (ADR 0163 / RFC 0013);
+\`from-chain\` expands one into a registered workflow you can run; \`chain-pack-install\`
+installs a signed workflow-chain pack.
 `;
 async function runWorkflows(ctx, argv) {
   const sub = argv[0] ?? "list";
-  const args = argv.slice(["list", "get", "register", "delete", "rm"].includes(sub) ? 1 : 0);
+  const args = argv.slice(["list", "get", "register", "delete", "rm", "chains", "from-chain", "chain-pack-install"].includes(sub) ? 1 : 0);
   if (sub === "--help" || sub === "-h") {
     write(ctx.io.stdout, WORKFLOWS_HELP);
     return 0;
@@ -2284,10 +2373,71 @@ async function runWorkflows(ctx, argv) {
     case "delete":
     case "rm":
       return runWorkflowsDelete(ctx, args);
+    case "chains":
+      return runWorkflowsChains(ctx, args);
+    case "from-chain":
+      return runWorkflowsFromChain(ctx, args);
+    case "chain-pack-install":
+      return runWorkflowsChainPackInstall(ctx, args);
     default:
       throw new CliError(`Unknown workflows command: ${sub}`);
   }
 }
+async function runWorkflowsChains(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, WORKFLOWS_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/workflow-chains");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const chains = Array.isArray(res.body?.chains) ? res.body.chains : [];
+  if (chains.length === 0) {
+    writeLine(ctx.io.stdout, "No workflow chains.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    chains.map((c) => ({ chainId: c.chainId ?? "", name: c.name ?? "", steps: Array.isArray(c.steps) ? c.steps.length : c.stepCount ?? "" })),
+    ["chainId", "name", "steps"]
+  ));
+  return 0;
+}
+async function runWorkflowsFromChain(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--chain", "--params-json"] });
+  const chainId = options.chain ?? positionals[0];
+  if (!chainId) {
+    write(ctx.io.stderr, "Usage: openwop workflows from-chain <chainId> [--params-json '{...}'] [--json]\n");
+    return 2;
+  }
+  let params = {};
+  if (options.paramsJson) {
+    try {
+      params = JSON.parse(String(options.paramsJson));
+    } catch {
+      throw new CliError("--params-json must be valid JSON.", 2);
+    }
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/workflows/from-chain", { method: "POST", body: { chainId, params } });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Registered workflow ${res.body?.workflowId ?? ""} from chain ${chainId}.`);
+  return 0;
+}
+async function runWorkflowsChainPackInstall(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--name", "--version"] });
+  if (!options.name) {
+    write(ctx.io.stderr, "Usage: openwop workflows chain-pack-install --name <pack> [--version <v>] [--json]\n");
+    return 2;
+  }
+  const body = { name: String(options.name) };
+  if (options.version) body.version = String(options.version);
+  const res = await requestJson(ctx, "/v1/host/sample/workflow-chain-packs/install", { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Installed workflow-chain pack ${options.name}.`);
+  return 0;
+}
 async function runWorkflowsList(ctx, argv) {
   const { options } = parseOptions(argv, { bool: ["--help"] });
   if (options.help) {
@@ -2900,6 +3050,10 @@ var KANBAN_HELP = `Usage:
   openwop kanban card-move <cardId> --column <columnId> [--json]
   openwop kanban card-update <cardId> [--title <text>] [--description <text>] [--column <columnId>] [--workflow <id>] [--json]
   openwop kanban card-delete <cardId> [--yes]
+  openwop kanban card-assign <cardId> --assignee <subject> [--role <r>] [--no-notify] [--json]
+  openwop kanban card-claim <cardId> [--json]
+  openwop kanban boards-personal [--json]
+  openwop kanban assigned [--json]
   openwop kanban watch <boardId>
 
 Kanban boards (host-extension under /v1/host/sample/kanban). A board is a lane
@@ -2925,7 +3079,7 @@ async function runKanban(ctx, argv) {
     write(ctx.io.stdout, KANBAN_HELP);
     return 0;
   }
-  const known = ["boards", "board", "board-create", "board-delete", "card-add", "card-move", "card-update", "card-delete", "watch"];
+  const known = ["boards", "board", "board-create", "board-delete", "card-add", "card-move", "card-update", "card-delete", "card-assign", "card-claim", "boards-personal", "assigned", "watch"];
   const args = argv.slice(known.includes(sub) ? 1 : 0);
   switch (sub) {
     case "boards":
@@ -2944,6 +3098,14 @@ async function runKanban(ctx, argv) {
       return await cardPatch(ctx, args, false);
     case "card-delete":
       return await cardDelete(ctx, args);
+    case "card-assign":
+      return await cardAssign(ctx, args);
+    case "card-claim":
+      return await cardClaim(ctx, args);
+    case "boards-personal":
+      return await boardsPersonal(ctx, args);
+    case "assigned":
+      return await assignedList(ctx, args);
     case "watch":
       return await boardWatch(ctx, args);
     default:
@@ -3079,52 +3241,2913 @@ async function cardPatch(ctx, argv, moveOnly) {
     if (options.description) body.description = options.description;
     if (options.workflow) body.workflowId = options.workflow;
   }
-  if (Object.keys(body).length === 0) throw new CliError("Nothing to update \u2014 pass at least one field.", 2);
-  const res = await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
-  if (ctx.json) {
-    writeJson(ctx.io.stdout, res.body);
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to update \u2014 pass at least one field.", 2);
+  const res = await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Updated card ${positionals[0]}.`);
+  return 0;
+}
+async function cardDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban card-delete <cardId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete card ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted card ${positionals[0]}.`);
+  return 0;
+}
+async function boardWatch(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban watch <boardId>\n");
+    return options.help ? 0 : 2;
+  }
+  const url = new URL(`v1/host/sample/kanban/boards/${encodeURIComponent(positionals[0])}/events`, ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`);
+  const headers = { accept: "text/event-stream" };
+  if (ctx.apiKey) headers.authorization = `Bearer ${ctx.apiKey}`;
+  const res = await ctx.fetchImpl(url, { headers });
+  if (!res.ok || !res.body) {
+    throw new CliError(`Could not open the board event stream (HTTP ${res.status}).`, 1);
+  }
+  writeLine(ctx.io.stdout, `Watching board ${positionals[0]} (Ctrl-C to stop)\u2026`);
+  await consumeSse(res.body, (frame) => {
+    if (ctx.json) {
+      writeLine(ctx.io.stdout, JSON.stringify(frame));
+      return;
+    }
+    const type = frame.event ?? "message";
+    writeLine(ctx.io.stdout, `\xB7 ${type}${frame.data ? `: ${frame.data}` : ""}`);
+  });
+  return 0;
+}
+async function cardAssign(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--assignee", "--role"], bool: ["--no-notify", "--help"] });
+  if (options.help || positionals.length !== 1 || !options.assignee) {
+    write(ctx.io.stdout, "Usage: openwop kanban card-assign <cardId> --assignee <subject> [--role r] [--no-notify] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = { assigneeId: options.assignee };
+  if (options.role) body.assigneeRole = options.role;
+  if (options.noNotify) body.notifyAssignee = false;
+  const res = await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}/assign`, { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Assigned card ${positionals[0]} to ${options.assignee}.`);
+  return 0;
+}
+async function cardClaim(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban card-claim <cardId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}/claim`, { method: "POST", body: {} });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Claimed card ${positionals[0]}.`);
+  return 0;
+}
+async function boardsPersonal(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, KANBAN_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/kanban/boards/personal");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const boards = Array.isArray(res.body?.boards) ? res.body.boards : [];
+  if (boards.length === 0) {
+    writeLine(ctx.io.stdout, "No personal boards.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    boards.map((b) => ({ boardId: b.boardId ?? b.id ?? "", name: b.name ?? "", cards: b.cardCount ?? "" })),
+    ["boardId", "name", "cards"]
+  ));
+  return 0;
+}
+async function assignedList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, KANBAN_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/kanban/assigned");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const cards = Array.isArray(res.body?.cards) ? res.body.cards : [];
+  if (cards.length === 0) {
+    writeLine(ctx.io.stdout, "No cards assigned to you.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    cards.map((c) => ({ cardId: c.id ?? c.cardId ?? "", title: c.title ?? "", board: c.boardId ?? "", column: c.columnId ?? "" })),
+    ["cardId", "title", "board", "column"]
+  ));
+  return 0;
+}
+
+// src/cli/brand.ts
+var PUBLIC_PATH = "/v1/host/openwop-app/public-brand";
+var APP_PATH = "/v1/host/openwop-app/app-brand";
+var CONTRAST = ["standard", "medium", "high"];
+var RADIUS = ["sm", "md", "lg"];
+var MODE = ["system", "light", "dark"];
+var BRAND_HELP = `Usage:
+  openwop brand public [--json]
+  openwop brand get [--json]
+  openwop brand set [--name <n>] [--product-name <n>] [--accent <color>] [--neutral <color>]
+                    [--contrast standard|medium|high] [--radius sm|md|lg] [--default-mode system|light|dark]
+                    [--logo <url>] [--favicon <url>] [--identity-json <json>] [--json]
+
+White-label app brand for the OpenWOP demo host (ADR 0170 / 0171). ONE brand owns the
+app's own runtime identity \u2014 logo, colors, fonts, name, and a generative theme \u2014 applied
+to the running app with no rebuild. Drives the host-extension surface
+GET/PUT /v1/host/openwop-app/{public-brand,app-brand}:
+  \u2022 public \u2014 the applied identity every visitor sees (anonymous; no auth needed).
+  \u2022 get / set \u2014 read + edit the reserved app brand; requires SUPER-ADMIN
+    (OPENWOP_SUPERADMIN_TENANTS; authenticate as that tenant).
+
+'set' is read-modify-write: it fetches the current brand, applies your flags, and PUTs
+the merged result \u2014 so setting --accent won't wipe the logo. The accent/neutral/contrast/
+radius flags feed the ADR 0171 theme generator, which derives a full, accessible light +
+dark theme from the seed (the accent is kept exact; text shades are solved for WCAG-AA).
+--identity-json REPLACES the whole identity facet (advanced \u2014 mirrors the editor's JSON tier).
+
+  --name <n>          The brand's internal name.
+  --product-name <n>  The app's product name (shown in the wordmark / document title).
+  --accent <color>    Brand accent seed \u2014 any CSS color (oklch / #hex / rgb). Generates the ramp.
+  --neutral <color>   Optional surface/background tint seed.
+  --contrast <lvl>    Contrast target: standard (AA) | medium | high.
+  --radius <size>     Corner radius: sm | md | lg.
+  --default-mode <m>  Default theme mode: system | light | dark.
+  --logo <url>        Logo / mark URL (https, root-relative, or data:image).
+  --favicon <url>     Favicon URL.
+  --identity-json <j> Full identity facet as JSON (REPLACES every identity field).
+  --json              Machine-readable output.
+
+Examples:
+  openwop brand public --json
+  openwop brand set --accent 'oklch(58% 0.13 250)' --product-name 'Acme Ops'
+  openwop brand set --identity-json '{"productName":"Acme","theme":{"accentSeed":"#0a84ff"}}'
+`;
+async function runBrand(ctx, argv) {
+  const sub = argv[0] ?? "public";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, BRAND_HELP);
+    return 0;
+  }
+  const args = argv.slice(["public", "get", "set"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "public":
+      return await brandPublic(ctx, args);
+    case "get":
+      return await brandGet(ctx, args);
+    case "set":
+      return await brandSet(ctx, args);
+    default:
+      throw new CliError(`Unknown brand command: ${sub}
+Run \`openwop brand --help\` for usage.`);
+  }
+}
+async function appRequest(ctx, path, options, action) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError && (err.status === 401 || err.status === 403)) {
+      throw new CliError(
+        `${action} requires super-admin on this host. Set OPENWOP_SUPERADMIN_TENANTS on the server and authenticate the CLI as that tenant (openwop onboard / --api-key).`,
+        4
+      );
+    }
+    throw err;
+  }
+}
+function showIdentity(ctx, identity) {
+  const id = identity ?? {};
+  const theme = id.theme ?? {};
+  const logo = id.logo ?? {};
+  writeLine(ctx.io.stdout, `productName:  ${id.productName ?? "(default)"}`);
+  writeLine(ctx.io.stdout, `accent:       ${theme.accentSeed ?? id.colors?.accent ?? "(stock)"}`);
+  if (theme.neutralSeed) writeLine(ctx.io.stdout, `neutral:      ${theme.neutralSeed}`);
+  writeLine(ctx.io.stdout, `contrast:     ${theme.contrastLevel ?? "standard"}`);
+  if (theme.radius) writeLine(ctx.io.stdout, `radius:       ${theme.radius}`);
+  writeLine(ctx.io.stdout, `defaultMode:  ${theme.defaultMode ?? "system"}`);
+  writeLine(ctx.io.stdout, `logo:         ${logo.markSrc ?? "(none)"}`);
+  writeLine(ctx.io.stdout, `favicon:      ${logo.faviconSrc ?? "(none)"}`);
+  if (theme.override && (theme.override.light || theme.override.dark)) {
+    writeLine(ctx.io.stdout, `override:     (advanced token overrides set)`);
+  }
+}
+async function brandPublic(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop brand public [--json]\n");
+    return 0;
+  }
+  const res = await requestJson(ctx, PUBLIC_PATH, { auth: false });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  showIdentity(ctx, res.body?.identity);
+  return 0;
+}
+async function brandGet(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop brand get [--json]\n");
+    return 0;
+  }
+  const res = await appRequest(ctx, APP_PATH, {}, "Reading the app brand");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const brand = res.body?.brand ?? {};
+  writeLine(ctx.io.stdout, `name:         ${brand.name ?? "(unnamed)"}`);
+  showIdentity(ctx, brand.identity);
+  return 0;
+}
+async function brandSet(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: [
+      "--name",
+      "--product-name",
+      "--accent",
+      "--neutral",
+      "--contrast",
+      "--radius",
+      "--default-mode",
+      "--logo",
+      "--favicon",
+      "--identity-json"
+    ]
+  });
+  if (options.help) {
+    write(ctx.io.stdout, BRAND_HELP);
+    return 0;
+  }
+  const enumErr = (flag, val, allowed) => {
+    if (val !== void 0 && !allowed.includes(String(val))) {
+      throw new CliError(`--${flag} must be one of: ${allowed.join(" | ")} (got: ${String(val)})`, 2);
+    }
+  };
+  enumErr("contrast", options.contrast, CONTRAST);
+  enumErr("radius", options.radius, RADIUS);
+  enumErr("default-mode", options.defaultMode, MODE);
+  const cur = await appRequest(ctx, APP_PATH, {}, "Reading the app brand");
+  const current = cur.body?.brand ?? {};
+  let identity;
+  if (options.identityJson) {
+    try {
+      identity = JSON.parse(String(options.identityJson));
+    } catch (err) {
+      throw new CliError(`--identity-json is not valid JSON: ${err.message}`, 2);
+    }
+    if (!identity || typeof identity !== "object") throw new CliError("--identity-json must be a JSON object", 2);
+  } else {
+    identity = { ...current.identity ?? {} };
+    if (options.productName) identity.productName = String(options.productName);
+    if (options.logo || options.favicon) {
+      identity.logo = { ...identity.logo ?? {} };
+      if (options.logo) identity.logo.markSrc = String(options.logo);
+      if (options.favicon) identity.logo.faviconSrc = String(options.favicon);
+    }
+    const theme = { ...identity.theme ?? {} };
+    if (options.accent) theme.accentSeed = String(options.accent);
+    if (options.neutral) theme.neutralSeed = String(options.neutral);
+    if (options.contrast) theme.contrastLevel = String(options.contrast);
+    if (options.radius) theme.radius = String(options.radius);
+    if (options.defaultMode) theme.defaultMode = String(options.defaultMode);
+    if (Object.keys(theme).length) identity.theme = theme;
+  }
+  const body = { identity };
+  if (options.name) body.name = String(options.name);
+  const res = await appRequest(ctx, APP_PATH, { method: "PUT", body }, "Updating the app brand");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, "App brand updated. Applied live to the running app.");
+  showIdentity(ctx, res.body?.brand?.identity);
+  return 0;
+}
+
+// src/cli/crm.ts
+var BASE = "/v1/host/sample/crm/contacts";
+var CRM_HELP = `Usage:
+  openwop crm list [--stage <s>] [--json]
+  openwop crm get <contactId> [--json]
+  openwop crm create --name <name> [--email <e>] [--company <c>] [--stage <s>] [--json]
+  openwop crm update <contactId> [--name n] [--email e] [--company c] [--stage s] [--json]
+  openwop crm delete <contactId> [--yes]
+  openwop crm triage <contactId> [--json]
+
+CRM contacts (host-extension ${BASE}). A contact has a name, optional email /
+company, and a pipeline stage. \`triage\` runs the host's triage workflow over a
+contact and returns the run. The host is the authority; the CLI mirrors + relays.
+`;
+async function runCrm(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, CRM_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "delete", "triage"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return crmList(ctx, args);
+    case "get":
+      return crmGet(ctx, args);
+    case "create":
+      return crmCreate(ctx, args);
+    case "update":
+      return crmUpdate(ctx, args);
+    case "delete":
+      return crmDelete(ctx, args);
+    case "triage":
+      return crmTriage(ctx, args);
+    default:
+      throw new CliError(`Unknown crm command: ${sub}
+Run \`openwop crm --help\` for usage.`);
+  }
+}
+async function crmList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--stage"] });
+  if (options.help) {
+    write(ctx.io.stdout, CRM_HELP);
+    return 0;
+  }
+  const q = options.stage ? `?stage=${encodeURIComponent(String(options.stage))}` : "";
+  const res = await requestJson(ctx, `${BASE}${q}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.contacts) ? res.body.contacts : Array.isArray(res.body) ? res.body : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No contacts.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    items.map((c) => ({ id: c.id ?? "", name: c.name ?? "", stage: c.stage ?? "", email: c.email ?? "", company: c.company ?? "" })),
+    ["id", "name", "stage", "email", "company"]
+  ));
+  return 0;
+}
+async function crmGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop crm get <contactId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `${BASE}/${encodeURIComponent(positionals[0])}`);
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function crmCreate(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--name", "--email", "--company", "--stage"] });
+  if (!options.name) {
+    write(ctx.io.stderr, "Usage: openwop crm create --name <name> [--email e] [--company c] [--stage s] [--json]\n");
+    return 2;
+  }
+  const body = { name: String(options.name) };
+  for (const k of ["email", "company", "stage"]) if (options[k]) body[k] = String(options[k]);
+  const res = await requestJson(ctx, BASE, { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Created contact ${res.body?.id ?? ""} (${body.name}).`);
+  return 0;
+}
+async function crmUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--name", "--email", "--company", "--stage"] });
+  if (positionals.length !== 1) {
+    write(ctx.io.stderr, "Usage: openwop crm update <contactId> [--name n] [--email e] [--company c] [--stage s] [--json]\n");
+    return 2;
+  }
+  const body = {};
+  for (const k of ["name", "email", "company", "stage"]) if (options[k]) body[k] = String(options[k]);
+  const res = await requestJson(ctx, `${BASE}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Updated contact ${positionals[0]}.`);
+  return 0;
+}
+async function crmDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop crm delete <contactId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to delete contact ${positionals[0]} without --yes.`, 2);
+  await requestJson(ctx, `${BASE}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted contact ${positionals[0]}.`);
+  return 0;
+}
+async function crmTriage(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop crm triage <contactId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `${BASE}/${encodeURIComponent(positionals[0])}/triage`, { method: "POST", body: {} });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Triaged contact ${positionals[0]} \u2192 run ${res.body?.runId ?? "(see --json)"}.`);
+  return 0;
+}
+
+// src/cli/csm.ts
+var BASE2 = "/v1/host/sample/csm/accounts";
+var CSM_HELP = `Usage:
+  openwop csm list [--json]
+  openwop csm get <accountId> [--json]
+  openwop csm create --name <name> [--health-score <0-100>] [--json]
+  openwop csm update <accountId> [--name n] [--health-score <0-100>] [--json]
+  openwop csm delete <accountId> [--yes]
+
+Customer-Success accounts (host-extension ${BASE2}). An account has a name and a
+health score. The host is the authority; the CLI mirrors + relays.
+`;
+async function runCsm(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, CSM_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "delete"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return csmList(ctx, args);
+    case "get":
+      return csmGet(ctx, args);
+    case "create":
+      return csmCreate(ctx, args);
+    case "update":
+      return csmUpdate(ctx, args);
+    case "delete":
+      return csmDelete(ctx, args);
+    default:
+      throw new CliError(`Unknown csm command: ${sub}
+Run \`openwop csm --help\` for usage.`);
+  }
+}
+async function csmList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, CSM_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, BASE2);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.accounts) ? res.body.accounts : Array.isArray(res.body) ? res.body : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No accounts.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    items.map((a) => ({ id: a.id ?? "", name: a.name ?? "", healthScore: a.healthScore ?? "" })),
+    ["id", "name", "healthScore"]
+  ));
+  return 0;
+}
+async function csmGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop csm get <accountId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `${BASE2}/${encodeURIComponent(positionals[0])}`);
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function csmCreate(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--name", "--health-score"] });
+  if (!options.name) {
+    write(ctx.io.stderr, "Usage: openwop csm create --name <name> [--health-score <0-100>] [--json]\n");
+    return 2;
+  }
+  const body = { name: String(options.name) };
+  if (options.healthScore !== void 0) body.healthScore = Number(options.healthScore);
+  const res = await requestJson(ctx, BASE2, { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Created account ${res.body?.id ?? ""} (${String(options.name)}).`);
+  return 0;
+}
+async function csmUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--name", "--health-score"] });
+  if (positionals.length !== 1) {
+    write(ctx.io.stderr, "Usage: openwop csm update <accountId> [--name n] [--health-score <0-100>] [--json]\n");
+    return 2;
+  }
+  const body = {};
+  if (options.name) body.name = String(options.name);
+  if (options.healthScore !== void 0) body.healthScore = Number(options.healthScore);
+  const res = await requestJson(ctx, `${BASE2}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Updated account ${positionals[0]}.`);
+  return 0;
+}
+async function csmDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop csm delete <accountId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to delete account ${positionals[0]} without --yes.`, 2);
+  await requestJson(ctx, `${BASE2}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted account ${positionals[0]}.`);
+  return 0;
+}
+
+// src/cli/comments.ts
+var base = (org) => `/v1/host/sample/comments/orgs/${encodeURIComponent(org)}/comments`;
+var COMMENTS_HELP = `Usage:
+  openwop comments list --org <orgId> --resource-type <t> --resource-id <id> [--json]
+  openwop comments create --org <orgId> --resource-type <t> --resource-id <id> --body <text> [--parent <commentId>] [--json]
+  openwop comments update <commentId> --org <orgId> --body <text> [--json]
+  openwop comments delete <commentId> --org <orgId> [--yes]
+
+Threaded comments on a (resourceType, resourceId) target (host-extension, org-scoped,
+ADR 0021). Every command needs --org. The host validates the resource in-org and emits
+a notification on add/reply; the CLI mirrors + relays.
+`;
+async function runComments(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, COMMENTS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "create", "update", "delete"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return commentsList(ctx, args);
+    case "create":
+      return commentsCreate(ctx, args);
+    case "update":
+      return commentsUpdate(ctx, args);
+    case "delete":
+      return commentsDelete(ctx, args);
+    default:
+      throw new CliError(`Unknown comments command: ${sub}
+Run \`openwop comments --help\` for usage.`);
+  }
+}
+async function commentsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--org", "--resource-type", "--resource-id"] });
+  if (options.help) {
+    write(ctx.io.stdout, COMMENTS_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  if (!options.resourceType || !options.resourceId) {
+    write(ctx.io.stderr, "comments list needs --resource-type and --resource-id.\n");
+    return 2;
+  }
+  const q = `?resourceType=${encodeURIComponent(String(options.resourceType))}&resourceId=${encodeURIComponent(String(options.resourceId))}`;
+  const res = await requestJson(ctx, `${base(org)}${q}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.comments) ? res.body.comments : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No comments.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    items.map((c) => ({ id: c.id ?? "", author: c.authorId ?? "", parent: c.parentId ?? "", body: (c.body ?? "").slice(0, 60) })),
+    ["id", "author", "parent", "body"]
+  ));
+  return 0;
+}
+async function commentsCreate(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--org", "--resource-type", "--resource-id", "--body", "--parent"] });
+  const org = requireOrg(options.org);
+  if (!options.resourceType || !options.resourceId || !options.body) {
+    write(ctx.io.stderr, "comments create needs --resource-type, --resource-id, and --body.\n");
+    return 2;
+  }
+  const body = { resourceType: String(options.resourceType), resourceId: String(options.resourceId), body: String(options.body) };
+  if (options.parent) body.parentId = String(options.parent);
+  const res = await requestJson(ctx, base(org), { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Added comment ${res.body?.id ?? ""}.`);
+  return 0;
+}
+async function commentsUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--org", "--body"] });
+  const org = requireOrg(options.org);
+  if (positionals.length !== 1 || !options.body) {
+    write(ctx.io.stderr, "Usage: openwop comments update <commentId> --org <orgId> --body <text> [--json]\n");
+    return 2;
+  }
+  const res = await requestJson(ctx, `${base(org)}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: { body: String(options.body) } });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Updated comment ${positionals[0]}.`);
+  return 0;
+}
+async function commentsDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop comments delete <commentId> --org <orgId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to delete comment ${positionals[0]} without --yes.`, 2);
+  await requestJson(ctx, `${base(org)}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted comment ${positionals[0]}.`);
+  return 0;
+}
+
+// src/cli/sharing.ts
+var links = (org) => `/v1/host/sample/sharing/orgs/${encodeURIComponent(org)}/links`;
+var SHARING_HELP = `Usage:
+  openwop sharing list --org <orgId> [--json]
+  openwop sharing create --org <orgId> --resource-type <t> --resource-id <id> [--json]
+  openwop sharing revoke <token> --org <orgId> [--yes]
+  openwop sharing resolve <token> [--json]
+
+Shareable links to a resource (host-extension, ADR 0013). \`list\`/\`create\`/\`revoke\`
+are org-scoped (need --org, RBAC-gated). \`resolve\` reads a public /shared/<token>
+link WITHOUT auth \u2014 the unguessable token IS the credential.
+`;
+async function runSharing(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, SHARING_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "create", "revoke", "resolve"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return sharingList(ctx, args);
+    case "create":
+      return sharingCreate(ctx, args);
+    case "revoke":
+      return sharingRevoke(ctx, args);
+    case "resolve":
+      return sharingResolve(ctx, args);
+    default:
+      throw new CliError(`Unknown sharing command: ${sub}
+Run \`openwop sharing --help\` for usage.`);
+  }
+}
+async function sharingList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--org"] });
+  if (options.help) {
+    write(ctx.io.stdout, SHARING_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const res = await requestJson(ctx, links(org));
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.links) ? res.body.links : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No share links.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    items.map((l) => ({ token: l.token ?? "", resource: `${l.resourceType ?? ""}:${l.resourceId ?? ""}`, createdAt: l.createdAt ?? "" })),
+    ["token", "resource", "createdAt"]
+  ));
+  return 0;
+}
+async function sharingCreate(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--org", "--resource-type", "--resource-id"] });
+  const org = requireOrg(options.org);
+  if (!options.resourceType || !options.resourceId) {
+    write(ctx.io.stderr, "sharing create needs --resource-type and --resource-id.\n");
+    return 2;
+  }
+  const body = { resourceType: String(options.resourceType), resourceId: String(options.resourceId) };
+  const res = await requestJson(ctx, links(org), { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Created share link ${res.body?.token ?? ""}${res.body?.url ? ` (${res.body.url})` : ""}.`);
+  return 0;
+}
+async function sharingRevoke(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop sharing revoke <token> --org <orgId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to revoke share link ${positionals[0]} without --yes.`, 2);
+  await requestJson(ctx, `${links(org)}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Revoked share link ${positionals[0]}.`);
+  return 0;
+}
+async function sharingResolve(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop sharing resolve <token> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/sample/shared/${encodeURIComponent(positionals[0])}`, { auth: false });
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+
+// src/cli/forms.ts
+var base2 = (org) => `/v1/host/sample/forms/orgs/${encodeURIComponent(org)}/forms`;
+var FORMS_HELP = `Usage:
+  openwop forms list --org <orgId> [--json]
+  openwop forms get <formId> --org <orgId> [--json]
+  openwop forms create --org <orgId> --title <t> [--fields-json '[...]'] [--json]
+  openwop forms update <formId> --org <orgId> [--title <t>] [--fields-json '[...]'] [--json]
+  openwop forms status <formId> --org <orgId> --status <draft|published|closed> [--json]
+  openwop forms delete <formId> --org <orgId> [--yes]
+  openwop forms submissions <formId> --org <orgId> [--json]
+
+Form builder + intake (host-extension, org-scoped). Every command needs --org.
+A form has a title + fields[]; \`status\` publishes/closes it; \`submissions\` reads
+the collected responses. The host is the authority; the CLI mirrors + relays.
+`;
+function parseFields(raw) {
+  if (raw === void 0) return void 0;
+  try {
+    return JSON.parse(String(raw));
+  } catch {
+    throw new CliError("--fields-json must be valid JSON.", 2);
+  }
+}
+async function runForms(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, FORMS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "status", "delete", "submissions"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return formsList(ctx, args);
+    case "get":
+      return formsGet(ctx, args);
+    case "create":
+      return formsCreate(ctx, args);
+    case "update":
+      return formsUpdate(ctx, args);
+    case "status":
+      return formsStatus(ctx, args);
+    case "delete":
+      return formsDelete(ctx, args);
+    case "submissions":
+      return formsSubmissions(ctx, args);
+    default:
+      throw new CliError(`Unknown forms command: ${sub}
+Run \`openwop forms --help\` for usage.`);
+  }
+}
+async function formsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--org"] });
+  if (options.help) {
+    write(ctx.io.stdout, FORMS_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const res = await requestJson(ctx, base2(org));
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.forms) ? res.body.forms : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No forms.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    items.map((f) => ({ id: f.id ?? "", title: f.title ?? "", status: f.status ?? "", fields: Array.isArray(f.fields) ? f.fields.length : "" })),
+    ["id", "title", "status", "fields"]
+  ));
+  return 0;
+}
+async function formsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop forms get <formId> --org <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `${base2(org)}/${encodeURIComponent(positionals[0])}`);
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function formsCreate(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--org", "--title", "--fields-json"] });
+  const org = requireOrg(options.org);
+  if (!options.title) {
+    write(ctx.io.stderr, "Usage: openwop forms create --org <orgId> --title <t> [--fields-json '[...]'] [--json]\n");
+    return 2;
+  }
+  const body = { title: String(options.title) };
+  const fields = parseFields(options.fieldsJson);
+  if (fields !== void 0) body.fields = fields;
+  const res = await requestJson(ctx, base2(org), { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Created form ${res.body?.id ?? ""} (${String(options.title)}).`);
+  return 0;
+}
+async function formsUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--org", "--title", "--fields-json"] });
+  const org = requireOrg(options.org);
+  if (positionals.length !== 1) {
+    write(ctx.io.stderr, "Usage: openwop forms update <formId> --org <orgId> [--title <t>] [--fields-json ...] [--json]\n");
+    return 2;
+  }
+  const body = {};
+  if (options.title) body.title = String(options.title);
+  const fields = parseFields(options.fieldsJson);
+  if (fields !== void 0) body.fields = fields;
+  const res = await requestJson(ctx, `${base2(org)}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Updated form ${positionals[0]}.`);
+  return 0;
+}
+async function formsStatus(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--org", "--status"] });
+  const org = requireOrg(options.org);
+  if (positionals.length !== 1 || !options.status) {
+    write(ctx.io.stderr, "Usage: openwop forms status <formId> --org <orgId> --status <draft|published|closed> [--json]\n");
+    return 2;
+  }
+  const res = await requestJson(ctx, `${base2(org)}/${encodeURIComponent(positionals[0])}/status`, { method: "POST", body: { status: String(options.status) } });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Form ${positionals[0]} \u2192 status ${options.status}.`);
+  return 0;
+}
+async function formsDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop forms delete <formId> --org <orgId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to delete form ${positionals[0]} without --yes.`, 2);
+  await requestJson(ctx, `${base2(org)}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted form ${positionals[0]}.`);
+  return 0;
+}
+async function formsSubmissions(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop forms submissions <formId> --org <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `${base2(org)}/${encodeURIComponent(positionals[0])}/submissions`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const subs = Array.isArray(res.body?.submissions) ? res.body.submissions : [];
+  writeLine(ctx.io.stdout, `${subs.length} submission(s).`);
+  if (subs.length) writeJson(ctx.io.stdout, subs);
+  return 0;
+}
+
+// src/cli/email.ts
+var base3 = (org) => `/v1/host/sample/email/orgs/${encodeURIComponent(org)}`;
+var EMAIL_HELP = `Usage:
+  openwop email templates list --org <orgId> [--json]
+  openwop email templates get <templateId> --org <orgId> [--json]
+  openwop email templates create --org <orgId> --name <n> --subject <s> --body <b> [--json]
+  openwop email templates update <templateId> --org <orgId> [--name n] [--subject s] [--body b] [--json]
+  openwop email templates delete <templateId> --org <orgId> [--yes]
+  openwop email campaigns list --org <orgId> [--json]
+  openwop email campaigns get <campaignId> --org <orgId> [--json]
+  openwop email campaigns create --org <orgId> --template <templateId> [--name <n>] [--json]
+  openwop email campaigns delete <campaignId> --org <orgId> [--yes]
+  openwop email campaigns send <campaignId> --org <orgId> [--yes] [--json]
+  openwop email campaigns sends <campaignId> --org <orgId> [--json]
+
+Outbound email (host-extension, org-scoped). Templates hold a name/subject/body;
+a campaign binds a template + audience; \`send\` dispatches it and \`sends\` reads the
+delivery log. Every command needs --org. The host is the authority; the CLI relays.
+`;
+async function runEmail(ctx, argv) {
+  const group = argv[0];
+  if (group === "--help" || group === "-h" || group === void 0) {
+    write(ctx.io.stdout, EMAIL_HELP);
+    return group === void 0 ? 2 : 0;
+  }
+  const rest = argv.slice(1);
+  if (group === "templates") return emailTemplates(ctx, rest);
+  if (group === "campaigns") return emailCampaigns(ctx, rest);
+  throw new CliError(`Unknown email command: ${group}. Use 'templates' or 'campaigns'.`);
+}
+async function emailTemplates(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "create", "update", "delete"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name", "--subject", "--body"] });
+  if (options.help) {
+    write(ctx.io.stdout, EMAIL_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const url = `${base3(org)}/templates`;
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, url);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.templates) ? res.body.templates : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No templates.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((t) => ({ id: t.id ?? "", name: t.name ?? "", subject: t.subject ?? "" })), ["id", "name", "subject"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email templates get <templateId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "create": {
+      if (!options.name || !options.subject || !options.body) {
+        write(ctx.io.stderr, "email templates create needs --name, --subject, --body.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, url, { method: "POST", body: { name: String(options.name), subject: String(options.subject), body: String(options.body) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created template ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "update": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email templates update <templateId> --org <orgId> [--name n] [--subject s] [--body b]\n");
+        return 2;
+      }
+      const patch = {};
+      for (const k of ["name", "subject", "body"]) if (options[k]) patch[k] = String(options[k]);
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated template ${positionals[0]}.`);
+      return 0;
+    }
+    case "delete": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email templates delete <templateId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete template ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted template ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown email templates command: ${sub}`);
+  }
+}
+async function emailCampaigns(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "create", "delete", "send", "sends"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--template", "--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, EMAIL_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const url = `${base3(org)}/campaigns`;
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, url);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.campaigns) ? res.body.campaigns : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No campaigns.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((c) => ({ id: c.id ?? "", name: c.name ?? "", status: c.status ?? "", template: c.templateId ?? "" })), ["id", "name", "status", "template"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email campaigns get <campaignId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "create": {
+      if (!options.template) {
+        write(ctx.io.stderr, "email campaigns create needs --template <templateId>.\n");
+        return 2;
+      }
+      const body = { templateId: String(options.template) };
+      if (options.name) body.name = String(options.name);
+      const res = await requestJson(ctx, url, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created campaign ${res.body?.id ?? ""}.`);
+      return 0;
+    }
+    case "delete": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email campaigns delete <campaignId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete campaign ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted campaign ${positionals[0]}.`);
+      return 0;
+    }
+    case "send": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email campaigns send <campaignId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to SEND campaign ${positionals[0]} without --yes (this dispatches real email).`, 2);
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}/send`, { method: "POST", body: {} });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Sent campaign ${positionals[0]}.`);
+      return 0;
+    }
+    case "sends": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop email campaigns sends <campaignId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}/sends`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown email campaigns command: ${sub}`);
+  }
+}
+
+// src/cli/chatWidget.ts
+var base4 = (org) => `/v1/host/sample/chat-widget/orgs/${encodeURIComponent(org)}/widgets`;
+var CHAT_WIDGET_HELP = `Usage:
+  openwop chat-widget list --org <orgId> [--json]
+  openwop chat-widget get <widgetId> --org <orgId> [--json]
+  openwop chat-widget create --org <orgId> [--name <n>] [--json]
+  openwop chat-widget update <widgetId> --org <orgId> [--name <n>] [--json]
+  openwop chat-widget delete <widgetId> --org <orgId> [--yes]
+  openwop chat-widget rotate-token <widgetId> --org <orgId> [--json]
+
+Embeddable chat widgets (host-extension, org-scoped). Each widget carries an embed
+token; \`rotate-token\` invalidates the old one. Every command needs --org.
+`;
+async function runChatWidget(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, CHAT_WIDGET_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "delete", "rotate-token"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, CHAT_WIDGET_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, base4(org));
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.widgets) ? res.body.widgets : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No widgets.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((w) => ({ id: w.id ?? w.widgetId ?? "", name: w.name ?? "", createdAt: w.createdAt ?? "" })), ["id", "name", "createdAt"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop chat-widget get <widgetId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${base4(org)}/${encodeURIComponent(positionals[0])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "create": {
+      const body = {};
+      if (options.name) body.name = String(options.name);
+      const res = await requestJson(ctx, base4(org), { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created widget ${res.body?.widget?.id ?? res.body?.id ?? ""}.`);
+      return 0;
+    }
+    case "update": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop chat-widget update <widgetId> --org <orgId> [--name n]\n");
+        return 2;
+      }
+      const patch = {};
+      if (options.name) patch.name = String(options.name);
+      const res = await requestJson(ctx, `${base4(org)}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated widget ${positionals[0]}.`);
+      return 0;
+    }
+    case "delete": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop chat-widget delete <widgetId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete widget ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `${base4(org)}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted widget ${positionals[0]}.`);
+      return 0;
+    }
+    case "rotate-token": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop chat-widget rotate-token <widgetId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${base4(org)}/${encodeURIComponent(positionals[0])}/rotate-token`, { method: "POST", body: {} });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Rotated token for widget ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown chat-widget command: ${sub}
+Run \`openwop chat-widget --help\` for usage.`);
+  }
+}
+
+// src/cli/marketplace.ts
+var MP = "/v1/host/sample/marketplace";
+var reviews = (org, pack) => `${MP}/orgs/${encodeURIComponent(org)}/listings/${encodeURIComponent(pack)}/reviews`;
+var MARKETPLACE_HELP = `Usage:
+  openwop marketplace listings [--json]
+  openwop marketplace install --pack <name> --version <v> [--json]
+  openwop marketplace reviews <packName> --org <orgId> [--json]
+  openwop marketplace review <packName> --org <orgId> --rating <1-5> [--comment <t>] [--json]
+  openwop marketplace unreview <packName> --org <orgId> [--yes]
+
+The pack marketplace (host-extension). \`listings\`/\`install\` browse + install shared
+packs; \`reviews\`/\`review\`/\`unreview\` are org-scoped (need --org). Distinct from the
+signed node-pack \`packs\` registry. The host is the authority; the CLI mirrors + relays.
+`;
+async function runMarketplace(ctx, argv) {
+  const sub = argv[0] ?? "listings";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, MARKETPLACE_HELP);
+    return 0;
+  }
+  const args = argv.slice(["listings", "install", "reviews", "review", "unreview"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "listings":
+      return mpListings(ctx, args);
+    case "install":
+      return mpInstall(ctx, args);
+    case "reviews":
+      return mpReviews(ctx, args);
+    case "review":
+      return mpReview(ctx, args);
+    case "unreview":
+      return mpUnreview(ctx, args);
+    default:
+      throw new CliError(`Unknown marketplace command: ${sub}
+Run \`openwop marketplace --help\` for usage.`);
+  }
+}
+async function mpListings(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, MARKETPLACE_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, `${MP}/listings`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.listings) ? res.body.listings : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No listings.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    items.map((l) => ({ pack: l.packName ?? l.name ?? "", version: l.version ?? l.latestVersion ?? "", rating: l.rating ?? "", installs: l.installs ?? "" })),
+    ["pack", "version", "rating", "installs"]
+  ));
+  return 0;
+}
+async function mpInstall(ctx, argv) {
+  const { options } = parseOptions(argv, { value: ["--pack", "--version"] });
+  if (!options.pack || !options.version) {
+    write(ctx.io.stderr, "Usage: openwop marketplace install --pack <name> --version <v> [--json]\n");
+    return 2;
+  }
+  const res = await requestJson(ctx, `${MP}/install`, { method: "POST", body: { packName: String(options.pack), version: String(options.version) } });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Installed ${String(options.pack)}@${String(options.version)}.`);
+  return 0;
+}
+async function mpReviews(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop marketplace reviews <packName> --org <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, reviews(org, positionals[0]));
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.reviews) ? res.body.reviews : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No reviews.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(items.map((r) => ({ author: r.authorId ?? "", rating: r.rating ?? "", comment: (r.comment ?? "").slice(0, 60) })), ["author", "rating", "comment"]));
+  return 0;
+}
+async function mpReview(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--org", "--rating", "--comment"] });
+  const org = requireOrg(options.org);
+  if (positionals.length !== 1 || options.rating === void 0) {
+    write(ctx.io.stderr, "Usage: openwop marketplace review <packName> --org <orgId> --rating <1-5> [--comment <t>] [--json]\n");
+    return 2;
+  }
+  const body = { rating: Number(options.rating) };
+  if (options.comment) body.comment = String(options.comment);
+  const res = await requestJson(ctx, reviews(org, positionals[0]), { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Reviewed ${positionals[0]} (${Number(options.rating)}\u2605).`);
+  return 0;
+}
+async function mpUnreview(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"], value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop marketplace unreview <packName> --org <orgId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to remove your review of ${positionals[0]} without --yes.`, 2);
+  await requestJson(ctx, reviews(org, positionals[0]), { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Removed review of ${positionals[0]}.`);
+  return 0;
+}
+
+// src/cli/kb.ts
+var base5 = (org) => `/v1/host/sample/kb/orgs/${encodeURIComponent(org)}`;
+var cols = (org) => `${base5(org)}/collections`;
+var KB_HELP = `Usage:
+  openwop kb collections list --org <orgId> [--json]
+  openwop kb collections get <collectionId> --org <orgId> [--json]
+  openwop kb collections create --org <orgId> --name <n> [--json]
+  openwop kb collections delete <collectionId> --org <orgId> [--yes]
+  openwop kb docs list <collectionId> --org <orgId> [--json]
+  openwop kb docs get <collectionId> <documentId> --org <orgId> [--json]
+  openwop kb docs add <collectionId> --org <orgId> --title <t> --text <text> [--json]
+  openwop kb docs delete <collectionId> <documentId> --org <orgId> [--yes]
+  openwop kb search <collectionId> --org <orgId> --query <q> [--top-k <n>] [--json]
+  openwop kb rag <collectionId> --org <orgId> --query <q> [--top-k <n>] [--json]
+
+Knowledge base (host-extension, org-scoped). Collections hold documents; \`search\` runs
+retrieval and \`rag\` a retrieve-then-generate query. Every command needs --org. The host
+is the authority; the CLI mirrors + relays.
+`;
+async function runKb(ctx, argv) {
+  const group = argv[0] ?? "collections";
+  if (group === "--help" || group === "-h") {
+    write(ctx.io.stdout, KB_HELP);
+    return 0;
+  }
+  const rest = argv.slice(1);
+  switch (group) {
+    case "collections":
+      return kbCollections(ctx, rest);
+    case "docs":
+      return kbDocs(ctx, rest);
+    case "search":
+      return kbSearch(ctx, rest, "search");
+    case "rag":
+      return kbSearch(ctx, rest, "rag");
+    default:
+      throw new CliError(`Unknown kb command: ${group}. Use collections|docs|search|rag.`);
+  }
+}
+async function kbCollections(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "create", "delete"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, KB_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, cols(org));
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.collections) ? res.body.collections : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No collections.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((c) => ({ id: c.id ?? c.collectionId ?? "", name: c.name ?? "", docs: c.documentCount ?? "" })), ["id", "name", "docs"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop kb collections get <collectionId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${cols(org)}/${encodeURIComponent(positionals[0])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "create": {
+      if (!options.name) {
+        write(ctx.io.stderr, "kb collections create needs --name.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, cols(org), { method: "POST", body: { name: String(options.name) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created collection ${res.body?.id ?? res.body?.collectionId ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "delete": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop kb collections delete <collectionId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete collection ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `${cols(org)}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted collection ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown kb collections command: ${sub}`);
+  }
+}
+async function kbDocs(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "add", "delete"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--title", "--text"] });
+  if (options.help) {
+    write(ctx.io.stdout, KB_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const collectionId = positionals[0];
+  if (!collectionId) {
+    write(ctx.io.stderr, "kb docs commands need a <collectionId>.\n");
+    return 2;
+  }
+  const docsUrl = `${cols(org)}/${encodeURIComponent(collectionId)}/documents`;
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, docsUrl);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.documents) ? res.body.documents : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No documents.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((d) => ({ id: d.id ?? d.documentId ?? "", title: d.title ?? "" })), ["id", "title"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 2) {
+        write(ctx.io.stderr, "Usage: openwop kb docs get <collectionId> <documentId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${docsUrl}/${encodeURIComponent(positionals[1])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "add": {
+      if (!options.title || !options.text) {
+        write(ctx.io.stderr, "kb docs add needs --title and --text.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, docsUrl, { method: "POST", body: { title: String(options.title), text: String(options.text) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Added document ${res.body?.id ?? ""} to ${collectionId}.`);
+      return 0;
+    }
+    case "delete": {
+      if (positionals.length !== 2) {
+        write(ctx.io.stderr, "Usage: openwop kb docs delete <collectionId> <documentId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete document ${positionals[1]} without --yes.`, 2);
+      await requestJson(ctx, `${docsUrl}/${encodeURIComponent(positionals[1])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted document ${positionals[1]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown kb docs command: ${sub}`);
+  }
+}
+async function kbSearch(ctx, argv, kind) {
+  const { options, positionals } = parseOptions(argv, { value: ["--org", "--query", "--top-k"] });
+  const org = requireOrg(options.org);
+  if (positionals.length !== 1 || !options.query) {
+    write(ctx.io.stderr, `Usage: openwop kb ${kind} <collectionId> --org <orgId> --query <q> [--top-k <n>] [--json]
+`);
+    return 2;
+  }
+  const body = { query: String(options.query) };
+  if (options.topK !== void 0) body.topK = Number(options.topK);
+  const res = await requestJson(ctx, `${cols(org)}/${encodeURIComponent(positionals[0])}/${kind}`, { method: "POST", body });
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+
+// src/cli/cms.ts
+var pages = (org) => `/v1/host/sample/cms/orgs/${encodeURIComponent(org)}/pages`;
+var LIFECYCLE = ["submit", "approve", "reject", "publish", "unpublish", "archive"];
+var CMS_HELP = `Usage:
+  openwop cms pages list --org <orgId> [--json]
+  openwop cms pages get <pageId> --org <orgId> [--json]
+  openwop cms pages by-slug <slug> --org <orgId> [--json]
+  openwop cms pages create --org <orgId> --title <t> [--slug <s>] [--json]
+  openwop cms pages update <pageId> --org <orgId> [--title <t>] [--slug <s>] [--json]
+  openwop cms pages delete <pageId> --org <orgId> [--yes]
+  openwop cms pages versions <pageId> --org <orgId> [--json]
+  openwop cms <submit|approve|reject|publish|unpublish|archive> <pageId> --org <orgId> [--json]
+
+CMS pages + the authoring lifecycle (host-extension, org-scoped, ADR 0027). A page
+moves draft \u2192 submit \u2192 approve \u2192 publish; \`versions\` lists its history. Every command
+needs --org. The host is the authority; the CLI mirrors + relays.
+`;
+async function runCms(ctx, argv) {
+  const sub = argv[0] ?? "pages";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, CMS_HELP);
+    return 0;
+  }
+  if (sub === "pages") return cmsPages(ctx, argv.slice(1));
+  if (LIFECYCLE.includes(sub)) return cmsLifecycle(ctx, sub, argv.slice(1));
+  throw new CliError(`Unknown cms command: ${sub}
+Run \`openwop cms --help\` for usage.`);
+}
+async function cmsPages(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "by-slug", "create", "update", "delete", "versions"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--title", "--slug"] });
+  if (options.help) {
+    write(ctx.io.stdout, CMS_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const url = pages(org);
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, url);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.pages) ? res.body.pages : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No pages.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((p) => ({ id: p.id ?? p.pageId ?? "", title: p.title ?? "", slug: p.slug ?? "", status: p.status ?? "" })), ["id", "title", "slug", "status"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop cms pages get <pageId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "by-slug": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop cms pages by-slug <slug> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${url}/by-slug/${encodeURIComponent(positionals[0])}`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "create": {
+      if (!options.title) {
+        write(ctx.io.stderr, "cms pages create needs --title.\n");
+        return 2;
+      }
+      const body = { title: String(options.title) };
+      if (options.slug) body.slug = String(options.slug);
+      const res = await requestJson(ctx, url, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created page ${res.body?.id ?? ""} (${String(options.title)}).`);
+      return 0;
+    }
+    case "update": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop cms pages update <pageId> --org <orgId> [--title t] [--slug s]\n");
+        return 2;
+      }
+      const patch = {};
+      if (options.title) patch.title = String(options.title);
+      if (options.slug) patch.slug = String(options.slug);
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated page ${positionals[0]}.`);
+      return 0;
+    }
+    case "delete": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop cms pages delete <pageId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete page ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted page ${positionals[0]}.`);
+      return 0;
+    }
+    case "versions": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop cms pages versions <pageId> --org <orgId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${url}/${encodeURIComponent(positionals[0])}/versions`);
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown cms pages command: ${sub}`);
+  }
+}
+async function cmsLifecycle(ctx, action, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--org"] });
+  const org = requireOrg(options.org);
+  if (positionals.length !== 1) {
+    write(ctx.io.stderr, `Usage: openwop cms ${action} <pageId> --org <orgId> [--json]
+`);
+    return 2;
+  }
+  const res = await requestJson(ctx, `${pages(org)}/${encodeURIComponent(positionals[0])}/${action}`, { method: "POST", body: {} });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Page ${positionals[0]} \u2192 ${action}.`);
+  return 0;
+}
+
+// src/cli/documents.ts
+var base6 = (org) => `/v1/host/sample/documents/orgs/${encodeURIComponent(org)}`;
+var DOCUMENTS_HELP = `Usage:
+  openwop documents list --org <orgId> [--json]
+  openwop documents get <documentId> --org <orgId> [--json]
+  openwop documents create --org <orgId> --title <t> --kind <k> [--format <f>] [--json]
+  openwop documents update <documentId> --org <orgId> [--title <t>] [--json]
+  openwop documents delete <documentId> --org <orgId> [--yes]
+  openwop documents versions <documentId> --org <orgId> [--json]
+  openwop documents render <documentId> --org <orgId> [--json]
+  openwop documents templates list --org <orgId> [--json]
+  openwop documents templates get <templateId> --org <orgId> [--json]
+  openwop documents templates create --org <orgId> --name <n> --kind <k> [--output-format <f>] [--json]
+  openwop documents templates delete <templateId> --org <orgId> [--yes]
+
+Document generation + templates (host-extension, org-scoped). A document has a
+title/kind/format and versioned content; \`render\` produces its output; templates
+drive assembly. Every command needs --org. The host is the authority; the CLI relays.
+`;
+async function runDocuments(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, DOCUMENTS_HELP);
+    return 0;
+  }
+  if (sub === "templates") return docTemplates(ctx, argv.slice(1));
+  const args = argv.slice(["list", "get", "create", "update", "delete", "versions", "render"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--title", "--kind", "--format"] });
+  if (options.help) {
+    write(ctx.io.stdout, DOCUMENTS_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const docs = `${base6(org)}/documents`;
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, docs);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.documents) ? res.body.documents : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No documents.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((d) => ({ id: d.id ?? "", title: d.title ?? "", kind: d.kind ?? "", format: d.format ?? "" })), ["id", "title", "kind", "format"]));
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents get <documentId> --org <orgId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${docs}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.title || !options.kind) {
+        write(ctx.io.stderr, "documents create needs --title and --kind.\n");
+        return 2;
+      }
+      const body = { title: String(options.title), kind: String(options.kind) };
+      if (options.format) body.format = String(options.format);
+      const res = await requestJson(ctx, docs, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created document ${res.body?.id ?? ""} (${String(options.title)}).`);
+      return 0;
+    }
+    case "update": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents update <documentId> --org <orgId> [--title t]\n");
+        return 2;
+      }
+      const patch = {};
+      if (options.title) patch.title = String(options.title);
+      const res = await requestJson(ctx, `${docs}/${encodeURIComponent(id)}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated document ${id}.`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents delete <documentId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete document ${id} without --yes.`, 2);
+      await requestJson(ctx, `${docs}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted document ${id}.`);
+      return 0;
+    }
+    case "versions": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents versions <documentId> --org <orgId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${docs}/${encodeURIComponent(id)}/versions`)).body);
+      return 0;
+    }
+    case "render": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents render <documentId> --org <orgId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${docs}/${encodeURIComponent(id)}/render`, { method: "POST", body: {} })).body);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown documents command: ${sub}`);
+  }
+}
+async function docTemplates(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "create", "delete"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name", "--kind", "--output-format"] });
+  if (options.help) {
+    write(ctx.io.stdout, DOCUMENTS_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  const url = `${base6(org)}/templates`;
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, url);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.templates) ? res.body.templates : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No templates.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((t) => ({ id: t.id ?? "", name: t.name ?? "", kind: t.kind ?? "" })), ["id", "name", "kind"]));
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents templates get <templateId> --org <orgId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${url}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.name || !options.kind) {
+        write(ctx.io.stderr, "documents templates create needs --name and --kind.\n");
+        return 2;
+      }
+      const body = { name: String(options.name), kind: String(options.kind) };
+      if (options.outputFormat) body.outputFormat = String(options.outputFormat);
+      const res = await requestJson(ctx, url, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created template ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop documents templates delete <templateId> --org <orgId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete template ${id} without --yes.`, 2);
+      await requestJson(ctx, `${url}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted template ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown documents templates command: ${sub}`);
+  }
+}
+
+// src/cli/projects.ts
+var BASE3 = "/v1/host/sample/projects";
+var PROJECTS_HELP = `Usage:
+  openwop projects list [--json]
+  openwop projects get <projectId> [--json]
+  openwop projects create --org <orgId> --name <n> [--json]
+  openwop projects update <projectId> [--name <n>] [--json]
+  openwop projects delete <projectId> [--yes]
+  openwop projects members list <projectId> [--json]
+  openwop projects members add <projectId> --ref <subjectRef> [--json]
+  openwop projects members remove <projectId> <ref> [--yes]
+
+Project workspaces (host-extension). A project scopes members + knowledge + schedules;
+\`create\` needs the owning --org. The host is the authority; the CLI mirrors + relays.
+`;
+async function runProjects(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, PROJECTS_HELP);
+    return 0;
+  }
+  if (sub === "members") return projectMembers(ctx, argv.slice(1));
+  const args = argv.slice(["list", "get", "create", "update", "delete"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, PROJECTS_HELP);
+    return 0;
+  }
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, BASE3);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.projects) ? res.body.projects : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No projects.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((p) => ({ id: p.id ?? "", name: p.name ?? "", org: p.orgId ?? "" })), ["id", "name", "org"]));
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop projects get <projectId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE3}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.org || !options.name) {
+        write(ctx.io.stderr, "projects create needs --org and --name.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, BASE3, { method: "POST", body: { orgId: String(options.org), name: String(options.name) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created project ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "update": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop projects update <projectId> [--name n]\n");
+        return 2;
+      }
+      const patch = {};
+      if (options.name) patch.name = String(options.name);
+      const res = await requestJson(ctx, `${BASE3}/${encodeURIComponent(id)}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated project ${id}.`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop projects delete <projectId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete project ${id} without --yes.`, 2);
+      await requestJson(ctx, `${BASE3}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted project ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown projects command: ${sub}`);
+  }
+}
+async function projectMembers(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "add", "remove"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--ref"] });
+  if (options.help) {
+    write(ctx.io.stdout, PROJECTS_HELP);
+    return 0;
+  }
+  const projectId = positionals[0];
+  if (!projectId) {
+    write(ctx.io.stderr, "projects members commands need a <projectId>.\n");
+    return 2;
+  }
+  const url = `${BASE3}/${encodeURIComponent(projectId)}/members`;
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, url);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.members) ? res.body.members : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((m) => ({ ref: m.ref ?? m.subject ?? "", role: m.role ?? "" })), ["ref", "role"]) : "No members.");
+      return 0;
+    }
+    case "add": {
+      if (!options.ref) {
+        write(ctx.io.stderr, "projects members add needs --ref <subjectRef>.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, url, { method: "POST", body: { ref: String(options.ref) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Added member ${String(options.ref)} to ${projectId}.`);
+      return 0;
+    }
+    case "remove": {
+      if (positionals.length !== 2) {
+        write(ctx.io.stderr, "Usage: openwop projects members remove <projectId> <ref> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to remove member ${positionals[1]} without --yes.`, 2);
+      await requestJson(ctx, `${url}/${encodeURIComponent(positionals[1])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Removed member ${positionals[1]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown projects members command: ${sub}`);
+  }
+}
+
+// src/cli/reviews.ts
+var BASE4 = "/v1/host/sample/reviews";
+var REVIEWS_HELP = `Usage:
+  openwop reviews list [--status <s>] [--json]
+  openwop reviews get <reviewId> [--json]
+  openwop reviews action <reviewId> <action> [--note <t>] [--json]
+
+The unified review inbox (ADR 0068 / RFC 0070). Reviewers act on a review via a named
+<action> (e.g. approve | reject | comment) that the host defines + quorums. The host is
+the authority; the CLI renders its resolved view and relays the action. Exit: 0 resolved
+\xB7 3 pending \xB7 1 rejected/error.`;
+async function runReviews(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, REVIEWS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "action"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help"], value: ["--status", "--note"] });
+  if (options.help) {
+    write(ctx.io.stdout, REVIEWS_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "list": {
+      const q = options.status ? `?status=${encodeURIComponent(String(options.status))}` : "";
+      const res = await requestJson(ctx, `${BASE4}${q}`);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.reviews) ? res.body.reviews : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No reviews.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((r) => ({ id: r.reviewId ?? r.id ?? "", status: r.status ?? "", kind: r.kind ?? "", title: (r.title ?? "").slice(0, 50) })), ["id", "status", "kind", "title"]));
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop reviews get <reviewId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${BASE4}/${encodeURIComponent(positionals[0])}`);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      writeJson(ctx.io.stdout, res.body);
+      const st = res.body?.status;
+      return st === "approved" || st === "resolved" ? 0 : st === "rejected" ? 1 : 3;
+    }
+    case "action": {
+      if (positionals.length !== 2) {
+        write(ctx.io.stderr, "Usage: openwop reviews action <reviewId> <action> [--note <t>] [--json]\n");
+        return 2;
+      }
+      const body = options.note ? { note: String(options.note) } : {};
+      const res = await requestJson(ctx, `${BASE4}/${encodeURIComponent(positionals[0])}/actions/${encodeURIComponent(positionals[1])}`, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Applied action '${positionals[1]}' to review ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown reviews command: ${sub}
+Run \`openwop reviews --help\` for usage.`);
+  }
+}
+
+// src/cli/workspacesTenancy.ts
+var WORKSPACES_HELP = `Usage:
+  openwop workspaces list [--json]
+  openwop workspaces create --name <n> [--json]
+  openwop workspaces switch <workspaceId> [--json]
+
+Your B2B workspaces (each a tenant, ADR 0015). \`switch\` changes the active workspace.
+Distinct from \`workspace\` (singular) \u2014 the per-tenant agent FILE store.`;
+async function runWorkspaces(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, WORKSPACES_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "create", "switch"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help"], value: ["--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, WORKSPACES_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, "/v1/host/sample/me/workspaces");
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.workspaces) ? res.body.workspaces : [];
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, "No workspaces.");
+        return 0;
+      }
+      writeLine(ctx.io.stdout, formatTable(items.map((w) => ({ id: w.id ?? w.workspaceId ?? "", name: w.name ?? "", active: w.active ? "yes" : "" })), ["id", "name", "active"]));
+      return 0;
+    }
+    case "create": {
+      if (!options.name) {
+        write(ctx.io.stderr, "Usage: openwop workspaces create --name <n> [--json]\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, "/v1/host/sample/workspaces", { method: "POST", body: { name: String(options.name) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created workspace ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "switch": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop workspaces switch <workspaceId> [--json]\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `/v1/host/sample/workspaces/${encodeURIComponent(positionals[0])}/switch`, { method: "POST", body: {} });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Switched to workspace ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown workspaces command: ${sub}
+Run \`openwop workspaces --help\` for usage.`);
+  }
+}
+
+// src/cli/agentProfile.ts
+var prof = (id) => `/v1/host/sample/agents/${encodeURIComponent(id)}/profile`;
+var AGENT_PROFILE_HELP = `Usage:
+  openwop agent-profile get <agentId> [--json]
+  openwop agent-profile set <agentId> --profile-json '{...}' [--json]
+  openwop agent-profile readiness <agentId> [--json]
+
+An agent's rich profile + its connector readiness (ADR 0031). \`set\` PUTs the full
+profile object; \`readiness\` reports whether the connectors the agent needs are wired.`;
+async function runAgentProfile(ctx, argv) {
+  const sub = argv[0] ?? "get";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, AGENT_PROFILE_HELP);
+    return 0;
+  }
+  const args = argv.slice(["get", "set", "readiness"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help"], value: ["--profile-json"] });
+  if (options.help) {
+    write(ctx.io.stdout, AGENT_PROFILE_HELP);
+    return 0;
+  }
+  if (positionals.length !== 1) {
+    write(ctx.io.stderr, `Usage: openwop agent-profile ${sub} <agentId>
+`);
+    return 2;
+  }
+  const agentId = positionals[0];
+  switch (sub) {
+    case "get":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, prof(agentId))).body);
+      return 0;
+    case "readiness":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `/v1/host/sample/agents/${encodeURIComponent(agentId)}/connection-readiness`)).body);
+      return 0;
+    case "set": {
+      if (!options.profileJson) {
+        write(ctx.io.stderr, "agent-profile set needs --profile-json '{...}'.\n");
+        return 2;
+      }
+      let profile;
+      try {
+        profile = JSON.parse(String(options.profileJson));
+      } catch {
+        throw new CliError("--profile-json must be valid JSON.", 2);
+      }
+      const res = await requestJson(ctx, prof(agentId), { method: "PUT", body: profile });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated profile for agent ${agentId}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown agent-profile command: ${sub}`);
+  }
+}
+
+// src/cli/agentAllowlists.ts
+var BASE5 = "/v1/host/sample/agent-allowlists/admin/agents";
+var AGENT_ALLOWLISTS_HELP = `Usage:
+  openwop agent-allowlists list [--json]
+  openwop agent-allowlists get <agentId> [--json]
+  openwop agent-allowlists set <agentId> --allowlist-json '[...]' [--json]
+  openwop agent-allowlists clear <agentId> [--yes]
+
+Super-admin per-agent tool-allowlist overrides (ADR 0104). \`set\` PUTs the override
+(an array of tool ids); \`clear\` removes it. Requires super-admin (OPENWOP_SUPERADMIN_TENANTS).`;
+async function req(ctx, path, opts, action) {
+  try {
+    return await requestJson(ctx, path, opts);
+  } catch (err) {
+    if (err instanceof HttpError && (err.status === 401 || err.status === 403)) {
+      throw new CliError(`${action} requires super-admin on this host (OPENWOP_SUPERADMIN_TENANTS).`, 4);
+    }
+    throw err;
+  }
+}
+async function runAgentAllowlists(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, AGENT_ALLOWLISTS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "set", "clear"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--allowlist-json"] });
+  if (options.help) {
+    write(ctx.io.stdout, AGENT_ALLOWLISTS_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "list": {
+      const res = await req(ctx, BASE5, {}, "Reading agent allowlists");
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.agents) ? res.body.agents : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((a) => ({ agentId: a.agentId ?? a.id ?? "", tools: Array.isArray(a.allowlist) ? a.allowlist.length : "" })), ["agentId", "tools"]) : "No allowlist overrides.");
+      return 0;
+    }
+    case "get": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop agent-allowlists get <agentId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await req(ctx, `${BASE5}/${encodeURIComponent(positionals[0])}`, {}, "Reading the agent allowlist")).body);
+      return 0;
+    }
+    case "set": {
+      if (positionals.length !== 1 || !options.allowlistJson) {
+        write(ctx.io.stderr, "Usage: openwop agent-allowlists set <agentId> --allowlist-json '[...]'\n");
+        return 2;
+      }
+      let allowlist;
+      try {
+        allowlist = JSON.parse(String(options.allowlistJson));
+      } catch {
+        throw new CliError("--allowlist-json must be valid JSON.", 2);
+      }
+      const res = await req(ctx, `${BASE5}/${encodeURIComponent(positionals[0])}`, { method: "PUT", body: { allowlist } }, "Setting the agent allowlist");
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Set allowlist override for ${positionals[0]}.`);
+      return 0;
+    }
+    case "clear": {
+      if (positionals.length !== 1) {
+        write(ctx.io.stderr, "Usage: openwop agent-allowlists clear <agentId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to clear the allowlist override for ${positionals[0]} without --yes.`, 2);
+      await req(ctx, `${BASE5}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, "Clearing the agent allowlist");
+      writeLine(ctx.io.stdout, `Cleared allowlist override for ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown agent-allowlists command: ${sub}`);
+  }
+}
+
+// src/cli/agentPacks.ts
+var BASE6 = "/v1/host/sample/registry/agent-packs";
+var AGENT_PACKS_HELP = `Usage:
+  openwop agent-packs list [--json]
+  openwop agent-packs install --name <core.openwop.agents.*> [--version <v>] [--json]
+
+The agent (persona) pack registry. \`install\` provisions a signed agent pack (its name
+MUST start with 'core.openwop.agents.'). Distinct from the node-pack 'packs' registry.`;
+async function runAgentPacks(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, AGENT_PACKS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "install"].includes(sub) ? 1 : 0);
+  const { options } = parseOptions(args, { bool: ["--help"], value: ["--name", "--version"] });
+  if (options.help) {
+    write(ctx.io.stdout, AGENT_PACKS_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, BASE6);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.packs) ? res.body.packs : Array.isArray(res.body) ? res.body : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((p) => ({ name: p.name ?? "", version: p.version ?? p.latestVersion ?? "", agents: Array.isArray(p.agents) ? p.agents.length : "" })), ["name", "version", "agents"]) : "No agent packs.");
+      return 0;
+    }
+    case "install": {
+      if (!options.name) {
+        write(ctx.io.stderr, "Usage: openwop agent-packs install --name <core.openwop.agents.*> [--version <v>]\n");
+        return 2;
+      }
+      const body = { name: String(options.name) };
+      if (options.version) body.version = String(options.version);
+      const res = await requestJson(ctx, `${BASE6}/install`, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Installed agent pack ${String(options.name)}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown agent-packs command: ${sub}`);
+  }
+}
+
+// src/cli/agentOps.ts
+var H = "/v1/host/sample";
+var AGENT_OPS_HELP = `Usage:
+  openwop agent-ops seed [--heal] [--json]
+  openwop agent-ops status [--json]
+  openwop agent-ops run [--step <id>]... [--dry-run] [--json]
+  openwop agent-ops clear [--yes]
+  openwop agent-ops roster-check <rosterId> [--json]
+  openwop agent-ops roster-activity <rosterId> [--json]
+  openwop agent-ops fleet-activity [--json]
+
+Demo/operations helpers: seed/run/clear the example dataset + read roster & fleet
+activity. \`seed --heal\` repairs a partial seed; \`run --dry-run\` previews without writing.`;
+async function runAgentOps(ctx, argv) {
+  const sub = argv[0] ?? "status";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, AGENT_OPS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["seed", "status", "run", "clear", "roster-check", "roster-activity", "fleet-activity"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--heal", "--dry-run", "--yes"], multi: ["--step"] });
+  if (options.help) {
+    write(ctx.io.stdout, AGENT_OPS_HELP);
+    return 0;
+  }
+  const rid = positionals[0];
+  switch (sub) {
+    case "seed": {
+      const res = await requestJson(ctx, `${H}/example-data/seed`, { method: "POST", body: options.heal ? { heal: true } : {} });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, "Seeded example data.");
+      return 0;
+    }
+    case "status":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${H}/example-data/status`)).body);
+      return 0;
+    case "run": {
+      const body = {};
+      if (Array.isArray(options.step) && options.step.length) body.steps = options.step;
+      if (options.dryRun) body.dryRun = true;
+      const res = await requestJson(ctx, `${H}/example-data/run`, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, options.dryRun ? "Dry-run complete." : "Ran example-data steps.");
+      return 0;
+    }
+    case "clear": {
+      if (!options.yes) throw new CliError("Refusing to clear example data without --yes.", 2);
+      await requestJson(ctx, `${H}/example-data/clear`, { method: "POST", body: {} });
+      writeLine(ctx.io.stdout, "Cleared example data.");
+      return 0;
+    }
+    case "roster-check": {
+      if (!rid) {
+        write(ctx.io.stderr, "Usage: openwop agent-ops roster-check <rosterId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${H}/roster/${encodeURIComponent(rid)}/check`, { method: "POST", body: {} });
+      writeJson(ctx.io.stdout, res.body);
+      return 0;
+    }
+    case "roster-activity": {
+      if (!rid) {
+        write(ctx.io.stderr, "Usage: openwop agent-ops roster-activity <rosterId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${H}/roster/${encodeURIComponent(rid)}/activity`)).body);
+      return 0;
+    }
+    case "fleet-activity":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${H}/fleet/activity`)).body);
+      return 0;
+    default:
+      throw new CliError(`Unknown agent-ops command: ${sub}`);
+  }
+}
+
+// src/cli/evals.ts
+var base7 = (org) => `/v1/host/sample/evals/orgs/${encodeURIComponent(org)}`;
+var EVALS_HELP = `Usage:
+  openwop evals leaderboard --org <orgId> [--json]
+  openwop evals rating --org <orgId> [--json]
+  openwop evals match --org <orgId> --model-a <a> --model-b <b> --winner <a|b|tie> [--json]
+
+Model evals (host-extension, org-scoped). \`leaderboard\`/\`rating\` read the standings;
+\`match\` records an arena head-to-head outcome. Every command needs --org.`;
+async function runEvals(ctx, argv) {
+  const sub = argv[0] ?? "leaderboard";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, EVALS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["leaderboard", "rating", "match"].includes(sub) ? 1 : 0);
+  const { options } = parseOptions(args, { bool: ["--help"], value: ["--org", "--model-a", "--model-b", "--winner"] });
+  if (options.help) {
+    write(ctx.io.stdout, EVALS_HELP);
+    return 0;
+  }
+  const org = requireOrg(options.org);
+  switch (sub) {
+    case "leaderboard":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${base7(org)}/leaderboard`)).body);
+      return 0;
+    case "rating":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${base7(org)}/arena/rating`)).body);
+      return 0;
+    case "match": {
+      if (!options.modelA || !options.modelB || !options.winner) {
+        write(ctx.io.stderr, "evals match needs --model-a, --model-b, --winner.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${base7(org)}/arena/match`, { method: "POST", body: { modelA: String(options.modelA), modelB: String(options.modelB), winner: String(options.winner) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Recorded match (${String(options.modelA)} vs ${String(options.modelB)} \u2192 ${String(options.winner)}).`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown evals command: ${sub}`);
+  }
+}
+
+// src/cli/twin.ts
+var twinPath = (id) => `/v1/host/sample/agents/${encodeURIComponent(id)}/twin`;
+var GRANTS = "/v1/host/sample/profiles/me/twin-grants";
+var TWIN_HELP = `Usage:
+  openwop twin get <agentId> [--json]
+  openwop twin set <agentId> --scopes <a,b,...> [--json]
+  openwop twin clear <agentId> [--yes]
+  openwop twin grants [--json]
+  openwop twin grant --agent <agentId> --scopes <a,b,...> [--json]
+  openwop twin revoke <agentId> [--yes]
+
+An agent's digital-twin config + your twin GRANTS (which agents may act as your twin,
+with which scopes). \`set\` configures an agent's twin; \`grant\`/\`revoke\` manage grants.`;
+async function runTwin(ctx, argv) {
+  const sub = argv[0] ?? "get";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, TWIN_HELP);
+    return 0;
+  }
+  const args = argv.slice(["get", "set", "clear", "grants", "grant", "revoke"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--scopes", "--agent"] });
+  if (options.help) {
+    write(ctx.io.stdout, TWIN_HELP);
+    return 0;
+  }
+  const scopes = options.scopes ? String(options.scopes).split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  switch (sub) {
+    case "get": {
+      if (!positionals[0]) {
+        write(ctx.io.stderr, "Usage: openwop twin get <agentId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, twinPath(positionals[0]))).body);
+      return 0;
+    }
+    case "set": {
+      if (!positionals[0] || !scopes) {
+        write(ctx.io.stderr, "Usage: openwop twin set <agentId> --scopes <a,b,...>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, twinPath(positionals[0]), { method: "PUT", body: { scopes } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Configured twin for agent ${positionals[0]}.`);
+      return 0;
+    }
+    case "clear": {
+      if (!positionals[0]) {
+        write(ctx.io.stderr, "Usage: openwop twin clear <agentId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to clear the twin for ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, twinPath(positionals[0]), { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Cleared twin for ${positionals[0]}.`);
+      return 0;
+    }
+    case "grants": {
+      const res = await requestJson(ctx, GRANTS);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.grants) ? res.body.grants : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((g) => ({ agentId: g.agentId ?? "", scopes: Array.isArray(g.scopes) ? g.scopes.join(",") : "" })), ["agentId", "scopes"]) : "No twin grants.");
+      return 0;
+    }
+    case "grant": {
+      if (!options.agent || !scopes) {
+        write(ctx.io.stderr, "Usage: openwop twin grant --agent <agentId> --scopes <a,b,...>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, GRANTS, { method: "POST", body: { agentId: String(options.agent), scopes } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Granted twin scope to ${String(options.agent)}.`);
+      return 0;
+    }
+    case "revoke": {
+      if (!positionals[0]) {
+        write(ctx.io.stderr, "Usage: openwop twin revoke <agentId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to revoke the twin grant for ${positionals[0]} without --yes.`, 2);
+      await requestJson(ctx, `${GRANTS}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Revoked twin grant for ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown twin command: ${sub}`);
+  }
+}
+
+// src/cli/strategy.ts
+var BASE7 = "/v1/host/sample/strategy";
+var STRATEGY_HELP = `Usage:
+  openwop strategy list [--json]
+  openwop strategy get <strategyId> [--json]
+  openwop strategy create --org <orgId> --title <t> [--json]
+  openwop strategy update <strategyId> [--title <t>] [--json]
+  openwop strategy delete <strategyId> [--yes]
+  openwop strategy context [--json]
+  openwop strategy health [--json]
+
+Strategy documents (host-extension). \`context\`/\`health\` read the strategy context +
+its health. \`create\` needs the owning --org. The host is the authority; the CLI relays.`;
+async function runStrategy(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, STRATEGY_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "delete", "context", "health"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--title"] });
+  if (options.help) {
+    write(ctx.io.stdout, STRATEGY_HELP);
+    return 0;
+  }
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, BASE7);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.strategies) ? res.body.strategies : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((s) => ({ id: s.id ?? "", title: s.title ?? "", org: s.orgId ?? "" })), ["id", "title", "org"]) : "No strategies.");
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop strategy get <strategyId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE7}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "context":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE7}/context`)).body);
+      return 0;
+    case "health":
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE7}/health`)).body);
+      return 0;
+    case "create": {
+      if (!options.org || !options.title) {
+        write(ctx.io.stderr, "strategy create needs --org and --title.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, BASE7, { method: "POST", body: { orgId: String(options.org), title: String(options.title) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created strategy ${res.body?.id ?? ""} (${String(options.title)}).`);
+      return 0;
+    }
+    case "update": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop strategy update <strategyId> [--title t]\n");
+        return 2;
+      }
+      const patch = {};
+      if (options.title) patch.title = String(options.title);
+      const res = await requestJson(ctx, `${BASE7}/${encodeURIComponent(id)}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated strategy ${id}.`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop strategy delete <strategyId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete strategy ${id} without --yes.`, 2);
+      await requestJson(ctx, `${BASE7}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted strategy ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown strategy command: ${sub}`);
+  }
+}
+
+// src/cli/advisoryBoard.ts
+var BOARDS = "/v1/host/sample/advisors/boards";
+var ADVISORS_HELP = `Usage:
+  openwop advisors list [--json]
+  openwop advisors get <boardId> [--json]
+  openwop advisors by-handle <handle> [--json]
+  openwop advisors create --org <orgId> --name <n> [--handle <h>] [--json]
+  openwop advisors delete <boardId> [--yes]
+
+Advisory boards (host-extension) \u2014 a panel of advisor agents. \`create\` needs the
+owning --org. The host is the authority; the CLI mirrors + relays.`;
+async function runAdvisors(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, ADVISORS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "by-handle", "create", "delete"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name", "--handle"] });
+  if (options.help) {
+    write(ctx.io.stdout, ADVISORS_HELP);
+    return 0;
+  }
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, BOARDS);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.boards) ? res.body.boards : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((b) => ({ id: b.id ?? b.boardId ?? "", name: b.name ?? "", handle: b.handle ?? "" })), ["id", "name", "handle"]) : "No advisory boards.");
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop advisors get <boardId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BOARDS}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "by-handle": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop advisors by-handle <handle>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BOARDS}/by-handle/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.org || !options.name) {
+        write(ctx.io.stderr, "advisors create needs --org and --name.\n");
+        return 2;
+      }
+      const body = { orgId: String(options.org), name: String(options.name) };
+      if (options.handle) body.handle = String(options.handle);
+      const res = await requestJson(ctx, BOARDS, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created advisory board ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop advisors delete <boardId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete advisory board ${id} without --yes.`, 2);
+      await requestJson(ctx, `${BOARDS}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted advisory board ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown advisors command: ${sub}`);
+  }
+}
+
+// src/cli/campaignOrchestration.ts
+var BASE8 = "/v1/host/sample/campaign-orchestration/campaigns";
+var CAMPAIGNS_ORCH_HELP = `Usage:
+  openwop campaigns-orchestration list [--json]
+  openwop campaigns-orchestration get <campaignId> [--json]
+  openwop campaigns-orchestration create --name <n> [--json]
+  openwop campaigns-orchestration update <campaignId> [--name <n>] [--json]
+  openwop campaigns-orchestration delete <campaignId> [--yes]
+  openwop campaigns-orchestration finalize <campaignId> [--yes] [--json]
+
+Campaign orchestration (host-extension). \`finalize\` locks a campaign for execution.
+The host is the authority; the CLI mirrors + relays.`;
+async function runCampaignsOrch(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, CAMPAIGNS_ORCH_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "delete", "finalize"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, CAMPAIGNS_ORCH_HELP);
+    return 0;
+  }
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, BASE8);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.campaigns) ? res.body.campaigns : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((c) => ({ id: c.id ?? "", name: c.name ?? "", status: c.status ?? "" })), ["id", "name", "status"]) : "No campaigns.");
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop campaigns-orchestration get <campaignId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE8}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.name) {
+        write(ctx.io.stderr, "campaigns-orchestration create needs --name.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, BASE8, { method: "POST", body: { name: String(options.name) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created campaign ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "update": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop campaigns-orchestration update <campaignId> [--name n]\n");
+        return 2;
+      }
+      const patch = {};
+      if (options.name) patch.name = String(options.name);
+      const res = await requestJson(ctx, `${BASE8}/${encodeURIComponent(id)}`, { method: "PATCH", body: patch });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Updated campaign ${id}.`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop campaigns-orchestration delete <campaignId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete campaign ${id} without --yes.`, 2);
+      await requestJson(ctx, `${BASE8}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted campaign ${id}.`);
+      return 0;
+    }
+    case "finalize": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop campaigns-orchestration finalize <campaignId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to finalize campaign ${id} without --yes.`, 2);
+      const res = await requestJson(ctx, `/v1/host/sample/campaign-orchestration/finalize`, { method: "POST", body: { campaignId: id } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Finalized campaign ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown campaigns-orchestration command: ${sub}`);
+  }
+}
+
+// src/cli/notebooks.ts
+var BASE9 = "/v1/host/sample/notebooks";
+var NOTEBOOKS_HELP = `Usage:
+  openwop notebooks list [--json]
+  openwop notebooks get <notebookId> [--json]
+  openwop notebooks create --org <orgId> --name <n> [--json]
+  openwop notebooks delete <notebookId> [--yes]
+  openwop notebooks notes <notebookId> [--json]
+
+NotebookLM-style notebooks (host-extension). A notebook holds sources + notes + a chat.
+\`create\` needs the owning --org. The host is the authority; the CLI mirrors + relays.`;
+async function runNotebooks(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, NOTEBOOKS_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "delete", "notes"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, NOTEBOOKS_HELP);
     return 0;
   }
-  writeLine(ctx.io.stdout, `Updated card ${positionals[0]}.`);
-  return 0;
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, BASE9);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.notebooks) ? res.body.notebooks : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((n) => ({ id: n.id ?? "", title: n.title ?? "", sources: n.sourceCount ?? "" })), ["id", "title", "sources"]) : "No notebooks.");
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop notebooks get <notebookId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE9}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "notes": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop notebooks notes <notebookId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE9}/${encodeURIComponent(id)}/notes`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.org || !options.name) {
+        write(ctx.io.stderr, "notebooks create needs --org and --name.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, BASE9, { method: "POST", body: { orgId: String(options.org), name: String(options.name) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created notebook ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop notebooks delete <notebookId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete notebook ${id} without --yes.`, 2);
+      await requestJson(ctx, `${BASE9}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted notebook ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown notebooks command: ${sub}`);
+  }
 }
-async function cardDelete(ctx, argv) {
-  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
-  if (options.help || positionals.length !== 1) {
-    write(ctx.io.stdout, "Usage: openwop kanban card-delete <cardId> [--yes]\n");
-    return options.help ? 0 : 2;
+
+// src/cli/podcasts.ts
+var EP = "/v1/host/sample/podcasts/episodes";
+var PODCASTS_HELP = `Usage:
+  openwop podcasts list [--json]
+  openwop podcasts get <episodeId> [--json]
+  openwop podcasts create --org <orgId> --notebook <notebookId> --episode-profile <profileId> [--title <t>] [--json]
+  openwop podcasts delete <episodeId> [--yes]
+  openwop podcasts retry <episodeId> [--json]
+
+Podcast episodes (host-extension). \`create\` starts an episode; \`retry\` re-runs a
+failed generation. The host is the authority; the CLI mirrors + relays.`;
+async function runPodcasts(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, PODCASTS_HELP);
+    return 0;
   }
-  if (!options.yes) {
-    writeLine(ctx.io.stderr, `Refusing to delete card ${positionals[0]} without --yes.`);
-    return 2;
+  const args = argv.slice(["list", "get", "create", "delete", "retry"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--title", "--org", "--notebook", "--episode-profile"] });
+  if (options.help) {
+    write(ctx.io.stdout, PODCASTS_HELP);
+    return 0;
+  }
+  const id = positionals[0];
+  switch (sub) {
+    case "list": {
+      const res = await requestJson(ctx, EP);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.episodes) ? res.body.episodes : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((e) => ({ id: e.id ?? "", title: e.title ?? "", status: e.status ?? "" })), ["id", "title", "status"]) : "No episodes.");
+      return 0;
+    }
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop podcasts get <episodeId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${EP}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.org || !options.notebook || !options.episodeProfile) {
+        write(ctx.io.stderr, "podcasts create needs --org, --notebook, and --episode-profile.\n");
+        return 2;
+      }
+      const body = { orgId: String(options.org), notebookId: String(options.notebook), episodeProfileId: String(options.episodeProfile) };
+      if (options.title) body.title = String(options.title);
+      const res = await requestJson(ctx, EP, { method: "POST", body });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created episode ${res.body?.id ?? ""}.`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop podcasts delete <episodeId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete episode ${id} without --yes.`, 2);
+      await requestJson(ctx, `${EP}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted episode ${id}.`);
+      return 0;
+    }
+    case "retry": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop podcasts retry <episodeId>\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, `${EP}/${encodeURIComponent(id)}/retry`, { method: "POST", body: {} });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Retrying episode ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown podcasts command: ${sub}`);
   }
-  await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
-  writeLine(ctx.io.stdout, `Deleted card ${positionals[0]}.`);
-  return 0;
 }
-async function boardWatch(ctx, argv) {
-  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
-  if (options.help || positionals.length !== 1) {
-    write(ctx.io.stdout, "Usage: openwop kanban watch <boardId>\n");
-    return options.help ? 0 : 2;
+
+// src/cli/priorityMatrix.ts
+var LISTS = "/v1/host/sample/priority-matrix/lists";
+var PRIORITY_MATRIX_HELP = `Usage:
+  openwop priority-matrix lists [--json]
+  openwop priority-matrix get <listId> [--json]
+  openwop priority-matrix create --org <orgId> --name <n> [--json]
+  openwop priority-matrix delete <listId> [--yes]
+  openwop priority-matrix ideas <listId> [--json]
+
+Prioritization boards (host-extension). A list holds scored/voted ideas; \`ideas\` reads
+a list's ideas. \`create\` needs the owning --org. The host is the authority.`;
+async function runPriorityMatrix(ctx, argv) {
+  const sub = argv[0] ?? "lists";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, PRIORITY_MATRIX_HELP);
+    return 0;
   }
-  const url = new URL(`v1/host/sample/kanban/boards/${encodeURIComponent(positionals[0])}/events`, ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`);
-  const headers = { accept: "text/event-stream" };
-  if (ctx.apiKey) headers.authorization = `Bearer ${ctx.apiKey}`;
-  const res = await ctx.fetchImpl(url, { headers });
-  if (!res.ok || !res.body) {
-    throw new CliError(`Could not open the board event stream (HTTP ${res.status}).`, 1);
+  const args = argv.slice(["lists", "get", "create", "delete", "ideas"].includes(sub) ? 1 : 0);
+  const { options, positionals } = parseOptions(args, { bool: ["--help", "--yes"], value: ["--org", "--name"] });
+  if (options.help) {
+    write(ctx.io.stdout, PRIORITY_MATRIX_HELP);
+    return 0;
   }
-  writeLine(ctx.io.stdout, `Watching board ${positionals[0]} (Ctrl-C to stop)\u2026`);
-  await consumeSse(res.body, (frame) => {
-    if (ctx.json) {
-      writeLine(ctx.io.stdout, JSON.stringify(frame));
-      return;
+  const id = positionals[0];
+  switch (sub) {
+    case "lists": {
+      const res = await requestJson(ctx, LISTS);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = Array.isArray(res.body?.lists) ? res.body.lists : [];
+      writeLine(ctx.io.stdout, items.length ? formatTable(items.map((l) => ({ id: l.id ?? l.listId ?? "", name: l.name ?? "", ideas: l.ideaCount ?? "" })), ["id", "name", "ideas"]) : "No lists.");
+      return 0;
     }
-    const type = frame.event ?? "message";
-    writeLine(ctx.io.stdout, `\xB7 ${type}${frame.data ? `: ${frame.data}` : ""}`);
-  });
-  return 0;
+    case "get": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop priority-matrix get <listId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${LISTS}/${encodeURIComponent(id)}`)).body);
+      return 0;
+    }
+    case "ideas": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop priority-matrix ideas <listId>\n");
+        return 2;
+      }
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${LISTS}/${encodeURIComponent(id)}/ideas`)).body);
+      return 0;
+    }
+    case "create": {
+      if (!options.org || !options.name) {
+        write(ctx.io.stderr, "priority-matrix create needs --org and --name.\n");
+        return 2;
+      }
+      const res = await requestJson(ctx, LISTS, { method: "POST", body: { orgId: String(options.org), name: String(options.name) } });
+      if (ctx.json) writeJson(ctx.io.stdout, res.body);
+      else writeLine(ctx.io.stdout, `Created list ${res.body?.id ?? ""} (${String(options.name)}).`);
+      return 0;
+    }
+    case "delete": {
+      if (!id) {
+        write(ctx.io.stderr, "Usage: openwop priority-matrix delete <listId> [--yes]\n");
+        return 2;
+      }
+      if (!options.yes) throw new CliError(`Refusing to delete list ${id} without --yes.`, 2);
+      await requestJson(ctx, `${LISTS}/${encodeURIComponent(id)}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted list ${id}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown priority-matrix command: ${sub}`);
+  }
 }
 
 // src/cli/accessControl.ts
@@ -3313,10 +6336,10 @@ async function runEntity(ctx, entity, argv) {
     return orgId ? 0 : 2;
   }
   const rest = argv.slice(2);
-  const base = `/v1/host/sample/orgs/${encodeURIComponent(orgId)}/${entity}`;
+  const base8 = `/v1/host/sample/orgs/${encodeURIComponent(orgId)}/${entity}`;
   switch (verb) {
     case "list": {
-      const res = await requestJson(ctx, base);
+      const res = await requestJson(ctx, base8);
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -3332,7 +6355,7 @@ async function runEntity(ctx, entity, argv) {
     case "create": {
       const { body, ok: ok3 } = entityBody(ctx, entity, rest, true);
       if (!ok3) return 2;
-      const res = await requestJson(ctx, base, { method: "POST", body });
+      const res = await requestJson(ctx, base8, { method: "POST", body });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -3348,7 +6371,7 @@ async function runEntity(ctx, entity, argv) {
       }
       const { body, ok: ok3 } = entityBody(ctx, entity, rest, false);
       if (!ok3) return 2;
-      const res = await requestJson(ctx, `${base}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+      const res = await requestJson(ctx, `${base8}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -3366,7 +6389,7 @@ async function runEntity(ctx, entity, argv) {
         writeLine(ctx.io.stderr, `Refusing to delete ${singular(entity)} ${positionals[0]} without --yes.`);
         return 2;
       }
-      await requestJson(ctx, `${base}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      await requestJson(ctx, `${base8}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted ${singular(entity)} ${positionals[0]}.`);
       return 0;
     }
@@ -3673,6 +6696,9 @@ var BYOK_HELP = `Usage:
   openwop byok list [--json]
   openwop byok set --ref <credentialRef> [--value <secret>] [--json]
   openwop byok delete <credentialRef> [--yes]
+  openwop byok ai-default [get] [--json]
+  openwop byok ai-default set <credentialRef> [--json]
+  openwop byok ai-default clear [--yes]
 
 Bring-your-own-key secret store (host-side). The host holds the secret; the
 credential-payload-redaction invariant (RFC 0046) means a value is NEVER
@@ -3696,7 +6722,7 @@ async function runByok(ctx, argv) {
     write(ctx.io.stdout, BYOK_HELP);
     return 0;
   }
-  const args = argv.slice(["list", "set", "delete"].includes(sub) ? 1 : 0);
+  const args = argv.slice(["list", "set", "delete", "ai-default"].includes(sub) ? 1 : 0);
   switch (sub) {
     case "list":
       return await byokList(ctx, args);
@@ -3704,6 +6730,8 @@ async function runByok(ctx, argv) {
       return await byokSet(ctx, args);
     case "delete":
       return await byokDelete(ctx, args);
+    case "ai-default":
+      return await byokAiDefault(ctx, args);
     default:
       throw new CliError(`Unknown byok command: ${sub}
 Run \`openwop byok --help\` for usage.`);
@@ -3766,6 +6794,39 @@ async function byokDelete(ctx, argv) {
   writeLine(ctx.io.stdout, `Deleted secret ref ${positionals[0]}.`);
   return 0;
 }
+async function byokAiDefault(ctx, argv) {
+  const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "get";
+  const rest = ["get", "set", "clear"].includes(action) ? argv.slice(1) : argv;
+  const { options, positionals } = parseOptions(rest, { bool: ["--help", "--yes"] });
+  if (options.help) {
+    write(ctx.io.stdout, BYOK_HELP);
+    return 0;
+  }
+  const path = "/v1/host/sample/byok/ai-default";
+  if (action === "set") {
+    if (positionals.length !== 1) {
+      write(ctx.io.stderr, "Usage: openwop byok ai-default set <credentialRef> [--json]\n");
+      return 2;
+    }
+    const res2 = await requestJson(ctx, path, { method: "PUT", body: { credentialRef: positionals[0] } });
+    if (ctx.json) writeJson(ctx.io.stdout, res2.body);
+    else writeLine(ctx.io.stdout, `AI-default credential set to ${positionals[0]}.`);
+    return 0;
+  }
+  if (action === "clear") {
+    if (!options.yes) {
+      writeLine(ctx.io.stderr, "Refusing to clear the AI-default binding without --yes.");
+      return 2;
+    }
+    await requestJson(ctx, path, { method: "DELETE" });
+    writeLine(ctx.io.stdout, "AI-default credential cleared.");
+    return 0;
+  }
+  const res = await requestJson(ctx, path);
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `AI-default credentialRef: ${res.body?.credentialRef ?? "(none)"}`);
+  return 0;
+}
 
 // src/cli/conformance.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -3893,6 +6954,10 @@ var RUNS_HELP = `Usage:
   openwop runs annotations <runId> [--json]
   openwop runs annotate <runId> (--rating 1-5 | --label t | --correction t | --flag) [--note t] [--event-id id] [--node-id id]
   openwop runs debug-bundle <runId> [--max-events n] [--out file] [--json]
+  openwop runs fork <runId> [--mode replay|branch] [--from-sequence n] [--json]
+  openwop runs diff <runId> --against <otherRunId> [--json]
+  openwop runs delete <runId> [--yes]
+  openwop runs bulk-cancel <runId...> [--reason text] [--json]
 
 \`runs events\` polls GET /v1/runs/{runId}/events/poll (JSON, not SSE); --since N
 returns events with sequence > N. \`runs annotate\` posts a review signal
@@ -3917,7 +6982,7 @@ Input parsing for \`runs create\`:
 `;
 async function runRuns(ctx, argv) {
   const sub = argv[0] ?? "list";
-  const args = argv.slice(["list", "create", "get", "cancel", "ancestry", "events", "annotations", "annotate", "debug-bundle"].includes(sub) ? 1 : 0);
+  const args = argv.slice(["list", "create", "get", "cancel", "ancestry", "events", "annotations", "annotate", "debug-bundle", "fork", "diff", "delete", "bulk-cancel"].includes(sub) ? 1 : 0);
   if (sub === "--help" || sub === "-h") {
     write(ctx.io.stdout, RUNS_HELP);
     return 0;
@@ -3941,6 +7006,14 @@ async function runRuns(ctx, argv) {
       return runRunsAnnotate(ctx, args);
     case "debug-bundle":
       return runRunsDebugBundle(ctx, args);
+    case "fork":
+      return runRunsFork(ctx, args);
+    case "diff":
+      return runRunsDiff(ctx, args);
+    case "delete":
+      return runRunsDelete(ctx, args);
+    case "bulk-cancel":
+      return runRunsBulkCancel(ctx, args);
     default:
       throw new CliError(`Unknown runs command: ${sub}`);
   }
@@ -4033,6 +7106,57 @@ async function runRunsCancel(ctx, argv) {
   else writeLine(ctx.io.stdout, `Cancelled ${positionals[0]}`);
   return 0;
 }
+async function runRunsFork(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--mode", "--from-sequence"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop runs fork <runId> [--mode replay|branch] [--from-sequence n] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = {};
+  if (options.mode) body.mode = String(options.mode);
+  if (options.fromSequence !== void 0) body.fromSeq = Number(options.fromSequence);
+  const res = await requestJson(ctx, `/v1/runs/${encodeURIComponent(positionals[0])}:fork`, { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Forked ${positionals[0]} \u2192 ${res.body?.runId ?? "(see --json)"}`);
+  return 0;
+}
+async function runRunsDiff(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--against"] });
+  if (options.help || positionals.length !== 1 || !options.against) {
+    write(ctx.io.stdout, "Usage: openwop runs diff <runId> --against <otherRunId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(
+    ctx,
+    `/v1/runs/${encodeURIComponent(positionals[0])}:diff?against=${encodeURIComponent(String(options.against))}`
+  );
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function runRunsDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop runs delete <runId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) throw new CliError(`Refusing to delete run ${positionals[0]} without --yes (this removes the run and its event log).`, 2);
+  await requestJson(ctx, `/v1/runs/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted ${positionals[0]}`);
+  return 0;
+}
+async function runRunsBulkCancel(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--reason"] });
+  if (options.help || positionals.length === 0) {
+    write(ctx.io.stdout, "Usage: openwop runs bulk-cancel <runId...> [--reason text] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = { runIds: positionals };
+  if (options.reason) body.reason = options.reason;
+  const res = await requestJson(ctx, "/v1/runs:bulk-cancel", { method: "POST", body });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Requested cancel of ${positionals.length} run(s)`);
+  return 0;
+}
 async function runRunsEvents(ctx, argv) {
   const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--since", "--limit"] });
   if (options.help || positionals.length !== 1) {
@@ -5951,10 +9075,10 @@ async function runPacksPublish(ctx, argv) {
   const sha = createHash("sha256").update(tgz).digest("hex");
   const outDir = options.out ? resolvePath4(ctx.cwd, options.out) : join6(ctx.cwd, "dist", "packs");
   mkdirSync5(outDir, { recursive: true });
-  const base = `${name}-${version}`;
-  const tgzPath = join6(outDir, `${base}.tgz`);
-  const sigPath = join6(outDir, `${base}.sig`);
-  const manifestOut = join6(outDir, `${base}.manifest.json`);
+  const base8 = `${name}-${version}`;
+  const tgzPath = join6(outDir, `${base8}.tgz`);
+  const sigPath = join6(outDir, `${base8}.sig`);
+  const manifestOut = join6(outDir, `${base8}.manifest.json`);
   writeFileSync7(tgzPath, tgz);
   writeFileSync7(sigPath, sig);
   writeFileSync7(manifestOut, JSON.stringify(signedManifest, null, 2) + "\n", "utf8");
@@ -6039,8 +9163,8 @@ function canonicalJsonStringify(value) {
   return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalJsonStringify(value[k])).join(",") + "}";
 }
 function configHomeDir(env = process.env) {
-  const base = env.OPENWOP_CONFIG_HOME ? env.OPENWOP_CONFIG_HOME : homedir3();
-  return join6(base, ".openwop");
+  const base8 = env.OPENWOP_CONFIG_HOME ? env.OPENWOP_CONFIG_HOME : homedir3();
+  return join6(base8, ".openwop");
 }
 function extractPackJsonBytes(tarballBytes) {
   const decompressed = gunzipSync(tarballBytes);
@@ -6221,6 +9345,8 @@ var GOVERNANCE_HELP = `Usage:
   openwop governance policy [get] [--json]
   openwop governance policy set [--provider-allowlist <a,b,...>] [--action <kind=policy>]... [--retention-graph-days <n>] [--retention-source-days <n>] [--json]
   openwop governance audit [--prefix <p>] [--limit <n>] [--since <iso>] [--json]
+  openwop governance media-budget [get] [--json]
+  openwop governance media-budget set [--tts-chars <n>] [--stt-bytes <n>] [--json]
 
 Tenant governance administration (ADR 0028, host extension \u2014 superadmin-gated).
 Endpoints under ${GOV_BASE}:
@@ -6279,6 +9405,8 @@ async function runGovernance(ctx, argv) {
       return await runGovernancePolicy(ctx, argv.slice(1));
     case "audit":
       return await runGovernanceAudit(ctx, argv.slice(1));
+    case "media-budget":
+      return await runGovernanceMediaBudget(ctx, argv.slice(1));
     // `get`/`set` at the top level are policy ops — lets the `policy` group alias
     // read naturally (`openwop policy set ...`) without a redundant `policy policy`.
     case "get":
@@ -6428,6 +9556,30 @@ async function runGovernanceAudit(ctx, argv) {
   writeLine(ctx.io.stdout, formatTable(rows, ["timestamp", "principal", "action", "resource", "outcome"]));
   return 0;
 }
+async function runGovernanceMediaBudget(ctx, argv) {
+  const action = argv[0] === "set" ? "set" : "get";
+  const rest = argv[0] === "get" || argv[0] === "set" ? argv.slice(1) : argv;
+  const path = `${GOV_BASE}/media-budget`;
+  if (action === "set") {
+    const { options } = parseOptions(rest, { value: ["--tts-chars", "--stt-bytes"] });
+    const body = {};
+    if (options.ttsChars !== void 0) body.ttsChars = Number(options.ttsChars);
+    if (options.sttBytes !== void 0) body.sttBytes = Number(options.sttBytes);
+    const res2 = await requestJson(ctx, path, { method: "PUT", body });
+    if (ctx.json) writeJson(ctx.io.stdout, res2.body);
+    else writeLine(ctx.io.stdout, "Media budget updated.");
+    return 0;
+  }
+  const res = await requestJson(ctx, path);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const b = res.body ?? {};
+  writeLine(ctx.io.stdout, `override:  ${b.override ? JSON.stringify(b.override) : "(none \u2014 using host defaults)"}`);
+  writeLine(ctx.io.stdout, `effective: tts ${b.budgets?.ttsChars ?? "?"} chars/day, stt ${b.budgets?.sttBytes ?? "?"} bytes/day`);
+  return 0;
+}
 
 // src/cli/demo.ts
 import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
@@ -8001,7 +11153,7 @@ Examples:
   openwop profiles pin r_123
   openwop profiles activity --limit 10 --status failed
 `;
-var BASE = "/v1/host/sample/profiles";
+var BASE10 = "/v1/host/sample/profiles";
 async function profilesRequest(ctx, path, options, notFoundMsg) {
   try {
     return await requestJson(ctx, path, options);
@@ -8096,7 +11248,7 @@ async function runList2(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles list [--json]\n");
     return 0;
   }
-  const res = await profilesRequest(ctx, BASE);
+  const res = await profilesRequest(ctx, BASE10);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -8122,7 +11274,7 @@ async function runGet3(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles get [<userId>] [--json]\n");
     return options.help ? 0 : 2;
   }
-  const path = positionals.length === 1 ? `${BASE}/${encodeURIComponent(positionals[0])}` : `${BASE}/me`;
+  const path = positionals.length === 1 ? `${BASE10}/${encodeURIComponent(positionals[0])}` : `${BASE10}/me`;
   const res = await profilesRequest(ctx, path, void 0, `Profile not found: ${positionals[0] ?? "me"}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -8141,7 +11293,7 @@ async function runActivity(ctx, argv) {
   if (options.limit !== void 0) qs.set("limit", String(options.limit));
   if (options.status !== void 0) qs.set("status", String(options.status));
   const q = qs.toString();
-  const res = await profilesRequest(ctx, `${BASE}/me/activity${q ? `?${q}` : ""}`);
+  const res = await profilesRequest(ctx, `${BASE10}/me/activity${q ? `?${q}` : ""}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -8193,7 +11345,7 @@ async function runEdit(ctx, argv) {
   }
   if (Object.keys(avail).length) body.availability = avail;
   if (Object.keys(body).length === 0) throw new CliError("Nothing to edit \u2014 pass at least one field.", 2);
-  const res = await profilesRequest(ctx, `${BASE}/me`, { method: "PATCH", body });
+  const res = await profilesRequest(ctx, `${BASE10}/me`, { method: "PATCH", body });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -8214,12 +11366,12 @@ async function runSkillsSet(ctx, argv) {
     const eq = e.lastIndexOf("=");
     if (eq < 0) throw new CliError(`--skill must be name=proficiency (got '${e}')`, 2);
     const name = e.slice(0, eq).trim();
-    const prof = Number(e.slice(eq + 1));
+    const prof2 = Number(e.slice(eq + 1));
     if (!name) throw new CliError(`--skill name is required (got '${e}')`, 2);
-    if (!Number.isFinite(prof) || prof < 1 || prof > 5) throw new CliError(`--skill proficiency must be 1..5 (got '${e}')`, 2);
-    return { name, proficiency: prof };
+    if (!Number.isFinite(prof2) || prof2 < 1 || prof2 > 5) throw new CliError(`--skill proficiency must be 1..5 (got '${e}')`, 2);
+    return { name, proficiency: prof2 };
   });
-  const res = await profilesRequest(ctx, `${BASE}/me/skills`, { method: "PUT", body: { skills } });
+  const res = await profilesRequest(ctx, `${BASE10}/me/skills`, { method: "PUT", body: { skills } });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -8234,7 +11386,7 @@ async function runPortfolioAdd(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles portfolio add --token <mediaToken> [--json]\n");
     return options.help ? 0 : 2;
   }
-  const res = await profilesRequest(ctx, `${BASE}/me/portfolio`, { method: "POST", body: { token: options.token } });
+  const res = await profilesRequest(ctx, `${BASE10}/me/portfolio`, { method: "POST", body: { token: options.token } });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -8248,7 +11400,7 @@ async function runPortfolioRemove(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles portfolio remove <mediaToken> [--json]\n");
     return options.help ? 0 : 2;
   }
-  const res = await profilesRequest(ctx, `${BASE}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
+  const res = await profilesRequest(ctx, `${BASE10}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -8263,7 +11415,7 @@ async function runPin(ctx, argv, pinned) {
 `);
     return options.help ? 0 : 2;
   }
-  const path = `${BASE}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
+  const path = `${BASE10}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
   const res = await profilesRequest(ctx, path, { method: pinned ? "PUT" : "DELETE" }, `Agent not found: ${positionals[0]}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -8280,7 +11432,7 @@ async function runEndorse(ctx, argv, add) {
     return options.help ? 0 : 2;
   }
   const [userId, skill] = positionals;
-  const path = `${BASE}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
+  const path = `${BASE10}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
   const res = await profilesRequest(ctx, path, { method: add ? "POST" : "DELETE" }, `Profile or skill not found: ${userId} / ${skill}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -8290,6 +11442,115 @@ async function runEndorse(ctx, argv, add) {
   return 0;
 }
 
+// src/cli/completion.ts
+var COMPLETION_HELP = `Usage:
+  openwop completion <bash|zsh|fish>
+
+Emit a shell-completion script for openwop's top-level commands. Install it:
+  bash:  openwop completion bash > \${BASH_COMPLETION_USER_DIR:-~/.local/share/bash-completion}/completions/openwop
+  zsh:   openwop completion zsh  > "\${fpath[1]}/_openwop"   # then: autoload -U compinit && compinit
+  fish:  openwop completion fish > ~/.config/fish/completions/openwop.fish
+`;
+function bashScript(cmds) {
+  return `# openwop bash completion \u2014 source this or drop it in your bash-completion dir.
+_openwop() {
+  local cur="\${COMP_WORDS[COMP_CWORD]}"
+  if [ "\${COMP_CWORD}" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${cmds}" -- "\${cur}") )
+    return 0
+  fi
+}
+complete -F _openwop openwop
+`;
+}
+function zshScript(cmds) {
+  return `#compdef openwop
+# openwop zsh completion \u2014 install as _openwop on your fpath.
+_openwop() {
+  local -a _cmds
+  _cmds=(${cmds})
+  _arguments '1: :(\${_cmds})' '*::arg:->args'
+}
+_openwop "$@"
+`;
+}
+function fishScript(commands) {
+  const lines = commands.map((c) => `complete -c openwop -n __fish_use_subcommand -a ${c}`);
+  return `# openwop fish completion \u2014 install as ~/.config/fish/completions/openwop.fish
+${lines.join("\n")}
+`;
+}
+function runCompletion(ctx, argv, commands) {
+  const shell = argv[0];
+  if (shell === "--help" || shell === "-h") {
+    write(ctx.io.stdout, COMPLETION_HELP);
+    return 0;
+  }
+  if (!shell) {
+    write(ctx.io.stderr, COMPLETION_HELP);
+    return 2;
+  }
+  const cmds = commands.join(" ");
+  switch (shell) {
+    case "bash":
+      write(ctx.io.stdout, bashScript(cmds));
+      return 0;
+    case "zsh":
+      write(ctx.io.stdout, zshScript(cmds));
+      return 0;
+    case "fish":
+      write(ctx.io.stdout, fishScript(commands));
+      return 0;
+    default:
+      throw new CliError(`Unsupported shell: ${shell}. Use one of: bash | zsh | fish.`, 2);
+  }
+}
+
+// src/cli/upgrade.ts
+var REGISTRY = "https://registry.npmjs.org/@openwop/cli/latest";
+var UPGRADE_HELP = `Usage:
+  openwop upgrade [--json]
+
+Check npm for a newer @openwop/cli and print how to update. Report-only \u2014 it never
+installs. Update the global CLI yourself with:
+  npm install -g @openwop/cli@latest
+`;
+function semverGt(a, b) {
+  const pa = a.split(".").map((n) => Number(n) || 0);
+  const pb = b.split(".").map((n) => Number(n) || 0);
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return false;
+}
+async function runUpgrade(ctx, argv) {
+  if (argv[0] === "--help" || argv[0] === "-h") {
+    write(ctx.io.stdout, UPGRADE_HELP);
+    return 0;
+  }
+  let latest = "";
+  try {
+    const res = await ctx.fetchImpl(REGISTRY, { headers: { accept: "application/json" } });
+    if (!res.ok) throw new Error(`registry HTTP ${res.status}`);
+    latest = (await res.json()).version ?? "";
+  } catch (err) {
+    throw new CliError(`Could not reach the npm registry to check for updates: ${err.message}`, 1);
+  }
+  const behind = latest !== "" && semverGt(latest, VERSION);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { current: VERSION, latest, upToDate: !behind });
+    return 0;
+  }
+  if (!behind) {
+    writeLine(ctx.io.stdout, `@openwop/cli is up to date (${VERSION}).`);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `A newer @openwop/cli is available: ${VERSION} \u2192 ${latest}`);
+  writeLine(ctx.io.stdout, "Update with:  npm install -g @openwop/cli@latest");
+  return 0;
+}
+
 // src/cli/toggles.ts
 var TOGGLES_BASE = "/v1/host/sample/feature-toggles";
 var TOGGLES_HELP = `Usage:
@@ -8997,7 +12258,7 @@ Examples:
   openwop auth saml validate --idp-url http://localhost:9100/idp --variant valid
   openwop auth scim provision --op create-user --user-name jo@acme.com --email jo@acme.com
 `;
-var BASE2 = "/v1/host/sample/auth";
+var BASE11 = "/v1/host/sample/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
   if (Array.isArray(value)) return value.map(redact2);
@@ -9055,7 +12316,7 @@ async function runStatus(ctx, argv) {
   const profiles = disc.ok && Array.isArray(disc.body?.capabilities?.auth?.profiles) ? disc.body.capabilities.auth.profiles : [];
   const samlAdvertised = profiles.includes("openwop-auth-saml");
   const scimAdvertised = profiles.includes("openwop-auth-scim");
-  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE2}/saml/sso/metadata`)).ok : false;
+  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE11}/saml/sso/metadata`)).ok : false;
   if (ctx.json) {
     writeJson(ctx.io.stdout, {
       authProfilesAdvertised: profiles,
@@ -9080,7 +12341,7 @@ async function runSamlMetadata(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop auth saml metadata [--json]\n");
     return 0;
   }
-  const res = await authRequest(ctx, `${BASE2}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
+  const res = await authRequest(ctx, `${BASE11}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
   const xml = typeof res.body?.raw === "string" ? res.body.raw : typeof res.body === "string" ? res.body : JSON.stringify(res.body);
   if (ctx.json) {
     writeJson(ctx.io.stdout, { metadata: xml });
@@ -9097,8 +12358,8 @@ async function runSamlLoginUrl(ctx, argv) {
     return 0;
   }
   const returnTo = options.returnTo ?? "/";
-  const base = ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`;
-  const url = new URL(`${BASE2}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base);
+  const base8 = ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`;
+  const url = new URL(`${BASE11}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base8);
   const res = await ctx.fetchImpl(url, { method: "GET", redirect: "manual" });
   if (res.status === 404) {
     throw new CliError("SAML SSO is not configured on this host (set OPENWOP_SAML_*).", 1);
@@ -9123,7 +12384,7 @@ async function runSamlValidate(ctx, argv) {
   const body = { idpUrl: options.idpUrl, variant: options.variant };
   let res;
   try {
-    res = await requestJson(ctx, `${BASE2}/saml/validate`, { method: "POST", body });
+    res = await requestJson(ctx, `${BASE11}/saml/validate`, { method: "POST", body });
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
       throw new CliError("SAML validation seam not configured on this host (set OPENWOP_TEST_SAML_IDP_URL).", 1);
@@ -9166,7 +12427,7 @@ async function runScimProvision(ctx, argv) {
   if (options.displayName !== void 0) user.displayName = options.displayName;
   const body = { op: options.op, user };
   if (options.group !== void 0) body.group = options.group;
-  const res = await authRequest(ctx, `${BASE2}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
+  const res = await authRequest(ctx, `${BASE11}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
   const safe = redact2(res.body ?? {});
   if (ctx.json) {
     writeJson(ctx.io.stdout, safe);
@@ -10171,6 +13432,8 @@ var TRIGGERS_HELP = `Usage:
   openwop triggers register --source <webhook|email|form> --workflow <id> [--dedup] [--verification <mode>] [--json]
   openwop triggers list [--state <s>] [--source <s>] [--json]
   openwop triggers get <subscriptionId> [--json]
+  openwop triggers update <subscriptionId> --state <active|paused> [--json]
+  openwop triggers ingest <subscriptionId> [--event-json '{...}'] [--json]
 
 External-event trigger subscriptions (RFC 0099). A subscription binds an external
 SOURCE (webhook / email / form) to a WORKFLOW the caller can start; a verified
@@ -10209,7 +13472,7 @@ Examples:
   openwop triggers list --state active
   openwop triggers get sub_123 --json
 `;
-var SUBCOMMANDS5 = ["register", "list", "get"];
+var SUBCOMMANDS5 = ["register", "list", "get", "update", "ingest"];
 async function runTriggers(ctx, argv) {
   const sub = argv[0] ?? "list";
   if (sub === "--help" || sub === "-h") {
@@ -10224,11 +13487,45 @@ async function runTriggers(ctx, argv) {
       return await runList3(ctx, args);
     case "get":
       return await runGet4(ctx, args);
+    case "update":
+      return await runTriggersUpdate(ctx, args);
+    case "ingest":
+      return await runTriggersIngest(ctx, args);
     default:
       throw new CliError(`Unknown triggers command: ${sub}
 Run \`openwop triggers --help\` for usage.`);
   }
 }
+async function runTriggersUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--state"] });
+  if (positionals.length !== 1 || !options.state) {
+    write(ctx.io.stderr, "Usage: openwop triggers update <subscriptionId> --state <active|paused> [--json]\n");
+    return 2;
+  }
+  const res = await requestJson(ctx, `/v1/trigger-subscriptions/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: { state: options.state } });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Updated ${positionals[0]} \u2192 state ${options.state}.`);
+  return 0;
+}
+async function runTriggersIngest(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { value: ["--event-json"] });
+  if (positionals.length !== 1) {
+    write(ctx.io.stderr, "Usage: openwop triggers ingest <subscriptionId> [--event-json '{...}'] [--json]\n");
+    return 2;
+  }
+  let event = {};
+  if (options.eventJson) {
+    try {
+      event = JSON.parse(String(options.eventJson));
+    } catch {
+      throw new CliError("--event-json must be valid JSON.", 2);
+    }
+  }
+  const res = await requestJson(ctx, `/v1/trigger-subscriptions/${encodeURIComponent(positionals[0])}/ingest`, { method: "POST", body: event });
+  if (ctx.json) writeJson(ctx.io.stdout, res.body);
+  else writeLine(ctx.io.stdout, `Ingested event for ${positionals[0]}.`);
+  return 0;
+}
 function exitForState3(state) {
   if (state === "active") return 0;
   if (state === "paused") return 3;
@@ -10549,13 +13846,18 @@ async function runCli(argv, options = {}) {
       throw new CliError("This CLI requires a Node runtime with global fetch (Node 20+).");
     }
     const parsed = extractGlobalOptions(argv, env);
+    const profile = parsed.globals.profile ?? env.OPENWOP_PROFILE;
+    const savedConfig = readConfigSafe(configPathFor(profile, env)) ?? {};
     const ctx = {
       cwd,
       env,
       io,
       fetchImpl,
-      baseUrl: normalizeBaseUrl(parsed.globals.baseUrl ?? env.OPENWOP_BASE_URL ?? DEFAULT_BASE_URL),
-      apiKey: parsed.globals.apiKey ?? env.OPENWOP_API_KEY,
+      profile,
+      baseUrl: normalizeBaseUrl(
+        parsed.globals.baseUrl ?? env.OPENWOP_BASE_URL ?? savedConfig?.host?.baseUrl ?? DEFAULT_BASE_URL
+      ),
+      apiKey: parsed.globals.apiKey ?? env.OPENWOP_API_KEY ?? savedConfig?.host?.apiKey,
       json: parsed.globals.json,
       quiet: parsed.globals.quiet,
       verbose: parsed.globals.verbose,
@@ -10631,6 +13933,60 @@ async function runCli(argv, options = {}) {
         return await runOrgs(ctx, commandArgs);
       case "workspace":
         return await runWorkspace(ctx, commandArgs);
+      case "brand":
+        return await runBrand(ctx, commandArgs);
+      case "crm":
+        return await runCrm(ctx, commandArgs);
+      case "csm":
+        return await runCsm(ctx, commandArgs);
+      case "comments":
+        return await runComments(ctx, commandArgs);
+      case "sharing":
+        return await runSharing(ctx, commandArgs);
+      case "forms":
+        return await runForms(ctx, commandArgs);
+      case "email":
+        return await runEmail(ctx, commandArgs);
+      case "chat-widget":
+        return await runChatWidget(ctx, commandArgs);
+      case "marketplace":
+        return await runMarketplace(ctx, commandArgs);
+      case "kb":
+        return await runKb(ctx, commandArgs);
+      case "cms":
+        return await runCms(ctx, commandArgs);
+      case "documents":
+        return await runDocuments(ctx, commandArgs);
+      case "projects":
+        return await runProjects(ctx, commandArgs);
+      case "reviews":
+        return await runReviews(ctx, commandArgs);
+      case "workspaces":
+        return await runWorkspaces(ctx, commandArgs);
+      case "agent-profile":
+        return await runAgentProfile(ctx, commandArgs);
+      case "agent-allowlists":
+        return await runAgentAllowlists(ctx, commandArgs);
+      case "agent-packs":
+        return await runAgentPacks(ctx, commandArgs);
+      case "agent-ops":
+        return await runAgentOps(ctx, commandArgs);
+      case "evals":
+        return await runEvals(ctx, commandArgs);
+      case "twin":
+        return await runTwin(ctx, commandArgs);
+      case "strategy":
+        return await runStrategy(ctx, commandArgs);
+      case "advisors":
+        return await runAdvisors(ctx, commandArgs);
+      case "campaigns-orchestration":
+        return await runCampaignsOrch(ctx, commandArgs);
+      case "notebooks":
+        return await runNotebooks(ctx, commandArgs);
+      case "podcasts":
+        return await runPodcasts(ctx, commandArgs);
+      case "priority-matrix":
+        return await runPriorityMatrix(ctx, commandArgs);
       case "byok":
         return await runByok(ctx, commandArgs);
       case "config":
@@ -10699,6 +14055,10 @@ async function runCli(argv, options = {}) {
         return await runTriggers(ctx, commandArgs);
       case "a2a":
         return await runA2a(ctx, commandArgs);
+      case "completion":
+        return runCompletion(ctx, commandArgs, COMMAND_NAMES);
+      case "upgrade":
+        return await runUpgrade(ctx, commandArgs);
       default:
         throw new CliError(`Unknown command: ${command}
 Run \`openwop --help\` for usage.`);
@@ -10712,6 +14072,7 @@ Run \`openwop --help\` for usage.`);
       const bodyMessage = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? `: ${err.body.message}` : "";
       writeLine(io.stderr, `openwop: HTTP ${err.status}${bodyMessage}`);
       if (options.debugErrors) writeLine(io.stderr, String(err.stack ?? err));
+      if (err.status === 401 || err.status === 403) return 4;
       return err.status >= 500 ? 1 : 2;
     }
     writeLine(io.stderr, `openwop: ${err instanceof Error ? err.message : String(err)}`);
@@ -10719,78 +14080,108 @@ Run \`openwop --help\` for usage.`);
     return 1;
   }
 }
+var HELP_MAP = {
+  demo: DEMO_HELP,
+  runs: RUNS_HELP,
+  run: RUNS_HELP,
+  chat: CHAT_HELP,
+  workflows: WORKFLOWS_HELP,
+  workflow: WORKFLOWS_HELP,
+  catalog: CATALOG_HELP,
+  packs: PACKS_HELP,
+  pack: PACKS_HELP,
+  onboard: ONBOARD_HELP,
+  providers: PROVIDERS_HELP,
+  provider: PROVIDERS_HELP,
+  agents: AGENTS_HELP,
+  agent: AGENTS_HELP,
+  roster: ROSTER_HELP,
+  "org-chart": ORG_CHART_HELP,
+  orgchart: ORG_CHART_HELP,
+  kanban: KANBAN_HELP,
+  boards: KANBAN_HELP,
+  orgs: ORGS_HELP,
+  org: ORGS_HELP,
+  workspace: WORKSPACE_HELP,
+  byok: BYOK_HELP,
+  brand: BRAND_HELP,
+  crm: CRM_HELP,
+  csm: CSM_HELP,
+  comments: COMMENTS_HELP,
+  sharing: SHARING_HELP,
+  forms: FORMS_HELP,
+  email: EMAIL_HELP,
+  "chat-widget": CHAT_WIDGET_HELP,
+  marketplace: MARKETPLACE_HELP,
+  kb: KB_HELP,
+  cms: CMS_HELP,
+  documents: DOCUMENTS_HELP,
+  projects: PROJECTS_HELP,
+  reviews: REVIEWS_HELP,
+  workspaces: WORKSPACES_HELP,
+  "agent-profile": AGENT_PROFILE_HELP,
+  "agent-allowlists": AGENT_ALLOWLISTS_HELP,
+  "agent-packs": AGENT_PACKS_HELP,
+  "agent-ops": AGENT_OPS_HELP,
+  evals: EVALS_HELP,
+  twin: TWIN_HELP,
+  strategy: STRATEGY_HELP,
+  advisors: ADVISORS_HELP,
+  "campaigns-orchestration": CAMPAIGNS_ORCH_HELP,
+  notebooks: NOTEBOOKS_HELP,
+  podcasts: PODCASTS_HELP,
+  "priority-matrix": PRIORITY_MATRIX_HELP,
+  config: CONFIG_HELP,
+  doctor: DOCTOR_HELP,
+  health: HEALTH_HELP,
+  capabilities: CAPABILITIES_HELP,
+  caps: CAPABILITIES_HELP,
+  media: MEDIA_HELP,
+  conformance: CONFORMANCE_HELP,
+  memory: MEMORY_HELP,
+  webhooks: WEBHOOKS_HELP,
+  webhook: WEBHOOKS_HELP,
+  cron: CRON_HELP,
+  messaging: MESSAGING_HELP,
+  relay: RELAY_HELP,
+  notifications: NOTIFICATIONS_HELP,
+  notification: NOTIFICATIONS_HELP,
+  interrupts: INTERRUPTS_HELP,
+  interrupt: INTERRUPTS_HELP,
+  prompts: PROMPTS_HELP,
+  prompt: PROMPTS_HELP,
+  notify: NOTIFY_HELP,
+  account: ACCOUNT_HELP,
+  admin: ADMIN_HELP,
+  governance: GOVERNANCE_HELP,
+  policy: GOVERNANCE_HELP,
+  approvals: APPROVALS_HELP,
+  approval: APPROVALS_HELP,
+  consent: CONSENT_HELP,
+  mcp: MCP_HELP,
+  connections: CONNECTIONS_HELP,
+  conn: CONNECTIONS_HELP,
+  profiles: PROFILES_HELP,
+  completion: COMPLETION_HELP,
+  upgrade: UPGRADE_HELP,
+  toggles: TOGGLES_HELP,
+  users: USERS_HELP,
+  workforces: WORKFORCES_HELP,
+  fleet: WORKFORCES_HELP,
+  auth: AUTH_HELP,
+  sso: AUTH_HELP,
+  analytics: ANALYTICS_HELP,
+  usage: ANALYTICS_HELP,
+  proposals: PROPOSALS_HELP,
+  goals: GOALS_HELP,
+  export: EXPORT_HELP,
+  import: IMPORT_HELP,
+  triggers: TRIGGERS_HELP,
+  a2a: A2A_HELP
+};
+var COMMAND_NAMES = Object.keys(HELP_MAP);
 function showHelp(io, command) {
-  const map = {
-    demo: DEMO_HELP,
-    runs: RUNS_HELP,
-    run: RUNS_HELP,
-    chat: CHAT_HELP,
-    workflows: WORKFLOWS_HELP,
-    workflow: WORKFLOWS_HELP,
-    catalog: CATALOG_HELP,
-    packs: PACKS_HELP,
-    pack: PACKS_HELP,
-    onboard: ONBOARD_HELP,
-    providers: PROVIDERS_HELP,
-    provider: PROVIDERS_HELP,
-    agents: AGENTS_HELP,
-    agent: AGENTS_HELP,
-    roster: ROSTER_HELP,
-    "org-chart": ORG_CHART_HELP,
-    orgchart: ORG_CHART_HELP,
-    kanban: KANBAN_HELP,
-    boards: KANBAN_HELP,
-    orgs: ORGS_HELP,
-    org: ORGS_HELP,
-    workspace: WORKSPACE_HELP,
-    byok: BYOK_HELP,
-    config: CONFIG_HELP,
-    doctor: DOCTOR_HELP,
-    health: HEALTH_HELP,
-    capabilities: CAPABILITIES_HELP,
-    caps: CAPABILITIES_HELP,
-    media: MEDIA_HELP,
-    conformance: CONFORMANCE_HELP,
-    memory: MEMORY_HELP,
-    webhooks: WEBHOOKS_HELP,
-    webhook: WEBHOOKS_HELP,
-    cron: CRON_HELP,
-    messaging: MESSAGING_HELP,
-    relay: RELAY_HELP,
-    notifications: NOTIFICATIONS_HELP,
-    notification: NOTIFICATIONS_HELP,
-    interrupts: INTERRUPTS_HELP,
-    interrupt: INTERRUPTS_HELP,
-    prompts: PROMPTS_HELP,
-    prompt: PROMPTS_HELP,
-    notify: NOTIFY_HELP,
-    account: ACCOUNT_HELP,
-    admin: ADMIN_HELP,
-    governance: GOVERNANCE_HELP,
-    policy: GOVERNANCE_HELP,
-    approvals: APPROVALS_HELP,
-    approval: APPROVALS_HELP,
-    consent: CONSENT_HELP,
-    mcp: MCP_HELP,
-    connections: CONNECTIONS_HELP,
-    conn: CONNECTIONS_HELP,
-    profiles: PROFILES_HELP,
-    toggles: TOGGLES_HELP,
-    users: USERS_HELP,
-    workforces: WORKFORCES_HELP,
-    fleet: WORKFORCES_HELP,
-    auth: AUTH_HELP,
-    sso: AUTH_HELP,
-    analytics: ANALYTICS_HELP,
-    usage: ANALYTICS_HELP,
-    proposals: PROPOSALS_HELP,
-    goals: GOALS_HELP,
-    export: EXPORT_HELP,
-    import: IMPORT_HELP,
-    triggers: TRIGGERS_HELP,
-    a2a: A2A_HELP
-  };
-  write(io.stdout, map[command] ?? ROOT_HELP);
+  write(io.stdout, HELP_MAP[command] ?? ROOT_HELP);
   return 0;
 }
 var ROOT_HELP = `openwop - operate OpenWOP hosts and the workflow-engine demo app
@@ -10799,14 +14190,24 @@ Usage:
   openwop [global options] <command> [options]
 
 Global options:
-  --base-url <url>    Host base URL (default: OPENWOP_BASE_URL or http://localhost:8080)
-  --api-key <key>     Bearer API key (default: OPENWOP_API_KEY, or sample-token for localhost)
+  --base-url <url>    Host base URL (default: --base-url > OPENWOP_BASE_URL > saved config > http://localhost:8080)
+  --api-key <key>     Bearer API key (default: OPENWOP_API_KEY > saved config > sample-token for localhost)
+  --profile <name>    Use a named config profile (~/.openwop-<name>); also OPENWOP_PROFILE
   --json              Print machine-readable JSON where supported
   --quiet             Suppress non-essential output
   --verbose           Print extra diagnostics
   --version           Print CLI version
   --help, -h          Show help
 
+Exit codes:
+  0  success (a read succeeded; a run/goal completed; a check passed)
+  1  runtime/host error (HTTP >=500, unreachable host, an operation failed)
+  2  usage error (bad flags/args) or a client/host 4xx (e.g. not found, validation)
+  3  attention needed \u2014 a non-failure "open" state: a run escalated/paused, a
+     proposal is pending, a goal is still open (set by run/goal/proposal/approval-style
+     commands so scripts can branch on 0 vs 3 vs 1)
+  4  auth/permission denied (e.g. a super-admin surface without a super-admin principal)
+
 Commands:
   onboard             Guided first-run setup (host + provider + model + BYOK key)
   providers list      List stored BYOK credential refs (never values)
@@ -10815,6 +14216,8 @@ Commands:
   providers test      Verify the credential ref is reachable
   config file         Print the local config file path
   config get|set|unset  Read or modify ~/.openwop/config.json
+  completion <shell>  Emit a bash/zsh/fish completion script
+  upgrade             Check npm for a newer @openwop/cli
   doctor              Check local prerequisites and demo reachability
   demo status         Inspect the workflow-engine demo app
   demo start          Start the demo backend and frontend (--detach to background)
@@ -10871,6 +14274,34 @@ Commands:
   byok list           List BYOK credential refs (never values)
   byok set            Store a BYOK secret (prompts if --value omitted)
   byok delete         Remove a BYOK secret ref
+  brand public        Show the applied white-label app identity (ADR 0170/0171)
+  brand get|set       Read / edit the app brand + generative theme (super-admin)
+  crm list|create     Manage CRM contacts (+ get/update/delete/triage)
+  csm list|create     Manage Customer-Success accounts (+ get/update/delete)
+  comments list       Threaded comments on a resource (--org; +create/update/delete)
+  sharing list        Shareable resource links (--org; +create/revoke/resolve)
+  forms list          Form builder + intake (--org; +create/update/status/submissions)
+  email templates     Email templates + campaigns (--org; create/send/sends)
+  chat-widget list    Embeddable chat widgets (--org; +create/rotate-token)
+  marketplace listings  Browse/install packs + reviews (install; review --org)
+  kb collections      Knowledge base (--org; collections/docs/search/rag)
+  cms pages           CMS pages + authoring lifecycle (--org; submit/approve/publish)
+  documents list      Document generation + templates (--org; versions/render)
+  projects list       Project workspaces (create --org; +members)
+  reviews list        The unified review inbox (get; action <id> <action>)
+  workspaces list     Your B2B workspaces / tenants (create/switch; vs the file 'workspace')
+  agent-profile get   Rich agent profile + connector readiness (set/readiness)
+  agent-allowlists    Super-admin per-agent tool allowlists (list/get/set/clear)
+  agent-packs list    Agent (persona) pack registry (install)
+  agent-ops status    Demo example-data + roster/fleet activity (seed/run/clear)
+  evals leaderboard   Model eval leaderboard + arena (--org; match)
+  twin get            Agent digital-twin config + grants (set/grant/revoke)
+  strategy list       Strategy documents (create --org; context/health)
+  advisors list       Advisory boards (create --org; by-handle)
+  campaigns-orchestration  Orchestrated campaigns (create/finalize)
+  notebooks list      NotebookLM-style notebooks (create --org; notes)
+  podcasts list       Podcast episodes (create/retry)
+  priority-matrix lists  Prioritization boards (create --org; ideas)
   webhooks list       List webhook subscriptions
   webhooks add        Register a webhook subscription
   webhooks remove     Delete a webhook subscription