@openwop/cli 1.2.3 → 1.4.0

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.2.3",
+  version: "1.4.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1078,7 +1078,7 @@ import { createInterface as createInterface2 } from "node:readline";
 
 // src/ids.ts
 function projectTenantBoundId(id) {
-  if (id.includes("~")) return id;
+  if (id.includes("~") && !id.includes("/")) return id;
   let out = "";
   for (const byte of new TextEncoder().encode(id)) {
     const ch = String.fromCharCode(byte);
@@ -1153,6 +1153,17 @@ var V2_PATH_TEMPLATES = [
   "/workflows/{workflowId}"
 ];
 var V2_MANIFEST_OMITTED = ["/.well-known/openwop", "/openapi.json"];
+var V2_RENAMED = { "/v1/openapi.json": "/openapi.json" };
+var V2_SEAMS_PROFILE = "openwop-conformance-seams-v2";
+var V2_SEAM_PREFIXES = {
+  "/v1/host/workspace/files": "/conformance/seams/workspace/files"
+};
+function v2SeamTwin(path) {
+  for (const [v1, v2] of Object.entries(V2_SEAM_PREFIXES)) {
+    if (path === v1 || path.startsWith(`${v1}/`) || path.startsWith(`${v1}?`)) return `${v2}${path.slice(v1.length)}`;
+  }
+  return null;
+}
 var V2_MATCHERS = V2_PATH_TEMPLATES.map(
   (t) => new RegExp(`^${t.replace(/[.:]/g, "\\$&").replace(/\{[A-Za-z]+\}/g, "[^/]+")}$`)
 );
@@ -1161,6 +1172,7 @@ function v2Twin(path) {
   const bare = q === -1 ? path : path.slice(0, q);
   const query = q === -1 ? "" : path.slice(q);
   if (!bare.startsWith("/v1/")) return null;
+  if (V2_RENAMED[bare] !== void 0) return `${V2_RENAMED[bare]}${query}`;
   const unversioned = bare.slice("/v1".length);
   return V2_MATCHERS.some((m) => m.test(unversioned)) ? `${unversioned}${query}` : null;
 }
@@ -1204,6 +1216,7 @@ async function negotiateMajor(ctx) {
   }
   let major = 1;
   let roots = {};
+  let seams = false;
   try {
     const url = new URL(".well-known/openwop", ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`);
     const res = await ctx.fetchImpl(url, { method: "GET", headers: { accept: "application/json", "openwop-version": "2" } });
@@ -1212,7 +1225,10 @@ async function negotiateMajor(ctx) {
       ctx.discovery = { doc, servedVersion: res.headers?.get?.("openwop-version") ?? void 0 };
       ctx.discoveredStreamBase = streamBaseFrom(doc?.extensions, ctx.baseUrl);
       major = selectMajor(doc?.protocolVersions);
-      if (major === 2) roots = hostRootsFrom(doc?.extensions);
+      if (major === 2) {
+        roots = hostRootsFrom(doc?.extensions);
+        seams = doc?.conformance?.seamsProfile === V2_SEAMS_PROFILE;
+      }
     } else if (res.status === 406) {
       major = selectMajor(doc?.details?.protocolVersions);
     }
@@ -1220,6 +1236,7 @@ async function negotiateMajor(ctx) {
   }
   ctx.protocolMajor = major;
   ctx.hostRoots = roots;
+  ctx.seamsV2 = seams;
   return major;
 }
 async function resolveRequest(ctx, path, headers) {
@@ -1227,6 +1244,8 @@ async function resolveRequest(ctx, path, headers) {
   if (major !== 2) return { path, headers };
   const twin = v2Twin(path);
   if (twin !== null) return { path: projectRunIdsInPath(twin), headers: { ...headers, "openwop-version": "2.0" } };
+  const seam = ctx.seamsV2 ? v2SeamTwin(path) : null;
+  if (seam !== null) return { path: seam, headers: { ...headers, "openwop-version": "2.0" } };
   const rooted = hostRootFor(path, ctx.hostRoots ?? {});
   if (rooted !== null) return { path: rooted, headers };
   return { path, headers };
@@ -2613,7 +2632,19 @@ async function runInterrupts(ctx, argv) {
         write(ctx.io.stdout, "Usage: openwop interrupts list <runId> [--json]\n");
         return 2;
       }
-      const res = await requestJson(ctx, `/v1/host/openwop-app/runs/${encodeURIComponent(rest[0])}/interrupts`);
+      let res;
+      try {
+        res = await requestJson(ctx, `/v1/host/openwop-app/runs/${encodeURIComponent(rest[0])}/interrupts`);
+      } catch (err) {
+        const env = err instanceof HttpError ? errorEnvelope(err.body) : {};
+        if (err instanceof HttpError && err.status === 404 && /^no operation at /i.test(env.message ?? "")) {
+          throw new CliError(
+            "interrupts: `list` reads the openwop-app host extension (GET /v1/host/openwop-app/runs/{runId}/interrupts), which this host does not serve. On any host an open interrupt appears as interrupt.requested in the run's events; answer it with `openwop interrupts respond <runId> <nodeId>`.",
+            1
+          );
+        }
+        throw err;
+      }
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -3580,6 +3611,24 @@ async function readDiscovery(ctx) {
   ctx.discovery = { doc: res.body, servedVersion };
   return { doc: res.body, servedVersion, major };
 }
+async function advertisedRecord(ctx, pick) {
+  const doc = (d) => d && typeof d === "object" ? d : {};
+  let readAny = false;
+  const v1 = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (v1.ok) {
+    readAny = true;
+    const r = pick(doc(v1.body));
+    if (r) return r;
+  }
+  try {
+    const { doc: negotiated } = await readDiscovery(ctx);
+    readAny = true;
+    const r = pick(doc(negotiated));
+    if (r) return r;
+  } catch {
+  }
+  return readAny ? null : void 0;
+}
 function isV2Discovery(caps, servedVersion) {
   if (typeof servedVersion === "string" && servedVersion.startsWith("2.")) return true;
   if (!caps || typeof caps !== "object" || "capabilities" in caps || "supportedTransports" in caps) return false;
@@ -4389,6 +4438,10 @@ registry (\`openwop packs\` operates packs.openwop.dev):
   get     GET /v1/packs/{packName}   \u2014 one pack's node types (reverse-DNS name)
   export  GET /v1/packs/export       \u2014 the installed agent manifests (RFC 0003
           round-trip), re-installable elsewhere; --out writes them to a file.
+These four are v1 operations: protocol v2 names no installed-packs operation
+(spec/v2/path-manifest.json, api/v2/openapi.yaml), so they are sent as the v1
+paths whichever major the host speaks. To read the published catalog, use
+\`openwop packs\`, which resolves the registry's v2 tree.
 
 \`tools\` reads the portable tool catalog (RFC 0078 \xA7B) \u2014 GET /v1/tools, or
 GET /v1/tools/<toolId> for one descriptor. This is the tools an agent/workflow
@@ -11851,8 +11904,12 @@ ${routesHelp("workspace", WORKSPACE_ROUTES)}
 
 Agent workspace (RFC 0059 \xA7C). A tenant-scoped file area an agent reads and
 writes during a run, with optimistic concurrency via ETag / If-Match (WCT-1
-cross-owner isolation is enforced host-side). Drives the real CRUD surface
-GET/PUT/DELETE /v1/host/workspace/files. (The /v1/host/openwop-app/workspace/op
+cross-owner isolation is enforced host-side). Drives GET/PUT/DELETE
+/v1/host/workspace/files. v2 names no canonical workspace operation: its only
+v2 home is the conformance seams profile, so on a host that speaks major 2 AND
+advertises conformance.seamsProfile "openwop-conformance-seams-v2" the same
+calls go to /conformance/seams/workspace/files (OpenWOP-Version: 2.0);
+otherwise the v1 path is used. (The /v1/host/openwop-app/workspace/op
 cross-owner seam is a conformance-only test seam \u2014 reachable here as
 \`workspace op\`, and only on a host started with OPENWOP_TEST_SEAM_ENABLED=true.)
 
@@ -14833,6 +14890,153 @@ async function runOnboard(ctx, argv) {
   return 0;
 }
 
+// src/cli/login.ts
+import { hostname } from "node:os";
+var BASE10 = "/v1/host/openwop-app/cli-login";
+var LOGIN_HELP = `Usage:
+  openwop login [--label <name>] [--timeout <seconds>] [--profile <name>] [--json]
+  openwop logout [--profile <name>] [--json]
+
+Sign this terminal in to an openwop-app host without copying an API key
+(host extension under ${BASE10}).
+
+  login    Shows a short code. Open the host's Access \u2192 API keys page, type the
+           code under "Sign in the OpenWOP CLI", and approve. The host then issues
+           this CLI a key (30 days by default), saved to your config file.
+  logout   Revokes that key on the host and removes it from your config file.
+
+The key is never printed. It is listed in the app as "CLI: <label>", where you can
+revoke it. Sign in again to renew.
+
+  --label <name>      What to call this terminal in the app (default: this machine's hostname).
+  --timeout <seconds> Give up waiting for approval after this long (default: the host's own limit).
+  --profile <name>    Use the named config profile.
+
+Approve a code ONLY if you just ran \`openwop login\` yourself.
+
+Exit codes: 0 signed in / signed out \xB7 1 denied, expired or not available on this host \xB7 2 usage.
+
+Examples:
+  export OPENWOP_BASE_URL=https://app.openwop.dev/api
+  openwop login
+  openwop login --label "work laptop"
+  openwop logout
+`;
+var sleep2 = (ms2) => new Promise((r) => setTimeout(r, ms2));
+function approvalUrl(baseUrl, path) {
+  const p = typeof path === "string" && path.startsWith("/") ? path : "/access?tab=api-keys";
+  try {
+    return `${new URL(baseUrl).origin}${p}`;
+  } catch {
+    return p;
+  }
+}
+function notAvailable(ctx) {
+  return new CliError(
+    `${ctx.baseUrl} does not serve the CLI sign-in (${BASE10}/start is not there). Create an API key on the host and set OPENWOP_API_KEY instead.`,
+    1
+  );
+}
+async function runLogin(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--label", "--timeout", "--profile"] });
+  if (options.help) {
+    write(ctx.io.stdout, LOGIN_HELP);
+    return 0;
+  }
+  const timeoutS = options.timeout === void 0 ? void 0 : Number(options.timeout);
+  if (timeoutS !== void 0 && !(Number.isFinite(timeoutS) && timeoutS > 0)) {
+    writeLine(ctx.io.stderr, "--timeout must be a positive number of seconds.");
+    return 2;
+  }
+  const label = String(options.label ?? hostname() ?? "this machine").slice(0, 60);
+  const anon = { ...ctx, apiKey: void 0 };
+  let started;
+  try {
+    started = (await requestJson(anon, `${BASE10}/start`, { method: "POST", body: { label } })).body;
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) throw notAvailable(ctx);
+    throw err;
+  }
+  const deviceCode = started?.deviceCode;
+  const userCode = started?.userCode;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string") throw notAvailable(ctx);
+  writeLine(ctx.io.stderr, "");
+  writeLine(ctx.io.stderr, `  1. Open   ${approvalUrl(ctx.baseUrl, started.verificationPath)}`);
+  writeLine(ctx.io.stderr, `  2. Enter  ${userCode}   under "Sign in the OpenWOP CLI", and approve.`);
+  writeLine(ctx.io.stderr, "");
+  writeLine(ctx.io.stderr, "Waiting for approval\u2026");
+  const hostLimitS = Number.isFinite(Number(started.expiresIn)) ? Number(started.expiresIn) : 600;
+  const deadline = Date.now() + Math.min(timeoutS ?? hostLimitS, hostLimitS) * 1e3;
+  let intervalS = Number.isFinite(Number(started.interval)) ? Number(started.interval) : 3;
+  for (; ; ) {
+    if (Date.now() >= deadline) throw new CliError("Timed out waiting for approval. Run `openwop login` again for a new code.", 1);
+    await sleep2(Math.max(0, intervalS) * 1e3);
+    let res;
+    try {
+      res = (await requestJson(anon, `${BASE10}/poll`, { method: "POST", body: { deviceCode } })).body;
+    } catch (err) {
+      if (err instanceof HttpError && err.status === 404) {
+        throw new CliError("That sign-in expired or was already used. Run `openwop login` again for a new code.", 1);
+      }
+      throw err;
+    }
+    if (res?.status === "pending") {
+      if (Number.isFinite(Number(res.interval))) intervalS = Number(res.interval);
+      continue;
+    }
+    if (res?.status === "denied") throw new CliError("The sign-in was denied in the app.", 1);
+    if (res?.status === "failed") throw new CliError(`The host could not issue a key: ${String(res.message ?? "unknown reason")}`, 1);
+    if (res?.status === "approved" && typeof res.token === "string") {
+      const configPath = configPathFor(options.profile, ctx.env);
+      saveConfig(configPath, mergeConfig(readConfigSafe(configPath), { host: { baseUrl: ctx.baseUrl, apiKey: res.token } }));
+      const key = res.key ?? {};
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, { status: "signed-in", keyId: key.keyId ?? null, name: key.name ?? null, expiresAt: key.expiresAt ?? null, configPath });
+        return 0;
+      }
+      writeLine(ctx.io.stdout, `Signed in to ${ctx.baseUrl} as \u201C${key.name ?? `CLI: ${label}`}\u201D.`);
+      if (key.expiresAt) writeLine(ctx.io.stdout, `The key expires ${String(key.expiresAt).slice(0, 10)}; run \`openwop login\` again to renew.`);
+      writeLine(ctx.io.stdout, `Saved to ${configPath}. Revoke it any time with \`openwop logout\` or in the app.`);
+      return 0;
+    }
+    throw new CliError("The host answered the sign-in in a shape this CLI does not understand.", 1);
+  }
+}
+async function runLogout(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--profile"] });
+  if (options.help) {
+    write(ctx.io.stdout, LOGIN_HELP);
+    return 0;
+  }
+  const configPath = configPathFor(options.profile, ctx.env);
+  const config = readConfigSafe(configPath);
+  const saved = config?.host?.apiKey;
+  if (typeof saved !== "string" || saved.length === 0) {
+    if (ctx.json) writeJson(ctx.io.stdout, { status: "not-signed-in" });
+    else writeLine(ctx.io.stdout, "Not signed in: no key is saved in your config.");
+    return 0;
+  }
+  let revoked = false;
+  let note = "";
+  try {
+    await requestJson({ ...ctx, apiKey: saved }, `${BASE10}/logout`, { method: "POST", body: {} });
+    revoked = true;
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 401) note = "The host no longer recognised the key (already revoked or expired).";
+    else if (err instanceof HttpError && err.status === 404) note = "This host has no sign-out route; the key was NOT revoked there \u2014 revoke it in the app.";
+    else if (err instanceof HttpError && err.status === 400) note = "The saved key is not one a sign-in issued; it was NOT revoked on the host \u2014 revoke it in the app.";
+    else throw err;
+  }
+  unsetByPath(config, "host.apiKey");
+  saveConfig(configPath, config);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { status: "signed-out", revokedOnHost: revoked, ...note ? { note } : {} });
+    return 0;
+  }
+  writeLine(ctx.io.stdout, revoked ? "Signed out. The key was revoked on the host and removed from your config." : `Removed the key from your config. ${note}`);
+  return 0;
+}
+
 // src/cli/providers.ts
 var PROVIDERS_HELP = `Usage:
   openwop providers list [--json]
@@ -14972,30 +15176,49 @@ import { existsSync as existsSync6, readFileSync as readFileSync15, writeFileSyn
 import { join as join6, resolve as resolvePath8 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var PACKS_HELP = `Usage:
-  openwop packs search [query] [--registry-url url] [--limit n] [--json]
-  openwop packs info <name> [--version v] [--registry-url url] [--json]
-  openwop packs install <name>[@version] [--version v] [--dir path] [--no-verify] [--registry-url url] [--json]
-  openwop packs publish <dir> [--key ed25519.pem] [--key-id id] [--out dir] [--json]
-  openwop packs yank <name>[@version] [--version v] [--undo] [--json]
+  openwop packs search [query] [--registry-url url] [--tree v1|v2] [--limit n] [--json]
+  openwop packs info <name> [--version v] [--registry-url url] [--tree v1|v2] [--json]
+  openwop packs install <name>[@version|@range] [--version v] [--dir path] [--no-verify] [--registry-url url] [--tree v1|v2] [--json]
+  openwop packs publish <dir> [--key ed25519.pem] [--key-id id] [--out dir] [--tree v1|v2] [--json]
+  openwop packs yank <name>[@version] [--version v] [--undo] [--tree v1|v2] [--json]
 
 Operates the signed node-pack registry (default: https://packs.openwop.dev,
 override with --registry-url or OPENWOP_REGISTRY_URL). The registry is a
 separate surface from the host --base-url.
 
-  search    Reads /v1/index.json and filters the catalog client-side.
-  info      Reads /v1/packs/{name}/index.json (+ the version manifest with --version).
-  install   Downloads /v1/packs/{name}/-/{version}.tgz, checks sha256 integrity
-            against the manifest, and verifies the detached Ed25519 .sig against
-            the publisher key at /keys/{keyId}.pub (skip with --no-verify). Places
-            the tarball + manifest under ~/.openwop/packs/{name}/{version}/
+Every registry path is resolved through the registry's
+/.well-known/openwop-registry.json \`endpoints\` map (spec/v2/core/packs.md
+\xA7"The registry tree"), preferring the v2 tree (\`endpoints.v2\`). The v1 tree
+is used only when the registry names no v2 tree (or publishes no discovery
+document), or when you pass --tree v1.
+
+  search    Reads the registry index (endpoints.registryIndex, /v2/index.json on
+            packs.openwop.dev) and filters the catalog client-side.
+  info      Reads the pack index (endpoints.packMetadata) + the version manifest
+            with --version.
+  install   Resolves the version, downloads the tarball, checks its sha256
+            integrity against the manifest, and verifies the signature (skip
+            with --no-verify). v2: the detached Ed25519 .sig over the in-tarball
+            pack.json (RFC 8785 canonical JSON), under the registry key named by
+            signing.keyId, whose permittedNamespaces must cover the pack name.
+            Places the tarball + manifest under ~/.openwop/packs/{name}/{version}/
             (override with --dir).
+            Version: none = the pack's latest unyanked version; a range (^1.2,
+            ~1.2.0, 1.x, >=1.0.0 <2.0.0) = the highest matching unyanked version;
+            an exact version is a pin and MAY install a yanked version (with a
+            warning). A deprecated version installs with a warning.
   publish   The reference registry has NO write API (publish is PR-based). This
             packages + Ed25519-signs a local pack dir into a signed tarball +
-            sidecars (mirrors scripts/build-pack-tarball.mjs --signed), ready to
-            commit + open a PR. Private key: --key, else ~/.openwop-keys/{keyId}.private.pem.
+            sidecars, ready to commit + open a PR against openwop-registry. The
+            default (v2) signing block is { keyId, scheme: "ed25519-canonical-json" };
+            --tree v1 writes the legacy v1 block. Private key: --key, else
+            ~/.openwop-keys/{keyId}.private.pem.
   yank      Edits a local registry checkout \u2014 flips "yanked": true in the version
-            manifest (--undo reverses). The published change lands via PR + a
+            manifest under registry/v2/ (--tree v1 for the frozen v1 tree;
+            --undo reverses). The published change lands via PR + a
             build-index.mjs rerun. Run from inside the repo.
+
+Exit codes: 0 ok \xB7 1 verification / integrity / resolution failure \xB7 2 usage.
 `;
 async function runPacks(ctx, argv) {
   const sub = argv[0];
@@ -15023,6 +15246,71 @@ Run \`openwop packs --help\` for usage.`);
 function registryUrlFor(options, env) {
   return normalizeBaseUrl(options.registryUrl ?? env.OPENWOP_REGISTRY_URL ?? DEFAULT_REGISTRY_URL);
 }
+var REQUIRED_ENDPOINTS = ["registryIndex", "packMetadata", "versionManifest", "versionTarball", "versionSignature"];
+var LEGACY_V1_ENDPOINTS = {
+  registryIndex: "/v1/index.json",
+  packMetadata: "/v1/packs/{name}/index.json",
+  versionManifest: "/v1/packs/{name}/-/{version}.json",
+  versionTarball: "/v1/packs/{name}/-/{version}.tgz",
+  versionSignature: "/v1/packs/{name}/-/{version}.sig",
+  publicKey: "/keys/{keyId}.pub"
+};
+function treeOption(options) {
+  if (options.tree === void 0) return void 0;
+  if (options.tree !== "v1" && options.tree !== "v2") throw new CliError(`--tree must be v1 or v2 (got "${options.tree}").`);
+  return options.tree;
+}
+function stringTemplates(value) {
+  const out = {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) return out;
+  for (const [k, v] of Object.entries(value)) if (typeof v === "string" && !k.startsWith("_")) out[k] = v;
+  return out;
+}
+async function resolveRegistry(ctx, options) {
+  const url = registryUrlFor(options, ctx.env);
+  const forced = treeOption(options);
+  let doc = null;
+  try {
+    doc = await registryJson(ctx, url, "/.well-known/openwop-registry.json");
+  } catch (err) {
+    if (!(err instanceof HttpError) || err.status !== 404) throw err;
+  }
+  const endpoints = doc && typeof doc.endpoints === "object" ? doc.endpoints : null;
+  if (!endpoints) {
+    if (forced === "v2") throw new CliError(`${url} publishes no /.well-known/openwop-registry.json endpoints map, so no v2 tree can be resolved.`, 1);
+    return { url, tree: "v1", endpoints: { ...LEGACY_V1_ENDPOINTS }, signingKeys: null, source: "legacy-v1" };
+  }
+  const flat = stringTemplates(endpoints);
+  const publicKey = flat.publicKey ?? LEGACY_V1_ENDPOINTS.publicKey;
+  const v2 = stringTemplates(endpoints.v2);
+  const hasV2 = REQUIRED_ENDPOINTS.every((k) => typeof v2[k] === "string");
+  let tree;
+  let map;
+  let source;
+  if (forced === "v2" || forced === void 0 && hasV2) {
+    if (!hasV2) throw new CliError(`${url} names no v2 tree in its discovery document (endpoints.v2); retry with --tree v1.`, 1);
+    tree = "v2";
+    map = v2;
+    source = "endpoints.v2";
+  } else {
+    const v1 = stringTemplates(endpoints.v1);
+    tree = "v1";
+    map = { ...flat, ...v1 };
+    source = "endpoints.v1";
+  }
+  for (const k of REQUIRED_ENDPOINTS) {
+    if (typeof map[k] !== "string") throw new CliError(`${url}'s discovery document names no ${tree} "${k}" endpoint.`, 1);
+  }
+  return { url, tree, endpoints: { ...map, publicKey }, signingKeys: Array.isArray(doc.signingKeys) ? doc.signingKeys : null, source };
+}
+function registryPath(view, key, params = {}) {
+  const template = view.endpoints[key];
+  if (typeof template !== "string") throw new CliError(`${view.url}'s discovery document names no "${key}" endpoint.`, 1);
+  return template.replace(/\{([A-Za-z]+)\}/g, (_m, p) => {
+    if (params[p] === void 0) throw new CliError(`Registry endpoint ${key} needs {${p}}.`, 1);
+    return encodeURIComponent(params[p]);
+  });
+}
 async function registryJson(ctx, registryUrl, path) {
   const url = new URL(path, registryUrl + "/");
   const res = await ctx.fetchImpl(url, { method: "GET", headers: { accept: "application/json" } });
@@ -15043,15 +15331,15 @@ async function registryBytes(ctx, registryUrl, path) {
 async function runPacksSearch(ctx, argv) {
   const { options, positionals } = parseOptions(argv, {
     bool: ["--help"],
-    value: ["--registry-url", "--limit"]
+    value: ["--registry-url", "--limit", "--tree"]
   });
   if (options.help) {
     write(ctx.io.stdout, PACKS_HELP);
     return 0;
   }
   const query = String(positionals[0] ?? "").toLowerCase();
-  const registryUrl = registryUrlFor(options, ctx.env);
-  const index = await registryJson(ctx, registryUrl, "/v1/index.json");
+  const registry = await resolveRegistry(ctx, options);
+  const index = await registryJson(ctx, registry.url, registryPath(registry, "registryIndex"));
   const packs = Array.isArray(index?.packs) ? index.packs : [];
   const matched = packs.filter((p) => {
     if (!query) return true;
@@ -15060,7 +15348,7 @@ async function runPacksSearch(ctx, argv) {
   });
   const limit = Number(options.limit ?? 30);
   if (ctx.json) {
-    writeJson(ctx.io.stdout, { query: positionals[0] ?? "", total: matched.length, packs: matched });
+    writeJson(ctx.io.stdout, { query: positionals[0] ?? "", tree: registry.tree, total: matched.length, packs: matched });
     return 0;
   }
   if (matched.length === 0) {
@@ -15083,7 +15371,7 @@ async function runPacksSearch(ctx, argv) {
 async function runPacksInfo(ctx, argv) {
   const { options, positionals } = parseOptions(argv, {
     bool: ["--help"],
-    value: ["--registry-url", "--version"]
+    value: ["--registry-url", "--version", "--tree"]
   });
   if (options.help) {
     write(ctx.io.stdout, PACKS_HELP);
@@ -15091,15 +15379,11 @@ async function runPacksInfo(ctx, argv) {
   }
   const name = positionals[0];
   if (!name) throw new CliError("packs info requires a pack name.\nUsage: openwop packs info <name> [--version v]");
-  const registryUrl = registryUrlFor(options, ctx.env);
-  const pack = await registryJson(ctx, registryUrl, `/v1/packs/${encodeURIComponent(name)}/index.json`);
+  const registry = await resolveRegistry(ctx, options);
+  const pack = await packMetadata(ctx, registry, name);
   let versionManifest = null;
   if (options.version) {
-    versionManifest = await registryJson(
-      ctx,
-      registryUrl,
-      `/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(options.version)}.json`
-    );
+    versionManifest = await registryJson(ctx, registry.url, registryPath(registry, "versionManifest", { name, version: options.version }));
   }
   if (ctx.json) {
     writeJson(ctx.io.stdout, versionManifest ? { ...pack, requestedVersion: versionManifest } : pack);
@@ -15111,7 +15395,8 @@ async function runPacksInfo(ctx, argv) {
     `Latest:      ${pack.latest ?? "(none)"}`,
     `License:     ${pack.license || "\u2014"}`,
     `Author:      ${pack.author || "\u2014"}`,
-    `Description: ${pack.description || "\u2014"}`
+    `Description: ${pack.description || "\u2014"}`,
+    `Tree:        ${registry.tree}`
   ];
   if (pack.homepage) lines.push(`Homepage:    ${pack.homepage}`);
   lines.push("");
@@ -15121,7 +15406,7 @@ async function runPacksInfo(ctx, argv) {
     const rows = versions.map((v) => ({
       version: v.version,
       keyId: v.signingKeyId ?? "",
-      flags: v.yanked ? "yanked" : v.deprecated ? "deprecated" : "",
+      flags: versionFlags(v),
       integrity: typeof v.integrity === "string" ? v.integrity.slice(0, 24) + "\u2026" : ""
     }));
     writeLine(ctx.io.stdout, formatTable(rows, ["version", "keyId", "flags", "integrity"]));
@@ -15130,38 +15415,52 @@ async function runPacksInfo(ctx, argv) {
   }
   return 0;
 }
+async function packMetadata(ctx, registry, name) {
+  try {
+    return await registryJson(ctx, registry.url, registryPath(registry, "packMetadata", { name }));
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) throw new CliError(`No pack named ${name} on ${registry.url} (${registry.tree} tree). Try \`openwop packs search\`.`, 2);
+    throw err;
+  }
+}
+function versionFlags(v) {
+  return v?.yanked ? "yanked" : v?.versionDeprecated || v?.deprecated ? "deprecated" : "";
+}
 async function runPacksInstall(ctx, argv) {
   const { options, positionals } = parseOptions(argv, {
     bool: ["--help", "--no-verify"],
-    value: ["--registry-url", "--version", "--dir"]
+    value: ["--registry-url", "--version", "--dir", "--tree"]
   });
   if (options.help) {
     write(ctx.io.stdout, PACKS_HELP);
     return 0;
   }
   let name = positionals[0];
-  let version = options.version;
+  let requested = options.version;
   if (name && name.includes("@")) {
     const at = name.lastIndexOf("@");
-    version = version ?? name.slice(at + 1);
+    requested = requested ?? name.slice(at + 1);
     name = name.slice(0, at);
   }
   if (!name) throw new CliError("packs install requires a pack name.\nUsage: openwop packs install <name>[@version] [--version v]");
-  const registryUrl = registryUrlFor(options, ctx.env);
-  if (!version) {
-    const pack = await registryJson(ctx, registryUrl, `/v1/packs/${encodeURIComponent(name)}/index.json`);
-    version = pack?.latest;
-    if (!version) throw new CliError(`Could not resolve a version for ${name}; pass --version.`);
+  const registry = await resolveRegistry(ctx, options);
+  const warnings = [];
+  let version;
+  if (requested && isExactVersion(requested)) {
+    version = requested;
+  } else {
+    const pack = await packMetadata(ctx, registry, name);
+    version = resolveVersion(name, pack, requested);
   }
-  const manifest = await registryJson(
-    ctx,
-    registryUrl,
-    `/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.json`
-  );
+  const manifest = await registryJson(ctx, registry.url, registryPath(registry, "versionManifest", { name, version }));
   if (manifest?.yanked) {
-    throw new CliError(`${name}@${version} has been yanked and cannot be installed.`, 1);
+    warnings.push(`${name}@${version} is yanked${manifest.yankedReason ? ` (${manifest.yankedReason})` : ""}; installing it because it was pinned exactly.`);
   }
-  const tgz = await registryBytes(ctx, registryUrl, `/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.tgz`);
+  if (manifest?.versionDeprecated || manifest?.deprecated) {
+    const reason = manifest.deprecationReason ?? (typeof manifest.deprecated === "string" ? manifest.deprecated : "");
+    warnings.push(`${name}@${version} is deprecated${reason ? ` (${reason})` : ""}${manifest.supersededBy ? `; superseded by ${manifest.supersededBy}` : ""}.`);
+  }
+  const tgz = await registryBytes(ctx, registry.url, registryPath(registry, "versionTarball", { name, version }));
   const integrity = "sha256-" + createHash("sha256").update(tgz).digest("base64");
   if (manifest?.integrity && manifest.integrity !== integrity) {
     throw new CliError(
@@ -15171,19 +15470,7 @@ async function runPacksInstall(ctx, argv) {
   }
   let verifyResult = "skipped";
   if (!options.noVerify) {
-    const keyId = manifest?.signing?.keyId ?? manifest?.signing?.publicKeyRef;
-    if (!keyId) throw new CliError(`${name}@${version} manifest has no signing key reference; re-run with --no-verify to bypass.`, 1);
-    const sig = await registryBytes(ctx, registryUrl, `/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.sig`);
-    if (sig.length !== 64) throw new CliError(`Signature for ${name}@${version} is ${sig.length} bytes; expected 64 for Ed25519.`, 1);
-    const pubPem = (await registryBytes(ctx, registryUrl, `/keys/${encodeURIComponent(keyId)}.pub`)).toString("utf8");
-    const publicKey = createPublicKey(pubPem);
-    const method = manifest?.signing?.method ?? "ed25519";
-    const signedBytes = method === "manual" ? extractPackJsonBytes(tgz) : tgz;
-    const valid = ed25519Verify(null, signedBytes, publicKey, sig);
-    if (!valid) {
-      throw new CliError(`Signature verification FAILED for ${name}@${version} (keyId=${keyId}, method=${method}).`, 1);
-    }
-    verifyResult = `verified (keyId=${keyId}, method=${method})`;
+    verifyResult = registry.tree === "v2" ? await verifyV2(ctx, registry, name, version, manifest, tgz) : await verifyV1(ctx, registry, name, version, manifest, tgz);
   }
   const baseDir = options.dir ? resolvePath8(ctx.cwd, options.dir) : join6(configHomeDir(ctx.env), "packs");
   const destDir = join6(baseDir, name, version);
@@ -15192,27 +15479,182 @@ async function runPacksInstall(ctx, argv) {
   const manifestPath = join6(destDir, `${version}.json`);
   writeFileSync10(tgzPath, tgz);
   writeFileSync10(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  for (const w of warnings) writeLine(ctx.io.stderr, `warning: ${w}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, {
       name,
       version,
+      tree: registry.tree,
       integrity,
       signature: verifyResult,
+      yanked: Boolean(manifest?.yanked),
+      deprecated: Boolean(manifest?.versionDeprecated || manifest?.deprecated),
       tarball: tgzPath,
       manifest: manifestPath
     });
     return 0;
   }
-  writeLine(ctx.io.stdout, `Installed ${name}@${version}`);
+  writeLine(ctx.io.stdout, `Installed ${name}@${version} (${registry.tree} tree)`);
   writeLine(ctx.io.stdout, `  signature: ${verifyResult}`);
   writeLine(ctx.io.stdout, `  integrity: ${integrity}`);
   writeLine(ctx.io.stdout, `  tarball:   ${tgzPath}`);
   return 0;
 }
+async function verifyV1(ctx, registry, name, version, manifest, tgz) {
+  const keyId = manifest?.signing?.keyId ?? manifest?.signing?.publicKeyRef;
+  if (!keyId) throw new CliError(`${name}@${version} manifest has no signing key reference; re-run with --no-verify to bypass.`, 1);
+  const sig = await registryBytes(ctx, registry.url, registryPath(registry, "versionSignature", { name, version }));
+  if (sig.length !== 64) throw new CliError(`Signature for ${name}@${version} is ${sig.length} bytes; expected 64 for Ed25519.`, 1);
+  const pubPem = (await registryBytes(ctx, registry.url, registryPath(registry, "publicKey", { keyId }))).toString("utf8");
+  const method = manifest?.signing?.method ?? "ed25519";
+  const signedBytes = method === "manual" ? extractPackJsonBytes(tgz) : tgz;
+  if (!ed25519Verify(null, signedBytes, createPublicKey(pubPem), sig)) {
+    throw new CliError(`Signature verification FAILED for ${name}@${version} (keyId=${keyId}, method=${method}).`, 1);
+  }
+  return `verified (keyId=${keyId}, method=${method})`;
+}
+var V2_SCHEME = "ed25519-canonical-json";
+async function verifyV2(ctx, registry, name, version, manifest, tgz) {
+  const fail3 = (why) => new CliError(`Signature verification FAILED for ${name}@${version} (pack_signature_invalid): ${why}`, 1);
+  const signing = manifest?.signing;
+  if (!signing || typeof signing !== "object") throw fail3("the version manifest has no signing block; re-run with --no-verify to bypass.");
+  const legacy = ["method", "publicKeyRef", "signatureRef"].filter((k) => k in signing);
+  if (legacy.length > 0) throw fail3(`a v2 signing block carries ${legacy.join(", ")} (v1 fields; a v2 block is { keyId, scheme }).`);
+  if (signing.scheme !== V2_SCHEME) throw fail3(`signing.scheme is ${JSON.stringify(signing.scheme)}; the only v2 scheme is ${V2_SCHEME}.`);
+  const keyId = signing.keyId;
+  if (typeof keyId !== "string" || keyId === "") throw fail3("signing.keyId is missing.");
+  if (!registry.signingKeys) throw fail3(`${registry.url} publishes no signingKeys[], so the namespace check cannot run.`);
+  const key = registry.signingKeys.find((k) => k && k.keyId === keyId);
+  if (!key) throw fail3(`keyId ${keyId} is not listed in the registry's signingKeys[].`);
+  const permitted = Array.isArray(key.permittedNamespaces) ? key.permittedNamespaces : [];
+  if (!permitted.some((pattern) => namespaceCovers(pattern, name))) {
+    throw fail3(`key ${keyId} is not permitted to sign ${name} (permittedNamespaces: ${permitted.join(", ") || "none"}).`);
+  }
+  const packJson = extractPackJsonBytes(tgz);
+  let embedded;
+  try {
+    embedded = JSON.parse(packJson.toString("utf8"));
+  } catch {
+    throw fail3("the in-tarball pack.json is not JSON.");
+  }
+  if (embedded?.name !== name || embedded?.version !== version) {
+    throw fail3(`the in-tarball pack.json is ${embedded?.name}@${embedded?.version}, not ${name}@${version}.`);
+  }
+  if (embedded?.signing?.keyId !== void 0 && embedded.signing.keyId !== keyId) {
+    throw fail3(`the in-tarball pack.json names signer ${embedded.signing.keyId}, the version manifest ${keyId}.`);
+  }
+  if (canonicalJsonStringify(embedded) !== packJson.toString("utf8")) {
+    throw fail3("the in-tarball pack.json is not in canonical (RFC 8785) form, so its bytes are not what ed25519-canonical-json signs.");
+  }
+  const sig = await registryBytes(ctx, registry.url, registryPath(registry, "versionSignature", { name, version }));
+  if (sig.length !== 64) throw fail3(`the signature is ${sig.length} bytes; expected 64 for Ed25519.`);
+  const keyPath = typeof key.publicKeyUrl === "string" && key.publicKeyUrl !== "" ? key.publicKeyUrl : registryPath(registry, "publicKey", { keyId });
+  const pubPem = (await registryBytes(ctx, registry.url, keyPath)).toString("utf8");
+  if (!ed25519Verify(null, packJson, createPublicKey(pubPem), sig)) throw fail3(`the signature does not verify under ${keyId}.`);
+  const status = typeof key.status === "string" ? key.status : "active";
+  return `verified (keyId=${keyId}, scheme=${V2_SCHEME}${status !== "active" ? `, key status ${status}` : ""})`;
+}
+function namespaceCovers(pattern, name) {
+  if (typeof pattern !== "string") return false;
+  if (pattern.endsWith(".*")) return name.startsWith(pattern.slice(0, -1));
+  return name === pattern;
+}
+var SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function isExactVersion(v) {
+  return SEMVER_RE.test(v.trim());
+}
+function parseSemver(v) {
+  const m = SEMVER_RE.exec(String(v).trim());
+  if (!m) return null;
+  return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]), pre: m[4] ? m[4].split(".") : [] };
+}
+function compareSemver(a, b) {
+  const x = parseSemver(a);
+  const y = parseSemver(b);
+  if (!x || !y) return String(a).localeCompare(String(b));
+  for (const k of ["major", "minor", "patch"]) if (x[k] !== y[k]) return x[k] - y[k];
+  if (x.pre.length === 0 || y.pre.length === 0) return y.pre.length - x.pre.length;
+  for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+    const p = x.pre[i];
+    const q = y.pre[i];
+    if (p === void 0) return -1;
+    if (q === void 0) return 1;
+    const pn = /^\d+$/.test(p);
+    const qn = /^\d+$/.test(q);
+    if (pn && qn && Number(p) !== Number(q)) return Number(p) - Number(q);
+    if (pn !== qn) return pn ? -1 : 1;
+    if (p !== q) return p < q ? -1 : 1;
+  }
+  return 0;
+}
+function comparator(raw) {
+  const m = /^(\^|~|>=|<=|>|<|=)?\s*v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(-[0-9A-Za-z.-]+)?$/.exec(raw);
+  if (!m) throw new CliError(`Unsupported version range "${raw}". Use an exact version, ^x.y.z, ~x.y.z, x.y.x, or comparators like ">=1.0.0 <2.0.0".`);
+  const op = m[1] ?? "";
+  const wild = (p) => p === void 0 || /^[xX*]$/.test(p);
+  const [maj, min, pat] = [m[2], m[3], m[4]];
+  const n = (p) => wild(p) ? 0 : Number(p);
+  const floor = `${n(maj)}.${n(min)}.${n(pat)}${m[5] ?? ""}`;
+  const cmp = (v) => compareSemver(v, floor);
+  let ceil = null;
+  if (op === "^") {
+    ceil = n(maj) > 0 || wild(min) ? `${n(maj) + 1}.0.0` : n(min) > 0 || wild(pat) ? `0.${n(min) + 1}.0` : `0.0.${n(pat) + 1}`;
+  } else if (op === "~") {
+    ceil = wild(min) ? `${n(maj) + 1}.0.0` : `${n(maj)}.${n(min) + 1}.0`;
+  } else if (op === "" || op === "=") {
+    if (wild(maj)) return () => true;
+    if (wild(min)) ceil = `${n(maj) + 1}.0.0`;
+    else if (wild(pat)) ceil = `${n(maj)}.${n(min) + 1}.0`;
+    else return (v) => cmp(v) === 0;
+  }
+  if (ceil !== null) {
+    const c = ceil;
+    return (v) => cmp(v) >= 0 && compareSemver(v, `${c}-0`) < 0;
+  }
+  switch (op) {
+    case ">=":
+      return (v) => cmp(v) >= 0;
+    case ">":
+      return (v) => cmp(v) > 0;
+    case "<=":
+      return (v) => cmp(v) <= 0;
+    default:
+      return (v) => cmp(v) < 0;
+  }
+}
+function satisfiesRange(version, range) {
+  const parsed = parseSemver(version);
+  if (!parsed) return false;
+  return range.split("||").some((set) => {
+    const parts = set.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/).filter(Boolean);
+    if (parts.length === 0) return true;
+    if (parsed.pre.length > 0 && !parts.some((p) => p.includes("-"))) return false;
+    return parts.every((p) => comparator(p)(version));
+  });
+}
+function resolveVersion(name, pack, range) {
+  const versions = Array.isArray(pack?.versions) ? pack.versions : [];
+  const unyanked = versions.filter((v) => v && typeof v.version === "string" && !v.yanked).map((v) => v.version);
+  if (!range || range === "latest") {
+    const latest = typeof pack?.latest === "string" ? pack.latest : void 0;
+    const latestEntry = versions.find((v) => v?.version === latest);
+    if (latest && versions.length === 0) return latest;
+    if (latest && latestEntry && !latestEntry.yanked) return latest;
+    const best = unyanked.filter((v) => (parseSemver(v)?.pre.length ?? 1) === 0).sort(compareSemver).pop() ?? unyanked.sort(compareSemver).pop();
+    if (!best) throw new CliError(`${name} has no installable (unyanked) version; pin an exact version to install a yanked one.`, 1);
+    return best;
+  }
+  const match = unyanked.filter((v) => satisfiesRange(v, range)).sort(compareSemver).pop();
+  if (!match) {
+    const yankedHit = versions.some((v) => v?.yanked && typeof v.version === "string" && satisfiesRange(v.version, range));
+    throw new CliError(`No unyanked version of ${name} satisfies "${range}"${yankedHit ? " (a yanked version does; pin it exactly to install it)" : ""}.`, 1);
+  }
+  return match;
+}
 async function runPacksPublish(ctx, argv) {
   const { options, positionals } = parseOptions(argv, {
     bool: ["--help"],
-    value: ["--key", "--key-id", "--out"]
+    value: ["--key", "--key-id", "--out", "--tree"]
   });
   if (options.help) {
     write(ctx.io.stdout, PACKS_HELP);
@@ -15230,9 +15672,10 @@ async function runPacksPublish(ctx, argv) {
   const version = manifest.version;
   if (!name || !version) throw new CliError('pack.json must declare both "name" and "version".');
   const keyId = options.keyId ?? "openwop-team-1";
+  const tree = treeOption(options) ?? "v2";
   const signedManifest = {
     ...manifest,
-    signing: { method: "manual", publicKeyRef: keyId, signatureRef: "keys/pack.json.sig" }
+    signing: tree === "v2" ? { keyId, scheme: V2_SCHEME } : { method: "manual", publicKeyRef: keyId, signatureRef: "keys/pack.json.sig" }
   };
   const canonical = canonicalJsonStringify(signedManifest);
   let privateKey;
@@ -15269,6 +15712,7 @@ async function runPacksPublish(ctx, argv) {
       name,
       version,
       keyId,
+      tree,
       integrity: `sha256:${sha}`,
       tarball: tgzPath,
       signature: sigPath,
@@ -15279,7 +15723,7 @@ async function runPacksPublish(ctx, argv) {
     });
     return 0;
   }
-  writeLine(ctx.io.stdout, `Packaged + signed ${name}@${version} (keyId=${keyId})`);
+  writeLine(ctx.io.stdout, `Packaged + signed ${name}@${version} for the ${tree} tree (keyId=${keyId})`);
   writeLine(ctx.io.stdout, `  tarball:   ${tgzPath}`);
   writeLine(ctx.io.stdout, `  signature: ${sigPath}`);
   writeLine(ctx.io.stdout, `  manifest:  ${manifestOut}`);
@@ -15291,15 +15735,15 @@ async function runPacksPublish(ctx, argv) {
   }
   writeLine(ctx.io.stdout, "");
   writeLine(ctx.io.stdout, "The reference registry has no write API. To publish:");
-  writeLine(ctx.io.stdout, `  1. Copy the artifacts into registry/v1/packs/${name}/-/`);
-  writeLine(ctx.io.stdout, "  2. Run `node registry/scripts/build-index.mjs` to refresh the index.");
+  writeLine(ctx.io.stdout, `  1. Copy the artifacts into registry/${tree}/packs/${name}/-/ of an openwop-registry checkout`);
+  writeLine(ctx.io.stdout, `  2. Run \`node registry/scripts/build-index.mjs --tree ${tree}\` to refresh the index.`);
   writeLine(ctx.io.stdout, "  3. Open a pull request (publishMethod: github-pull-request).");
   return 0;
 }
 async function runPacksYank(ctx, argv) {
   const { options, positionals } = parseOptions(argv, {
     bool: ["--help", "--undo"],
-    value: ["--version"]
+    value: ["--version", "--tree"]
   });
   if (options.help) {
     write(ctx.io.stdout, PACKS_HELP);
@@ -15316,7 +15760,8 @@ async function runPacksYank(ctx, argv) {
     throw new CliError("packs yank requires <name>@<version> (or <name> --version v).");
   }
   const root = requireRepoRoot(ctx);
-  const manifestPath = join6(root, "registry", "v1", "packs", name, "-", `${version}.json`);
+  const tree = treeOption(options) ?? "v2";
+  const manifestPath = join6(root, "registry", tree, "packs", name, "-", `${version}.json`);
   if (!existsSync6(manifestPath)) {
     throw new CliError(`Version manifest not found: ${manifestPath}
 (packs yank edits a local registry checkout; the published change lands via PR.)`);
@@ -15330,12 +15775,12 @@ async function runPacksYank(ctx, argv) {
   manifest.yanked = newValue;
   writeFileSync10(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
   if (ctx.json) {
-    writeJson(ctx.io.stdout, { name, version, yanked: newValue, manifest: manifestPath, publishMethod: "github-pull-request" });
+    writeJson(ctx.io.stdout, { name, version, tree, yanked: newValue, manifest: manifestPath, publishMethod: "github-pull-request" });
     return 0;
   }
   writeLine(ctx.io.stdout, `${newValue ? "Yanked" : "Un-yanked"} ${name}@${version}`);
   writeLine(ctx.io.stdout, `  edited: ${manifestPath}`);
-  writeLine(ctx.io.stdout, "  Next: run `node registry/scripts/build-index.mjs`, commit, and open a PR.");
+  writeLine(ctx.io.stdout, `  Next: run \`node registry/scripts/build-index.mjs --tree ${tree}\`, commit, and open a PR.`);
   return 0;
 }
 function canonicalJsonStringify(value) {
@@ -17818,7 +18263,7 @@ Examples:
   openwop profiles pin r_123
   openwop profiles activity --limit 10 --status failed
 `;
-var BASE10 = "/v1/host/openwop-app/profiles";
+var BASE11 = "/v1/host/openwop-app/profiles";
 async function profilesRequest(ctx, path, options, notFoundMsg) {
   try {
     return await requestJson(ctx, path, options);
@@ -17915,7 +18360,7 @@ async function runList2(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles list [--json]\n");
     return 0;
   }
-  const res = await profilesRequest(ctx, BASE10);
+  const res = await profilesRequest(ctx, BASE11);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -17941,7 +18386,7 @@ async function runGet3(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles get [<userId>] [--json]\n");
     return options.help ? 0 : 2;
   }
-  const path = positionals.length === 1 ? `${BASE10}/${encodeURIComponent(positionals[0])}` : `${BASE10}/me`;
+  const path = positionals.length === 1 ? `${BASE11}/${encodeURIComponent(positionals[0])}` : `${BASE11}/me`;
   const res = await profilesRequest(ctx, path, void 0, `Profile not found: ${positionals[0] ?? "me"}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -17960,7 +18405,7 @@ async function runActivity(ctx, argv) {
   if (options.limit !== void 0) qs2.set("limit", String(options.limit));
   if (options.status !== void 0) qs2.set("status", String(options.status));
   const q = qs2.toString();
-  const res = await profilesRequest(ctx, `${BASE10}/me/activity${q ? `?${q}` : ""}`);
+  const res = await profilesRequest(ctx, `${BASE11}/me/activity${q ? `?${q}` : ""}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -17999,7 +18444,7 @@ async function runEdit(ctx, argv) {
   if (Array.isArray(options.interests)) body.interests = options.interests;
   if (Array.isArray(options.growthInterests)) body.growthInterests = options.growthInterests;
   if (options.location !== void 0 || Array.isArray(options.link)) {
-    const current = (await profilesRequest(ctx, `${BASE10}/me`)).body?.contact ?? {};
+    const current = (await profilesRequest(ctx, `${BASE11}/me`)).body?.contact ?? {};
     const contact = { ...current };
     if (options.location !== void 0) contact.location = options.location;
     if (Array.isArray(options.link)) {
@@ -18026,7 +18471,7 @@ async function runEdit(ctx, argv) {
   }
   if (Object.keys(avail).length) body.availability = avail;
   if (Object.keys(body).length === 0) throw new CliError("Nothing to edit \u2014 pass at least one field.", 2);
-  const res = await profilesRequest(ctx, `${BASE10}/me`, { method: "PATCH", body });
+  const res = await profilesRequest(ctx, `${BASE11}/me`, { method: "PATCH", body });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18052,7 +18497,7 @@ async function runSkillsSet(ctx, argv) {
     if (!Number.isFinite(prof2) || prof2 < 1 || prof2 > 5) throw new CliError(`--skill proficiency must be 1..5 (got '${e}')`, 2);
     return { name, proficiency: prof2 };
   });
-  const res = await profilesRequest(ctx, `${BASE10}/me/skills`, { method: "PUT", body: { skills } });
+  const res = await profilesRequest(ctx, `${BASE11}/me/skills`, { method: "PUT", body: { skills } });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18067,7 +18512,7 @@ async function runPortfolioAdd(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles portfolio add --token <mediaToken> [--json]\n");
     return options.help ? 0 : 2;
   }
-  const res = await profilesRequest(ctx, `${BASE10}/me/portfolio`, { method: "POST", body: { token: options.token } });
+  const res = await profilesRequest(ctx, `${BASE11}/me/portfolio`, { method: "POST", body: { token: options.token } });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18081,7 +18526,7 @@ async function runPortfolioRemove(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles portfolio remove <mediaToken> [--json]\n");
     return options.help ? 0 : 2;
   }
-  const res = await profilesRequest(ctx, `${BASE10}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
+  const res = await profilesRequest(ctx, `${BASE11}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18096,7 +18541,7 @@ async function runPin(ctx, argv, pinned) {
 `);
     return options.help ? 0 : 2;
   }
-  const path = `${BASE10}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
+  const path = `${BASE11}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
   const res = await profilesRequest(ctx, path, { method: pinned ? "PUT" : "DELETE" }, `Agent not found: ${positionals[0]}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -18113,7 +18558,7 @@ async function runEndorse(ctx, argv, add) {
     return options.help ? 0 : 2;
   }
   const [userId, skill] = positionals;
-  const path = `${BASE10}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
+  const path = `${BASE11}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
   const res = await profilesRequest(ctx, path, { method: add ? "POST" : "DELETE" }, `Profile or skill not found: ${userId} / ${skill}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -19208,7 +19653,7 @@ Examples:
   openwop auth saml validate --idp-url http://localhost:9100/idp --variant valid
   openwop auth scim provision --op create-user --user-name jo@acme.com --email jo@acme.com
 `;
-var BASE11 = "/v1/host/openwop-app/auth";
+var BASE12 = "/v1/host/openwop-app/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
   return redactSecrets(value, { secret: SECRET_KEY2 });
@@ -19259,7 +19704,7 @@ async function runStatus(ctx, argv) {
   const profiles = disc.ok && Array.isArray(disc.body?.capabilities?.auth?.profiles) ? disc.body.capabilities.auth.profiles : [];
   const samlAdvertised = profiles.includes("openwop-auth-saml");
   const scimAdvertised = profiles.includes("openwop-auth-scim");
-  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE11}/saml/sso/metadata`)).ok : false;
+  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE12}/saml/sso/metadata`)).ok : false;
   if (ctx.json) {
     writeJson(ctx.io.stdout, {
       authProfilesAdvertised: profiles,
@@ -19284,7 +19729,7 @@ async function runSamlMetadata(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop auth saml metadata [--json]\n");
     return 0;
   }
-  const res = await authRequest(ctx, `${BASE11}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
+  const res = await authRequest(ctx, `${BASE12}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
   const xml = typeof res.body?.raw === "string" ? res.body.raw : typeof res.body === "string" ? res.body : JSON.stringify(res.body);
   if (ctx.json) {
     writeJson(ctx.io.stdout, { metadata: xml });
@@ -19302,7 +19747,7 @@ async function runSamlLoginUrl(ctx, argv) {
   }
   const returnTo = options.returnTo ?? "/";
   const base16 = ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`;
-  const url = new URL(`${BASE11}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base16);
+  const url = new URL(`${BASE12}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base16);
   const res = await ctx.fetchImpl(url, { method: "GET", redirect: "manual" });
   if (res.status === 404) {
     throw new CliError("SAML SSO is not configured on this host (set OPENWOP_SAML_*).", 1);
@@ -19327,7 +19772,7 @@ async function runSamlValidate(ctx, argv) {
   const body = { idpUrl: options.idpUrl, variant: options.variant };
   let res;
   try {
-    res = await requestJson(ctx, `${BASE11}/saml/validate`, { method: "POST", body });
+    res = await requestJson(ctx, `${BASE12}/saml/validate`, { method: "POST", body });
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
       throw new CliError("SAML validation seam not configured on this host (set OPENWOP_TEST_SAML_IDP_URL).", 1);
@@ -19370,7 +19815,7 @@ async function runScimProvision(ctx, argv) {
   if (options.displayName !== void 0) user.displayName = options.displayName;
   const body = { op: options.op, user };
   if (options.group !== void 0) body.group = options.group;
-  const res = await authRequest(ctx, `${BASE11}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
+  const res = await authRequest(ctx, `${BASE12}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
   const safe = redact2(res.body ?? {});
   if (ctx.json) {
     writeJson(ctx.io.stdout, safe);
@@ -19394,7 +19839,7 @@ async function runBreakGlass(ctx, argv) {
   const token = await readSecretInput(ctx, options.tokenFile !== void 0 ? { valueFile: options.tokenFile } : {}, "Break-glass token");
   let res;
   try {
-    res = await requestJson(ctx, `${BASE11}/break-glass`, { method: "POST", body: { token } });
+    res = await requestJson(ctx, `${BASE12}/break-glass`, { method: "POST", body: { token } });
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) throw new CliError("Break-glass login is not enabled on this host (OPENWOP_BREAKGLASS_ENABLED is not true).", 1);
     if (err instanceof HttpError && err.status === 401) throw new CliError("Break-glass login refused (wrong, short, or already-used token, or the host is misconfigured). The attempt was audited.", 4);
@@ -19723,10 +20168,9 @@ function exitForState(state) {
   return 1;
 }
 async function ensureAdvertised3(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  const advertised = !!(body.capabilities?.agents?.proposals ?? body.agents?.proposals);
+  const record = await advertisedRecord(ctx, (b) => b.capabilities?.agents?.proposals ?? b.agents?.proposals);
+  if (record === void 0) return;
+  const advertised = !!record;
   if (!advertised) {
     throw new CliError(
       "proposals: this host does not advertise the reviewable-learning proposal capability (capabilities.agents.proposals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -20055,10 +20499,9 @@ function exitForState2(state) {
   return 1;
 }
 async function ensureAdvertised4(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  const advertised = !!(body.capabilities?.agents?.goals ?? body.agents?.goals);
+  const record = await advertisedRecord(ctx, (b) => b.capabilities?.agents?.goals ?? b.agents?.goals);
+  if (record === void 0) return;
+  const advertised = !!record;
   if (!advertised) {
     throw new CliError(
       "goals: this host does not advertise the standing-goals capability (capabilities.agents.goals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -20326,10 +20769,9 @@ function redact3(value) {
   return redactSecrets(value, { secret: SECRET_KEY3, keep: REF_ONLY_KEY });
 }
 async function ensureAdvertised5(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  const advertised = !!(body.capabilities?.portability ?? body.portability);
+  const record = await advertisedRecord(ctx, (b) => b.capabilities?.portability ?? b.portability);
+  if (record === void 0) return;
+  const advertised = !!record;
   if (!advertised) {
     throw new CliError(
       "portability: this host does not advertise the export/import capability (capabilities.portability is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -20576,10 +21018,7 @@ function exitForState3(state) {
   return 1;
 }
 async function triggerBridgeCaps(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return void 0;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  return body.capabilities?.triggerBridge ?? body.triggerBridge ?? null;
+  return advertisedRecord(ctx, (b) => b.capabilities?.triggerBridge ?? b.triggerBridge);
 }
 async function ensureAdvertised6(ctx) {
   const tb = await triggerBridgeCaps(ctx);
@@ -20839,10 +21278,7 @@ function exitForState4(state) {
   return 1;
 }
 async function a2aCaps(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return void 0;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  return body.capabilities?.a2a ?? body.a2a ?? null;
+  return advertisedRecord(ctx, (b) => b.capabilities?.a2a ?? b.a2a);
 }
 async function runStatus2(ctx, argv) {
   const { options } = parseOptions(argv, { bool: ["--help"] });
@@ -20859,7 +21295,7 @@ async function runStatus2(ctx, argv) {
     writeLine(ctx.io.stdout, "This host does not advertise A2A (capabilities.a2a absent).");
     return 1;
   }
-  writeLine(ctx.io.stdout, `a2a.supported: ${a2a.supported ? "yes" : "no"}`);
+  writeLine(ctx.io.stdout, `a2a.supported: ${a2a.supported ?? true ? "yes" : "no"}`);
   if (a2a.agentCardUrl) writeLine(ctx.io.stdout, `agentCardUrl: ${a2a.agentCardUrl}`);
   writeLine(ctx.io.stdout, `streaming: ${a2a.streaming ? "yes" : "no"}`);
   writeLine(ctx.io.stdout, `pushNotifications: ${a2a.pushNotifications ? "yes" : "no"}`);
@@ -21048,7 +21484,7 @@ Run \`openwop docs --help\` for usage.`);
 }
 
 // src/cli/knowledgeSync.ts
-var BASE12 = "/v1/host/openwop-app/knowledge-sync";
+var BASE13 = "/v1/host/openwop-app/knowledge-sync";
 var KNOWLEDGE_SYNC_HELP = `Usage:
   openwop knowledge-sync list --org <orgId> [--json]
   openwop knowledge-sync get <sourceId> [--json]
@@ -21108,12 +21544,12 @@ async function runKnowledgeSync(ctx, argv) {
   switch (sub) {
     case "list": {
       if (!options.org) return usage4(ctx, "list --org <orgId>");
-      const res = await requestJson(ctx, withQuery(BASE12, { orgId: String(options.org) }));
+      const res = await requestJson(ctx, withQuery(BASE13, { orgId: String(options.org) }));
       return renderList(ctx, res.body, pickArray(res.body, "sources"), ["id", "provider", "collectionId", "cadence", "status", "lastSyncedAt"], "No sync sources.");
     }
     case "get": {
       if (!id) return usage4(ctx, "get <sourceId>");
-      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE12}/${enc2(id)}`)).body);
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE13}/${enc2(id)}`)).body);
       return 0;
     }
     case "create": {
@@ -21129,12 +21565,12 @@ async function runKnowledgeSync(ctx, argv) {
       if (options.cadence) body.cadence = String(options.cadence);
       if (options.provider) body.provider = String(options.provider);
       if (options.noMedia) body.includeMedia = false;
-      const res = await requestJson(ctx, BASE12, { method: "POST", body });
+      const res = await requestJson(ctx, BASE13, { method: "POST", body });
       return renderDone(ctx, res.body, `Created sync source ${res.body?.source?.id ?? ""}.`);
     }
     case "browse": {
       if (!options.org || !options.connection) return usage4(ctx, "browse --org <orgId> --connection <connectionId> [--folder id]");
-      const res = await requestJson(ctx, withQuery(`${BASE12}/browse`, {
+      const res = await requestJson(ctx, withQuery(`${BASE13}/browse`, {
         orgId: String(options.org),
         connectionId: String(options.connection),
         folderId: options.folder
@@ -21143,18 +21579,18 @@ async function runKnowledgeSync(ctx, argv) {
     }
     case "update": {
       if (!id || !options.includeMedia && !options.noMedia) return usage4(ctx, "update <sourceId> (--include-media | --no-media)");
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}`, { method: "PATCH", body: { includeMedia: !options.noMedia } });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}`, { method: "PATCH", body: { includeMedia: !options.noMedia } });
       return renderDone(ctx, res.body, `Updated sync source ${id} (media ${options.noMedia ? "excluded" : "included"}).`);
     }
     case "pause":
     case "resume": {
       if (!id) return usage4(ctx, `${sub} <sourceId>`);
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}/${sub}`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}/${sub}`, { method: "POST", body: {} });
       return renderDone(ctx, res.body, `${sub === "pause" ? "Paused" : "Resumed"} sync source ${id}.`);
     }
     case "sync": {
       if (!id) return usage4(ctx, "sync <sourceId>");
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}/sync`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}/sync`, { method: "POST", body: {} });
       const r = res.body?.result ?? {};
       const counts = Object.entries(r).filter(([, v]) => typeof v === "number").map(([k, v]) => `${k}=${v}`).join(" ");
       return renderDone(ctx, res.body, `Synced source ${id}${counts ? `: ${counts}` : "."}`);
@@ -21162,7 +21598,7 @@ async function runKnowledgeSync(ctx, argv) {
     case "delete": {
       if (!id) return usage4(ctx, "delete <sourceId> [--yes]");
       if (!options.yes) throw new CliError(`Refusing to delete sync source ${id} without --yes.`, 2);
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}`, { method: "DELETE" });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}`, { method: "DELETE" });
       return renderDone(ctx, res.body, `Deleted sync source ${id}.`);
     }
     default:
@@ -21174,7 +21610,7 @@ Run \`openwop knowledge-sync --help\` for usage.`);
 // src/cli/entities.ts
 import { readFileSync as readFileSync18, writeFileSync as writeFileSync14 } from "node:fs";
 import { resolve as resolvePath9 } from "node:path";
-var BASE13 = "/v1/host/openwop-app/entities";
+var BASE14 = "/v1/host/openwop-app/entities";
 var PUBLIC_BASE2 = "/v1/host/openwop-app/public-entities";
 var ENTITIES_HELP = `Usage:
   openwop entities locale-context [--json]
@@ -21296,7 +21732,7 @@ async function runEntities(ctx, argv) {
   const q = (path, extra = {}) => withQuery(path, { projectId: project4, ...extra });
   switch (family) {
     case "locale-context": {
-      const res = await requestJson(ctx, q(`${BASE13}/locale-context`));
+      const res = await requestJson(ctx, q(`${BASE14}/locale-context`));
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -21328,10 +21764,10 @@ Run \`openwop entities --help\` for usage.`);
 }
 async function types(ctx, sub, pos, o, project4, q) {
   const name = pos[0];
-  const typePath = (n) => `${BASE13}/types/${enc2(n)}`;
+  const typePath = (n) => `${BASE14}/types/${enc2(n)}`;
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, q(`${BASE13}/types`));
+      const res = await requestJson(ctx, q(`${BASE14}/types`));
       return renderList(
         ctx,
         res.body,
@@ -21355,7 +21791,7 @@ async function types(ctx, sub, pos, o, project4, q) {
         projectId: project4
       });
       if (!body.name) return usage5(ctx, "types create --name <n> [--fields <json>]");
-      const res = await requestJson(ctx, `${BASE13}/types`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE14}/types`, { method: "POST", body });
       return renderDone(ctx, res.body, `Created entity type ${res.body?.name ?? body.name}.`);
     }
     case "update": {
@@ -21430,7 +21866,7 @@ async function types(ctx, sub, pos, o, project4, q) {
 async function records(ctx, sub, pos, o, _project, q) {
   const [type, id] = pos;
   if (!type) return usage5(ctx, `${sub} <type>${sub === "list" || sub === "create" ? "" : " <entityId>"}`);
-  const coll = `${BASE13}/types/${enc2(type)}/entities`;
+  const coll = `${BASE14}/types/${enc2(type)}/entities`;
   const recordBody = () => mergeBody(ctx, o, {
     values: o.values !== void 0 ? parseJsonFlag("--values", o.values) : void 0,
     termIds: csv(o.termIds),
@@ -21475,7 +21911,7 @@ async function records(ctx, sub, pos, o, _project, q) {
 async function taxonomies(ctx, sub, pos, o, project4, q) {
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, q(`${BASE13}/taxonomies`));
+      const res = await requestJson(ctx, q(`${BASE14}/taxonomies`));
       return renderList(ctx, res.body, pickArray(res.body, "taxonomies"), ["name", "displayName"], "No taxonomies.");
     }
     case "create": {
@@ -21485,14 +21921,14 @@ async function taxonomies(ctx, sub, pos, o, project4, q) {
         projectId: project4
       });
       if (!body.name) return usage5(ctx, "taxonomies create --name <n> [--display-name d]");
-      const res = await requestJson(ctx, `${BASE13}/taxonomies`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE14}/taxonomies`, { method: "POST", body });
       return renderDone(ctx, res.body, `Created taxonomy ${res.body?.name ?? body.name}.`);
     }
     case "delete": {
       const name = pos[0];
       if (!name) return usage5(ctx, "taxonomies delete <taxonomy> --yes");
       confirm(o, `taxonomy ${name}`);
-      await requestJson(ctx, q(`${BASE13}/taxonomies/${enc2(name)}`), { method: "DELETE" });
+      await requestJson(ctx, q(`${BASE14}/taxonomies/${enc2(name)}`), { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted taxonomy ${name}.`);
       return 0;
     }
@@ -21503,7 +21939,7 @@ async function taxonomies(ctx, sub, pos, o, project4, q) {
 async function terms(ctx, sub, pos, o, project4, q) {
   const [tax, slug] = pos;
   if (!tax) return usage5(ctx, `terms ${sub} <taxonomy>`);
-  const coll = `${BASE13}/taxonomies/${enc2(tax)}/terms`;
+  const coll = `${BASE14}/taxonomies/${enc2(tax)}/terms`;
   switch (sub) {
     case "list": {
       const res = await requestJson(ctx, q(coll));
@@ -21555,7 +21991,7 @@ async function terms(ctx, sub, pos, o, project4, q) {
 async function relationships(ctx, sub, pos, o, project4, q) {
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, q(`${BASE13}/relationships`));
+      const res = await requestJson(ctx, q(`${BASE14}/relationships`));
       return renderList(ctx, res.body, pickArray(res.body, "relationships"), ["fromTypeName", "toTypeName", "cardinality", "onDelete"], "No relationships.");
     }
     case "create": {
@@ -21567,14 +22003,14 @@ async function relationships(ctx, sub, pos, o, project4, q) {
         projectId: project4
       });
       if (!body.fromTypeName || !body.toTypeName) return usage5(ctx, "relationships create --from <type> --to <type>");
-      const res = await requestJson(ctx, `${BASE13}/relationships`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE14}/relationships`, { method: "POST", body });
       return renderDone(ctx, res.body, `Created relationship ${body.fromTypeName} \u2192 ${body.toTypeName}.`);
     }
     case "delete": {
       const [from, to] = pos;
       if (!from || !to) return usage5(ctx, "relationships delete <fromType> <toType> --yes");
       confirm(o, `relationship ${from} \u2192 ${to}`);
-      await requestJson(ctx, q(`${BASE13}/relationships/${enc2(from)}/${enc2(to)}`), { method: "DELETE" });
+      await requestJson(ctx, q(`${BASE14}/relationships/${enc2(from)}/${enc2(to)}`), { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted relationship ${from} \u2192 ${to}.`);
       return 0;
     }
@@ -22162,7 +22598,7 @@ Run \`openwop production --help\` for usage.`);
 }
 
 // src/cli/tutorials.ts
-var BASE14 = "/v1/host/openwop-app/tutorials";
+var BASE15 = "/v1/host/openwop-app/tutorials";
 var TUTORIALS_HELP = `Usage:
   openwop tutorials list [--json]
   openwop tutorials get <slug> [--json]
@@ -22170,9 +22606,9 @@ var TUTORIALS_HELP = `Usage:
   openwop tutorials progress set <tutorialId> --steps <id,id,...> [--json]
   openwop tutorials progress clear <tutorialId> [--json]
 
-The tutorial library (GET ${BASE14}) and one tutorial in full (GET ${BASE14}/<slug>).
-\`progress\` reads YOUR saved steps (GET ${BASE14}/progress); \`progress set\` replaces a
-tutorial's completed steps and \`progress clear\` resets them (POST ${BASE14}/progress,
+The tutorial library (GET ${BASE15}) and one tutorial in full (GET ${BASE15}/<slug>).
+\`progress\` reads YOUR saved steps (GET ${BASE15}/progress); \`progress set\` replaces a
+tutorial's completed steps and \`progress clear\` resets them (POST ${BASE15}/progress,
 body { tutorialId, completedStepIds, mode? }). The server stamps the user \u2014 you can
 only write your own progress; anonymous sessions cannot save.
 
@@ -22196,7 +22632,7 @@ async function runTutorials(ctx, argv) {
   }
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, BASE14);
+      const res = await requestJson(ctx, BASE15);
       const items = Array.isArray(res.body?.tutorials) ? res.body.tutorials : [];
       const code = renderList(ctx, res.body, items, ["id", "category", "title", "source"], "No tutorials.");
       if (!ctx.json && res.body?.degraded) writeLine(ctx.io.stdout, "(shipped copy \u2014 the tenant library was unreachable)");
@@ -22208,13 +22644,13 @@ async function runTutorials(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop tutorials get <slug>\n");
         return 2;
       }
-      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE14}/${enc2(slug)}`)).body);
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE15}/${enc2(slug)}`)).body);
       return 0;
     }
     case "progress": {
       const action = positionals[0];
       if (!action) {
-        const res2 = await requestJson(ctx, `${BASE14}/progress`);
+        const res2 = await requestJson(ctx, `${BASE15}/progress`);
         const items = Array.isArray(res2.body?.progress) ? res2.body.progress : [];
         const code = renderList(
           ctx,
@@ -22237,7 +22673,7 @@ async function runTutorials(ctx, argv) {
         return 2;
       }
       const body = action === "set" ? { tutorialId, completedStepIds: csv(options.steps) ?? [] } : { tutorialId, completedStepIds: [], mode: "clear" };
-      const res = await requestJson(ctx, `${BASE14}/progress`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE15}/progress`, { method: "POST", body });
       return renderDone(ctx, res.body, action === "set" ? `Saved ${Array.isArray(res.body?.completedStepIds) ? res.body.completedStepIds.length : body.completedStepIds.length} completed step(s) for ${tutorialId}.` : `Cleared progress for ${tutorialId}.`);
     }
     default:
@@ -22247,16 +22683,16 @@ Run \`openwop tutorials --help\` for usage.`);
 }
 
 // src/cli/walkthroughs.ts
-var BASE15 = "/v1/host/openwop-app/walkthroughs";
+var BASE16 = "/v1/host/openwop-app/walkthroughs";
 var WALKTHROUGHS_HELP = `Usage:
   openwop walkthroughs progress [--json]
   openwop walkthroughs progress set <walkthroughId> --status started|completed --run <runId> [--json]
   openwop walkthroughs funnel <walkthroughId> [--json]
 
-\`progress\` reads your walkthrough progress (GET ${BASE15}/progress); \`progress set\`
-records one (POST ${BASE15}/progress, body { walkthroughId, status, runId }).
+\`progress\` reads your walkthrough progress (GET ${BASE16}/progress); \`progress set\`
+records one (POST ${BASE16}/progress, body { walkthroughId, status, runId }).
 \`funnel\` shows run-status counts + where runs stalled for one walkthrough
-(GET ${BASE15}/funnel?walkthroughId=\u2026) \u2014 a recent-window view over the newest runs.
+(GET ${BASE16}/funnel?walkthroughId=\u2026) \u2014 a recent-window view over the newest runs.
 
 Exit codes: 0 ok \xB7 2 usage / validation / feature off \xB7 4 forbidden.
 
@@ -22284,10 +22720,10 @@ async function runWalkthroughs(ctx, argv) {
           write(ctx.io.stderr, "Usage: openwop walkthroughs progress set <walkthroughId> --status started|completed --run <runId>\n");
           return 2;
         }
-        const res2 = await requestJson(ctx, `${BASE15}/progress`, { method: "POST", body: { walkthroughId, status: String(options.status), runId: String(options.run) } });
+        const res2 = await requestJson(ctx, `${BASE16}/progress`, { method: "POST", body: { walkthroughId, status: String(options.status), runId: String(options.run) } });
         return renderDone(ctx, res2.body, `Recorded ${walkthroughId} as ${String(options.status)}.`);
       }
-      const res = await requestJson(ctx, `${BASE15}/progress`);
+      const res = await requestJson(ctx, `${BASE16}/progress`);
       const items = Array.isArray(res.body?.progress) ? res.body.progress : [];
       return renderList(ctx, res.body, items, ["walkthroughId", "status", "runId", "updatedAt"], "No walkthrough progress.");
     }
@@ -22297,7 +22733,7 @@ async function runWalkthroughs(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop walkthroughs funnel <walkthroughId>\n");
         return 2;
       }
-      const res = await requestJson(ctx, withQuery(`${BASE15}/funnel`, { walkthroughId }));
+      const res = await requestJson(ctx, withQuery(`${BASE16}/funnel`, { walkthroughId }));
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -22318,7 +22754,7 @@ Run \`openwop walkthroughs --help\` for usage.`);
 }
 
 // src/cli/widgets.ts
-var BASE16 = "/v1/host/openwop-app/widgets";
+var BASE17 = "/v1/host/openwop-app/widgets";
 var WIDGETS_HELP = `Usage:
   openwop widgets list [--json]
   openwop widgets summary [--json]
@@ -22326,8 +22762,8 @@ var WIDGETS_HELP = `Usage:
   openwop widgets archive <widgetId> [--json]
   openwop widgets seed [--json]
 
-The reference example domain (GET/POST ${BASE16}, GET ${BASE16}/summary,
-POST ${BASE16}/<id>/archive, POST ${BASE16}/seed). Mounted only when the host sets
+The reference example domain (GET/POST ${BASE17}, GET ${BASE17}/summary,
+POST ${BASE17}/<id>/archive, POST ${BASE17}/seed). Mounted only when the host sets
 OPENWOP_EXAMPLE_WIDGETS_ENABLED=true. \`seed\` is idempotent (\`seeded: false\` on a
 re-run). Archiving an already-archived widget is a conflict (exit 2), never a
 silent success.
@@ -22353,12 +22789,12 @@ async function runWidgets(ctx, argv) {
   try {
     switch (sub) {
       case "list": {
-        const res = await requestJson(ctx, BASE16);
+        const res = await requestJson(ctx, BASE17);
         const items = Array.isArray(res.body?.widgets) ? res.body.widgets : [];
         return renderList(ctx, res.body, items, ["id", "name", "status"], "No widgets.");
       }
       case "summary": {
-        const res = await requestJson(ctx, `${BASE16}/summary`);
+        const res = await requestJson(ctx, `${BASE17}/summary`);
         if (ctx.json) {
           writeJson(ctx.io.stdout, res.body);
           return 0;
@@ -22372,7 +22808,7 @@ async function runWidgets(ctx, argv) {
           write(ctx.io.stderr, "widgets create needs --name.\n");
           return 2;
         }
-        const res = await requestJson(ctx, BASE16, { method: "POST", body: { name: String(options.name) } });
+        const res = await requestJson(ctx, BASE17, { method: "POST", body: { name: String(options.name) } });
         return renderDone(ctx, res.body, `Created widget ${res.body?.id ?? ""} (${String(options.name)}).`);
       }
       case "archive": {
@@ -22381,11 +22817,11 @@ async function runWidgets(ctx, argv) {
           write(ctx.io.stderr, "Usage: openwop widgets archive <widgetId>\n");
           return 2;
         }
-        const res = await requestJson(ctx, `${BASE16}/${enc2(id)}/archive`, { method: "POST", body: {} });
+        const res = await requestJson(ctx, `${BASE17}/${enc2(id)}/archive`, { method: "POST", body: {} });
         return renderDone(ctx, res.body, `Archived widget ${id}.`);
       }
       case "seed": {
-        const res = await requestJson(ctx, `${BASE16}/seed`, { method: "POST", body: {} });
+        const res = await requestJson(ctx, `${BASE17}/seed`, { method: "POST", body: {} });
         return renderDone(ctx, res.body, res.body?.seeded === false ? "Example widgets already seeded (no-op)." : "Seeded example widgets.");
       }
       default:
@@ -22405,17 +22841,17 @@ Run \`openwop widgets --help\` for usage.`);
 }
 
 // src/cli/uiState.ts
-var BASE17 = "/v1/host/openwop-app/ui-state";
+var BASE18 = "/v1/host/openwop-app/ui-state";
 var UI_STATE_HELP = `Usage:
   openwop ui-state list [--resource-type <t>] [--resource-id <id>] [--json]
   openwop ui-state get <resourceType> <resourceId> <key> [--json]
   openwop ui-state set <resourceType> <resourceId> <key> --value <json> [--json]
   openwop ui-state delete <resourceType> <resourceId> <key>
 
-\`list\` reads your rows (GET ${BASE17}?resourceType=&resourceId=); \`get\` filters one
-key from that list. \`set\` writes one key (PUT ${BASE17}, body { resourceType,
+\`list\` reads your rows (GET ${BASE18}?resourceType=&resourceId=); \`get\` filters one
+key from that list. \`set\` writes one key (PUT ${BASE18}, body { resourceType,
 resourceId, key, value }); --value is parsed as JSON, falling back to a string.
-\`delete\` removes one key (DELETE ${BASE17}/<type>/<id>/<key>).
+\`delete\` removes one key (DELETE ${BASE18}/<type>/<id>/<key>).
 
 Exit codes: 0 ok \xB7 2 usage / not found \xB7 4 forbidden.
 
@@ -22438,7 +22874,7 @@ async function runUiState(ctx, argv) {
   const [resourceType, resourceId, key] = positionals;
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, withQuery(BASE17, { resourceType: options.resourceType, resourceId: options.resourceId }));
+      const res = await requestJson(ctx, withQuery(BASE18, { resourceType: options.resourceType, resourceId: options.resourceId }));
       const items = Array.isArray(res.body?.items) ? res.body.items : [];
       return renderList(ctx, res.body, items, ["resourceType", "resourceId", "key", "value"], "No saved UI state.");
     }
@@ -22447,7 +22883,7 @@ async function runUiState(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop ui-state get <resourceType> <resourceId> <key>\n");
         return 2;
       }
-      const res = await requestJson(ctx, withQuery(BASE17, { resourceType, resourceId }));
+      const res = await requestJson(ctx, withQuery(BASE18, { resourceType, resourceId }));
       const items = Array.isArray(res.body?.items) ? res.body.items : [];
       const hit = items.find((i) => i?.key === key);
       if (!hit) throw new CliError(`No ui-state for ${resourceType}/${resourceId}/${key}.`, 2);
@@ -22466,7 +22902,7 @@ async function runUiState(ctx, argv) {
       } catch {
         value = String(options.value);
       }
-      const res = await requestJson(ctx, BASE17, { method: "PUT", body: { resourceType, resourceId, key, value } });
+      const res = await requestJson(ctx, BASE18, { method: "PUT", body: { resourceType, resourceId, key, value } });
       return renderDone(ctx, res.body, `Saved ${resourceType}/${resourceId}/${key}.`);
     }
     case "delete": {
@@ -22474,7 +22910,7 @@ async function runUiState(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop ui-state delete <resourceType> <resourceId> <key>\n");
         return 2;
       }
-      await requestJson(ctx, `${BASE17}/${enc2(resourceType)}/${enc2(resourceId)}/${enc2(key)}`, { method: "DELETE" });
+      await requestJson(ctx, `${BASE18}/${enc2(resourceType)}/${enc2(resourceId)}/${enc2(key)}`, { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted ${resourceType}/${resourceId}/${key}.`);
       return 0;
     }
@@ -22487,8 +22923,8 @@ Run \`openwop ui-state --help\` for usage.`);
 // src/cli/uiPlugin.ts
 import { writeFileSync as writeFileSync16 } from "node:fs";
 import { resolve as resolvePath11 } from "node:path";
-var BASE18 = "/v1/host/openwop-app/ui-plugin";
-var RPC_PRODUCT = `${BASE18}/rpc`;
+var BASE19 = "/v1/host/openwop-app/ui-plugin";
+var RPC_PRODUCT = `${BASE19}/rpc`;
 var RPC_CONFORMANCE = "/v1/host/sample/ui-plugin/rpc";
 var UI_PLUGIN_HELP = `Usage:
   openwop ui-plugin packs [--json]
@@ -22499,15 +22935,18 @@ var UI_PLUGIN_HELP = `Usage:
   openwop ui-plugin rpc --body <json> | --body-file <path>
 
 \`packs\` lists served plugins + the host's isolation mechanism + each plugin's tier
-(GET ${BASE18}/packs). \`entry\` fetches a plugin's sandboxed entry bundle
-(GET ${BASE18}/packs/<name>/plugins/<id>/entry); \`trusted-entry\` fetches a signed
-pack's main-frame ES module (GET ${BASE18}/trusted/<name>/plugins/<id>/entry.mjs \u2014
+(GET ${BASE19}/packs). \`entry\` fetches a plugin's sandboxed entry bundle
+(GET ${BASE19}/packs/<name>/plugins/<id>/entry); \`trusted-entry\` fetches a signed
+pack's main-frame ES module (GET ${BASE19}/trusted/<name>/plugins/<id>/entry.mjs \u2014
 404 unless the trusted-plugins toggle is on and the signature verifies).
-\`demo-artifact\` ensures the idempotent demo artifact (POST ${BASE18}/demo-artifact).
+\`demo-artifact\` ensures the idempotent demo artifact (POST ${BASE19}/demo-artifact).
 \`rpc\` sends one ui-plugin/1 request (POST ${RPC_PRODUCT}, body { message }); the
 message is { openwop: "ui-plugin/1", type: "request", id (integer,
 default 1), method, params } unless you pass a
-whole body with --body/--body-file.
+whole body with --body/--body-file. --conformance-alias posts to the test-seam
+alias ${RPC_CONFORMANCE} instead; that seam has no v2 equivalent (the v2
+seams profile, api/seams-v2.yaml, defines no ui-plugin operation), so it is
+always sent as the v1 path, on either protocol major.
 
 Exit codes: 0 ok \xB7 2 usage / not found / rejected request \xB7 4 forbidden.
 
@@ -22541,7 +22980,7 @@ async function runUiPlugin(ctx, argv) {
   }
   switch (sub) {
     case "packs": {
-      const res = await requestJson(ctx, `${BASE18}/packs`);
+      const res = await requestJson(ctx, `${BASE19}/packs`);
       const items = Array.isArray(res.body?.plugins) ? res.body.plugins : [];
       const code = renderList(ctx, res.body, items, ["packName", "pluginId", "tier"], "No UI plugins served.");
       if (!ctx.json && res.body?.isolation !== void 0) writeLine(ctx.io.stdout, `isolation: ${typeof res.body.isolation === "string" ? res.body.isolation : JSON.stringify(res.body.isolation)}`);
@@ -22555,7 +22994,7 @@ async function runUiPlugin(ctx, argv) {
 `);
         return 2;
       }
-      const path = sub === "entry" ? `${BASE18}/packs/${enc2(name)}/plugins/${enc2(pluginId)}/entry` : `${BASE18}/trusted/${enc2(name)}/plugins/${enc2(pluginId)}/entry.mjs`;
+      const path = sub === "entry" ? `${BASE19}/packs/${enc2(name)}/plugins/${enc2(pluginId)}/entry` : `${BASE19}/trusted/${enc2(name)}/plugins/${enc2(pluginId)}/entry.mjs`;
       const res = await fetchRawText(ctx, path);
       if (options.output) {
         writeFileSync16(resolvePath11(ctx.cwd, String(options.output)), res.text);
@@ -22567,7 +23006,7 @@ async function runUiPlugin(ctx, argv) {
       return 0;
     }
     case "demo-artifact": {
-      const res = await requestJson(ctx, `${BASE18}/demo-artifact`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE19}/demo-artifact`, { method: "POST", body: {} });
       return renderDone(ctx, res.body, `Demo artifact ${res.body?.artifactId ?? ""} (version ${res.body?.version ?? ""}).`);
     }
     case "rpc": {
@@ -22597,18 +23036,18 @@ Run \`openwop ui-plugin --help\` for usage.`);
 }
 
 // src/cli/canvasCollab.ts
-var BASE19 = "/v1/host/openwop-app/canvas-collab";
+var BASE20 = "/v1/host/openwop-app/canvas-collab";
 var CANVAS_COLLAB_HELP = `Usage:
   openwop canvas-collab ticket <canvasId> [--json]
   openwop canvas-collab claim-seed <canvasId> [--json]
   openwop canvas-collab debug [--json]
 
 \`ticket\` mints a short-lived collaboration ticket for one canvas
-(POST ${BASE19}/<canvasId>/ticket) \u2014 a credential for the collaboration socket's
+(POST ${BASE20}/<canvasId>/ticket) \u2014 a credential for the collaboration socket's
 ?ticket= parameter; it is printed once and never stored. \`claim-seed\` runs the
-seeder election (POST ${BASE19}/<canvasId>/claim-seed) \u2192 { seed: true } for the one
+seeder election (POST ${BASE20}/<canvasId>/claim-seed) \u2192 { seed: true } for the one
 caller that should seed a fresh room. \`debug\` lists this server instance's live
-rooms (GET ${BASE19}/_debug; super-admin only; lifecycle metadata, never content).
+rooms (GET ${BASE20}/_debug; super-admin only; lifecycle metadata, never content).
 
 Exit codes: 0 ok \xB7 2 usage / not found (uniform) \xB7 4 forbidden (debug without super-admin).
 
@@ -22642,7 +23081,7 @@ async function runCanvasCollab(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop canvas-collab ticket <canvasId>\n");
         return 2;
       }
-      const res = await requestJson(ctx, `${BASE19}/${enc2(id)}/ticket`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/ticket`, { method: "POST", body: {} });
       return printTicketOnce(ctx, res.body, `canvas ${id}`);
     }
     case "claim-seed": {
@@ -22650,13 +23089,13 @@ async function runCanvasCollab(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop canvas-collab claim-seed <canvasId>\n");
         return 2;
       }
-      const res = await requestJson(ctx, `${BASE19}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
       if (ctx.json) writeJson(ctx.io.stdout, res.body);
       else writeLine(ctx.io.stdout, res.body?.seed ? `You won the seed election for ${id} \u2014 seed the room.` : `Another client seeds ${id} (seed: false).`);
       return 0;
     }
     case "debug": {
-      const res = await requestJson(ctx, `${BASE19}/_debug`);
+      const res = await requestJson(ctx, `${BASE20}/_debug`);
       const items = Array.isArray(res.body?.instanceRooms) ? res.body.instanceRooms : [];
       return renderList(ctx, res.body, items, ["roomId", "tenantId", "clients", "openedAt"], "No live collaboration rooms on this instance.");
     }
@@ -22667,14 +23106,14 @@ Run \`openwop canvas-collab --help\` for usage.`);
 }
 
 // src/cli/workflowCollab.ts
-var BASE20 = "/v1/host/openwop-app/workflow-collab";
+var BASE21 = "/v1/host/openwop-app/workflow-collab";
 var WORKFLOW_COLLAB_HELP = `Usage:
   openwop workflow-collab ticket <workflowId> [--json]
   openwop workflow-collab claim-seed <workflowId> [--json]
 
 \`ticket\` mints a short-lived collaboration ticket for one workflow draft
-(POST ${BASE20}/<workflowId>/ticket) \u2014 shown once, never stored. \`claim-seed\` runs
-the seeder election (POST ${BASE20}/<workflowId>/claim-seed) \u2192 { seed }.
+(POST ${BASE21}/<workflowId>/ticket) \u2014 shown once, never stored. \`claim-seed\` runs
+the seeder election (POST ${BASE21}/<workflowId>/claim-seed) \u2192 { seed }.
 
 Exit codes: 0 ok \xB7 2 usage / not found / feature off \xB7 4 forbidden.
 
@@ -22701,11 +23140,11 @@ async function runWorkflowCollab(ctx, argv) {
   }
   switch (sub) {
     case "ticket": {
-      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/ticket`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE21}/${enc2(id)}/ticket`, { method: "POST", body: {} });
       return printTicketOnce(ctx, res.body, `workflow ${id}`);
     }
     case "claim-seed": {
-      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE21}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
       if (ctx.json) writeJson(ctx.io.stdout, res.body);
       else writeLine(ctx.io.stdout, res.body?.seed ? `You won the seed election for ${id} \u2014 seed the room.` : `Another client seeds ${id} (seed: false).`);
       return 0;
@@ -22749,7 +23188,7 @@ Run \`openwop canvas-packs --help\` for usage.`);
 }
 
 // src/cli/present.ts
-var BASE21 = "/v1/host/openwop-app/present";
+var BASE22 = "/v1/host/openwop-app/present";
 var ACTIONS = ["next", "prev", "goto", "blank"];
 var PRESENT_HELP = `Usage:
   openwop present outline <token> [--json]
@@ -22759,11 +23198,11 @@ var PRESENT_HELP = `Usage:
   openwop present events <token> [--max <n>] [--timeout <seconds>] [--json]
 
 Drive a live presentation with its remote token (no API key \u2014 the token is the
-credential). \`outline\` reads { title, frames, current? } (GET ${BASE21}/<token>/outline).
-\`command\` sends a navigation command (POST ${BASE21}/<token>/command, body
+credential). \`outline\` reads { title, frames, current? } (GET ${BASE22}/<token>/outline).
+\`command\` sends a navigation command (POST ${BASE22}/<token>/command, body
 { action, index? }). \`state\` reports the presenter's current frame
-(POST ${BASE21}/<token>/state, body { current }). \`events\` follows the navigation
-feed (GET ${BASE21}/<token>/events, server-sent events) \u2014 one line per event, or one
+(POST ${BASE22}/<token>/state, body { current }). \`events\` follows the navigation
+feed (GET ${BASE22}/<token>/events, server-sent events) \u2014 one line per event, or one
 JSON object per line with --json; stops after --max events or --timeout seconds.
 
 Exit codes: 0 ok \xB7 2 usage / unknown or expired session.
@@ -22790,7 +23229,7 @@ async function runPresent(ctx, argv) {
 `);
     return 2;
   }
-  const base16 = `${BASE21}/${enc2(token)}`;
+  const base16 = `${BASE22}/${enc2(token)}`;
   switch (sub) {
     case "outline": {
       const res = await requestJson(ctx, `${base16}/outline`, { auth: false });
@@ -23798,8 +24237,8 @@ async function runCampaignBrief(ctx, argv) {
 }
 
 // src/cli/campaignConnectors.ts
-var BASE22 = `${APP}/campaign-connectors`;
-var orgBase2 = (org2) => `${BASE22}/orgs/${enc2(org2)}`;
+var BASE23 = `${APP}/campaign-connectors`;
+var orgBase2 = (org2) => `${BASE23}/orgs/${enc2(org2)}`;
 var CAMPAIGN_CONNECTORS_HELP = `Usage:
   openwop campaign-connectors platforms [--json]
   openwop campaign-connectors sync --org <orgId> --platform meta|google [--json]
@@ -23848,7 +24287,7 @@ var TABLE2 = {
     usage: "platforms [--json]",
     args: 0,
     run: async (ctx) => {
-      const body = (await requestJson(ctx, `${BASE22}/platforms`)).body;
+      const body = (await requestJson(ctx, `${BASE23}/platforms`)).body;
       if (ctx.json) {
         writeJson(ctx.io.stdout, body);
         return 0;
@@ -23865,7 +24304,7 @@ var TABLE2 = {
     requires: ["platform"],
     run: async (ctx, a) => {
       const req2 = assign({ ...a.body }, { orgId: orgOf(a), platform: a.options.platform });
-      const body = (await requestJson(ctx, `${BASE22}/sync`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE23}/sync`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Sync ${body?.outcome ?? "done"}${body?.imported !== void 0 ? ` (${body.imported} imported)` : ""}.`);
     }
   },
@@ -23878,7 +24317,7 @@ var TABLE2 = {
     run: async (ctx, a) => {
       const o = a.options;
       const req2 = assign({ ...a.body }, { orgId: orgOf(a), segmentId: o.segment, adAccountId: o.adAccount, platform: o.platform, audienceName: o.audienceName });
-      const body = (await requestJson(ctx, `${BASE22}/audience-sync`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE23}/audience-sync`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Audience sync: ${body?.outcome ?? "done"}.`);
     }
   },
@@ -23901,7 +24340,7 @@ var TABLE2 = {
         writeLine(ctx.io.stderr, "openwop: missing --csv-file");
         return 2;
       }
-      const body = (await requestJson(ctx, `${BASE22}/import`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE23}/import`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Imported ${body?.imported ?? 0} rows (${body?.deduped ?? 0} deduped, ${Array.isArray(body?.invalid) ? body.invalid.length : body?.invalid ?? 0} invalid).`);
     }
   },
@@ -23911,7 +24350,7 @@ var TABLE2 = {
     value: ["--org", "--campaign"],
     run: async (ctx, a) => listOut(
       ctx,
-      (await requestJson(ctx, `${BASE22}/records${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body,
+      (await requestJson(ctx, `${BASE23}/records${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body,
       "records",
       ["date", "platform", "campaignId", "impressions", "clicks", "spend", "conversions"],
       "No performance records."
@@ -23921,7 +24360,7 @@ var TABLE2 = {
     usage: "kpi --org <orgId> [--campaign <id>] [--json]",
     args: 0,
     value: ["--org", "--campaign"],
-    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE22}/kpi${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body)
+    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE23}/kpi${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body)
   },
   "sync-status": {
     usage: "sync-status --org <orgId> [--json]",
@@ -24043,7 +24482,7 @@ async function runCampaignConnectors(ctx, argv) {
 }
 
 // src/cli/campaignIntel.ts
-var BASE23 = `${APP}/campaign-intel`;
+var BASE24 = `${APP}/campaign-intel`;
 var CAMPAIGN_INTEL_HELP = `Usage:
   openwop campaign-intel budget --org <orgId> [--campaign <id>] [--json]
   openwop campaign-intel forecast --org <orgId> [--campaign <id>] [--json]
@@ -24082,7 +24521,7 @@ var read = (name, withCampaign) => ({
   args: 0,
   value: ["--org", ...withCampaign ? ["--campaign"] : []],
   run: async (ctx, a) => {
-    const body = (await requestJson(ctx, `${BASE23}/${name}${qs({ orgId: orgOf2(a), campaignId: withCampaign ? a.options.campaign : void 0 })}`)).body;
+    const body = (await requestJson(ctx, `${BASE24}/${name}${qs({ orgId: orgOf2(a), campaignId: withCampaign ? a.options.campaign : void 0 })}`)).body;
     if (name === "anomalies") return listOut(ctx, body, "anomalies", ["date", "platform", "campaignId", "metric", "severity", "message"], "No anomalies.");
     if (name === "forecast") return listOut(ctx, body, "forecasts", ["campaignId", "platform", "horizonDays", "projectedSpend", "projectedConversions"], "No forecasts (no performance records).");
     return detail(ctx, body);
@@ -24117,7 +24556,7 @@ var TABLE3 = {
           return 2;
         }
       }
-      return detail(ctx, (await requestJson(ctx, `${BASE23}/plan-budget`, { method: "POST", body: req2 })).body);
+      return detail(ctx, (await requestJson(ctx, `${BASE24}/plan-budget`, { method: "POST", body: req2 })).body);
     }
   },
   apply: {
@@ -24142,7 +24581,7 @@ var TABLE3 = {
         dailyBudgetMinor: o.dailyBudgetMinor !== void 0 ? num(o.dailyBudgetMinor, "--daily-budget-minor") : void 0,
         dryRun: dryRun ? true : void 0
       });
-      const body = (await requestJson(ctx, `${BASE23}/recommendations/apply`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE24}/recommendations/apply`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Budget ${dryRun ? "preview" : "update"}: ${body?.outcome ?? "done"}.`);
     }
   }
@@ -24202,7 +24641,7 @@ async function runCampaignJourneys(ctx, argv) {
 }
 
 // src/cli/cdp.ts
-var BASE24 = `${APP}/cdp`;
+var BASE25 = `${APP}/cdp`;
 var CDP_HELP = `Usage:
   openwop cdp resolve --type <identifierType> --value <v> [--json]
   openwop cdp schemas list [--json]
@@ -24249,7 +24688,7 @@ var limited = (path, key, columns, empty) => ({
   usage: `${path === "governance-decisions" ? "governance" : path === "collected-events" ? "events" : path} [--limit <n>] [--json]`,
   args: 0,
   value: ["--limit"],
-  run: async (ctx, a) => listOut(ctx, (await requestJson(ctx, `${BASE24}/${path}${qs({ limit: a.options.limit })}`)).body, key, columns, empty)
+  run: async (ctx, a) => listOut(ctx, (await requestJson(ctx, `${BASE25}/${path}${qs({ limit: a.options.limit })}`)).body, key, columns, empty)
 });
 var TABLE5 = {
   resolve: {
@@ -24257,7 +24696,7 @@ var TABLE5 = {
     args: 0,
     value: ["--type", "--value"],
     requires: ["type", "value"],
-    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE24}/identity/resolve${qs({ type: a.options.type, value: a.options.value })}`)).body)
+    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE25}/identity/resolve${qs({ type: a.options.type, value: a.options.value })}`)).body)
   },
   collect: {
     usage: "collect --event-type <t> [--payload-json '{...}'] [--dedupe-key <k>] [--json]",
@@ -24272,7 +24711,7 @@ var TABLE5 = {
         payload: o.payloadJson !== void 0 ? parseJsonFlag2(o.payloadJson, "--payload-json") : void 0,
         dedupeKey: o.dedupeKey
       });
-      const body = (await requestJson(ctx, `${BASE24}/collect`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE25}/collect`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Collected ${req2.eventType} event ${body?.eventId ?? body?.event?.eventId ?? ""}${body?.deduped ? " (deduplicated)" : ""}.`);
     }
   },
@@ -24287,7 +24726,7 @@ var TABLE5 = {
         writeLine(ctx.io.stderr, "openwop: missing --events-json or --events-file");
         return 2;
       }
-      return detail(ctx, (await requestJson(ctx, `${BASE24}/collect/batch`, { method: "POST", body: req2 })).body);
+      return detail(ctx, (await requestJson(ctx, `${BASE25}/collect/batch`, { method: "POST", body: req2 })).body);
     }
   },
   import: {
@@ -24307,7 +24746,7 @@ var TABLE5 = {
         writeLine(ctx.io.stderr, "openwop: missing --csv-file");
         return 2;
       }
-      return detail(ctx, (await requestJson(ctx, `${BASE24}/collect/import`, { method: "POST", body: req2 })).body);
+      return detail(ctx, (await requestJson(ctx, `${BASE25}/collect/import`, { method: "POST", body: req2 })).body);
     }
   },
   events: limited("collected-events", "events", ["eventId", "eventType", ["at", (e) => e.at ?? e.receivedAt ?? e.createdAt], "dedupeKey"], "No collected events."),
@@ -24317,7 +24756,7 @@ var TABLE5 = {
     usage: "audit-verify [--json]",
     args: 0,
     run: async (ctx) => {
-      const body = (await requestJson(ctx, `${BASE24}/audit-chain/verify`)).body;
+      const body = (await requestJson(ctx, `${BASE25}/audit-chain/verify`)).body;
       if (ctx.json) {
         writeJson(ctx.io.stdout, body);
         return body?.valid === false || body?.ok === false ? 1 : 0;
@@ -24335,7 +24774,7 @@ var SCHEMAS = {
     args: 0,
     run: async (ctx) => listOut(
       ctx,
-      (await requestJson(ctx, `${BASE24}/event-schemas`)).body,
+      (await requestJson(ctx, `${BASE25}/event-schemas`)).body,
       "schemas",
       ["eventType", "version", ["updatedAt", (s) => s.updatedAt ?? s.registeredAt ?? s.createdAt]],
       "No event schemas registered."
@@ -24356,7 +24795,7 @@ var SCHEMAS = {
         writeLine(ctx.io.stderr, "openwop: missing --schema-json or --schema-file");
         return 2;
       }
-      const body = (await requestJson(ctx, `${BASE24}/event-schemas`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE25}/event-schemas`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Registered the ${req2.eventType} event schema${body?.version !== void 0 ? ` (version ${body.version})` : ""}.`);
     }
   },
@@ -24369,7 +24808,7 @@ var SCHEMAS = {
       const req2 = assign({ ...a.body }, { payload: jsonFrom(ctx, a.options.payloadJson, a.options.payloadFile, "--payload-json", "--payload-file") });
       let body;
       try {
-        body = (await requestJson(ctx, `${BASE24}/event-schemas/${enc2(a.positionals[0])}/validate`, { method: "POST", body: req2 })).body;
+        body = (await requestJson(ctx, `${BASE25}/event-schemas/${enc2(a.positionals[0])}/validate`, { method: "POST", body: req2 })).body;
       } catch (err) {
         if (!(err instanceof HttpError) || err.status !== 422) throw err;
         body = err.body;
@@ -24393,7 +24832,7 @@ async function runCdp(ctx, argv) {
 }
 
 // src/cli/destinationSync.ts
-var BASE25 = `${APP}/destination-sync/syncs`;
+var BASE26 = `${APP}/destination-sync/syncs`;
 var DESTINATION_SYNC_HELP = `Usage:
   openwop destination-sync list [--json]
   openwop destination-sync get <syncId> [--json]
@@ -24427,14 +24866,14 @@ function jsonFrom2(ctx, inline, file, inlineFlag, fileFlag) {
   if (file !== void 0) return parseJsonFlag2(readText(ctx, String(file), fileFlag), fileFlag);
   return void 0;
 }
-var item = (id) => `${BASE25}/${enc2(id)}`;
+var item = (id) => `${BASE26}/${enc2(id)}`;
 var TABLE6 = {
   list: {
     usage: "list [--json]",
     args: 0,
     run: async (ctx) => listOut(
       ctx,
-      (await requestJson(ctx, BASE25)).body,
+      (await requestJson(ctx, BASE26)).body,
       "syncs",
       [["id", (s) => s.id ?? s.syncId], "name", "destinationKind", "sourceObject", "syncMode", "cursor"],
       "No destination syncs."
@@ -24462,7 +24901,7 @@ var TABLE6 = {
         cursorField: o.cursorField,
         connectionId: o.connection
       });
-      const body = (await requestJson(ctx, BASE25, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, BASE26, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Created destination sync ${body?.id ?? body?.syncId ?? ""} (${req2.name}).`);
     }
   },
@@ -25292,7 +25731,7 @@ async function runPublic(ctx, argv) {
 }
 
 // src/cli/vault.ts
-var BASE26 = "/v1/host/openwop-app/vault";
+var BASE27 = "/v1/host/openwop-app/vault";
 var SURFACE2 = "The secrets vault";
 var VAULT_HELP = `Usage:
   openwop vault list [--json]
@@ -25304,10 +25743,10 @@ The super-admin secrets vault (host extension). Every route is SUPER-ADMIN gated
 without a super-admin principal the command fails closed with exit 4 and says how to
 get one (OPENWOP_SUPERADMIN_TENANTS on the server).
 
-  list     GET    ${BASE26}                                  inventory of refs (never values)
-  set      POST   ${BASE26}/secrets                          store a new secret under a ref
-  rotate   POST   ${BASE26}/secrets/:credentialRef/rotate    overwrite an EXISTING secret
-  delete   DELETE ${BASE26}/secrets/:credentialRef           remove (refused while the ref has live consumers unless --force)
+  list     GET    ${BASE27}                                  inventory of refs (never values)
+  set      POST   ${BASE27}/secrets                          store a new secret under a ref
+  rotate   POST   ${BASE27}/secrets/:credentialRef/rotate    overwrite an EXISTING secret
+  delete   DELETE ${BASE27}/secrets/:credentialRef           remove (refused while the ref has live consumers unless --force)
 
 SECRETS ARE REFS, NEVER VALUES. The value for set/rotate is read from --value-file or a
 no-echo prompt (a piped line also works) \u2014 never from a command-line flag. The host's
@@ -25363,7 +25802,7 @@ async function vaultList(ctx, argv) {
     write(ctx.io.stdout, VAULT_HELP);
     return 0;
   }
-  const res = await gatedRequest(ctx, BASE26, void 0, SURFACE2, "superadmin");
+  const res = await gatedRequest(ctx, BASE27, void 0, SURFACE2, "superadmin");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -25394,7 +25833,7 @@ async function vaultWrite(ctx, argv, verb) {
   const scope = scopeOf(options);
   const value = await readSecretInput(ctx, options, `Secret value for "${ref}"`);
   const body = { value, ...scope === "host" ? { scope: "host" } : {} };
-  const path = verb === "set" ? `${BASE26}/secrets` : `${BASE26}/secrets/${encodeURIComponent(ref)}/rotate`;
+  const path = verb === "set" ? `${BASE27}/secrets` : `${BASE27}/secrets/${encodeURIComponent(ref)}/rotate`;
   if (verb === "set") body.credentialRef = ref;
   const res = await gatedRequest(ctx, path, { method: "POST", body }, SURFACE2, "superadmin");
   if (ctx.json) {
@@ -25418,7 +25857,7 @@ async function vaultDelete(ctx, argv) {
   if (scopeOf(options) === "host") qs2.set("scope", "host");
   if (options.force) qs2.set("force", "true");
   const q = qs2.toString() ? `?${qs2}` : "";
-  const res = await gatedRequest(ctx, `${BASE26}/secrets/${encodeURIComponent(positionals[0])}${q}`, { method: "DELETE" }, SURFACE2, "superadmin");
+  const res = await gatedRequest(ctx, `${BASE27}/secrets/${encodeURIComponent(positionals[0])}${q}`, { method: "DELETE" }, SURFACE2, "superadmin");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -25428,27 +25867,40 @@ async function vaultDelete(ctx, argv) {
 }
 
 // src/cli/developerKeys.ts
-var BASE27 = "/v1/host/openwop-app/developer-keys";
+var BASE28 = "/v1/host/openwop-app/developer-keys";
 var SURFACE3 = "Managing developer API keys";
 var DEVELOPER_KEYS_HELP = `Usage:
   openwop developer-keys list [--json]
   openwop developer-keys create --name <n> [--scope <s>]... [--expires-at <iso>] [--json]
   openwop developer-keys revoke <keyId> --yes [--json]
 
-Developer API keys for this workspace (host extension under ${BASE27}). Requires an
+Developer API keys for this workspace (host extension under ${BASE28}). Requires an
 authenticated principal (not an anonymous session); an admin or owner sees and can
 revoke every key in the workspace, anyone else only their own.
 
-  list     GET    ${BASE27}          keys (public fields only \u2014 never the token or its hash)
-  create   POST   ${BASE27}          issue a key; the token is shown ONCE
-  revoke   DELETE ${BASE27}/:keyId   revoke (404 when the key is not yours / not in this workspace)
+  list     GET    ${BASE28}          keys (public fields only \u2014 never the token or its hash)
+  create   POST   ${BASE28}          issue a key; the token is shown ONCE
+  revoke   DELETE ${BASE28}/:keyId   revoke (404 when the key is not yours / not in this workspace)
 
 ONE-TIME SECRET: \`create\` prints the new token exactly once, on stdout, with a warning.
 Store it immediately \u2014 the host keeps only a hash and cannot show it again. The CLI does
 not save it anywhere.
 
+A KEY CANNOT MANAGE KEYS: openwop-app refuses \`list\`, \`create\` and \`revoke\` (403)
+when the CLI is itself signed in with a developer key (owk_\u2026). Create and revoke keys
+in the app (Access \u2192 API keys), or sign in with an operator key.
+
+SCOPES ARE REQUIRED AND NARROW: openwop-app refuses a key with no --scope, and a key is
+limited to exactly the scopes it declares. To start a run and read it back a key needs
+runs:create AND runs:read; reaching the rest of the workspace (agents, memory, BYOK)
+needs workspace:read / workspace:write. \`--scope '*'\` is a key with your full authority.
+A scope the host does not know is refused by name.
+
+EXPIRY: openwop-app gives a key 90 days unless --expires-at says otherwise, and refuses
+an expiry in the past or more than its maximum (366 days by default) away.
+
   --name <n>          (create) Display name. Required.
-  --scope <s>         (create) Scope granted to the key (repeatable).
+  --scope <s>         (create) Scope granted to the key (repeatable; at least one).
   --expires-at <iso>  (create) Expiry timestamp.
   --yes               (revoke) Required confirmation.
 
@@ -25456,7 +25908,7 @@ Exit codes: 0 ok \xB7 2 usage / not found \xB7 4 not signed in.
 
 Examples:
   openwop developer-keys list
-  openwop developer-keys create --name "CI deploy" --scope runs:write
+  openwop developer-keys create --name "CI deploy" --scope runs:create --scope runs:read
   openwop developer-keys revoke dk:0123abcd --yes
 `;
 async function runDeveloperKeys(ctx, argv) {
@@ -25485,7 +25937,7 @@ async function keysList(ctx, argv) {
     write(ctx.io.stdout, DEVELOPER_KEYS_HELP);
     return 0;
   }
-  const res = await gatedRequest(ctx, BASE27, void 0, SURFACE3, "signed-in");
+  const res = await gatedRequest(ctx, BASE28, void 0, SURFACE3, "signed-in");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -25514,7 +25966,7 @@ async function keysCreate(ctx, argv) {
   const body = { name: options.name };
   if (Array.isArray(options.scope) && options.scope.length) body.scopes = options.scope;
   if (options.expiresAt) body.expiresAt = options.expiresAt;
-  const res = await gatedRequest(ctx, BASE27, { method: "POST", body }, SURFACE3, "signed-in");
+  const res = await gatedRequest(ctx, BASE28, { method: "POST", body }, SURFACE3, "signed-in");
   writeLine(ctx.io.stderr, "WARNING: this token is shown ONCE. Store it now \u2014 it cannot be retrieved again.");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -25535,7 +25987,7 @@ async function keysRevoke(ctx, argv) {
     writeLine(ctx.io.stderr, `Refusing to revoke ${positionals[0]} without --yes.`);
     return 2;
   }
-  await gatedRequest(ctx, `${BASE27}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, SURFACE3, "signed-in");
+  await gatedRequest(ctx, `${BASE28}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, SURFACE3, "signed-in");
   if (ctx.json) {
     writeJson(ctx.io.stdout, { keyId: positionals[0], revoked: true });
     return 0;
@@ -25604,44 +26056,44 @@ Run \`openwop custom-domains --help\` for usage.`);
     })), ["hostname", "status", "verifiedAt", "lastError"]));
     return 0;
   }
-  const hostname = positionals[0];
-  if (!hostname) throw new CliError(`Usage: openwop custom-domains ${sub} <hostname> --org <orgId>`, 2);
+  const hostname2 = positionals[0];
+  if (!hostname2) throw new CliError(`Usage: openwop custom-domains ${sub} <hostname> --org <orgId>`, 2);
   if (sub === "add") {
-    const res2 = await requestJson(ctx, base14(orgId), { method: "POST", body: { hostname } });
+    const res2 = await requestJson(ctx, base14(orgId), { method: "POST", body: { hostname: hostname2 } });
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
     }
     const d = res2.body?.domain ?? {};
-    writeLine(ctx.io.stdout, `Added ${d.hostname ?? hostname} (status ${d.status ?? "pending"}).`);
-    writeLine(ctx.io.stdout, `Publish TXT _openwop-verify.${d.hostname ?? hostname} = ${d.verificationToken ?? "(see --json)"} then run \`openwop custom-domains verify ${d.hostname ?? hostname} --org ${orgId}\`.`);
+    writeLine(ctx.io.stdout, `Added ${d.hostname ?? hostname2} (status ${d.status ?? "pending"}).`);
+    writeLine(ctx.io.stdout, `Publish TXT _openwop-verify.${d.hostname ?? hostname2} = ${d.verificationToken ?? "(see --json)"} then run \`openwop custom-domains verify ${d.hostname ?? hostname2} --org ${orgId}\`.`);
     return 0;
   }
   if (sub === "verify") {
-    const res2 = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname)}/verify`, { method: "POST", body: {} });
+    const res2 = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname2)}/verify`, { method: "POST", body: {} });
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
     }
     const d = res2.body?.domain ?? {};
-    writeLine(ctx.io.stdout, `${d.hostname ?? hostname}: ${d.status ?? "?"}${d.lastError ? ` \u2014 ${d.lastError}` : ""}`);
+    writeLine(ctx.io.stdout, `${d.hostname ?? hostname2}: ${d.status ?? "?"}${d.lastError ? ` \u2014 ${d.lastError}` : ""}`);
     return d.status === "live" ? 0 : 3;
   }
   if (!options.yes) {
-    writeLine(ctx.io.stderr, `Refusing to remove ${hostname} without --yes.`);
+    writeLine(ctx.io.stderr, `Refusing to remove ${hostname2} without --yes.`);
     return 2;
   }
-  const res = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname)}`, { method: "DELETE" });
+  const res = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname2)}`, { method: "DELETE" });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
   }
-  writeLine(ctx.io.stdout, `Removed ${hostname}.`);
+  writeLine(ctx.io.stdout, `Removed ${hostname2}.`);
   return 0;
 }
 
 // src/cli/environments.ts
-var BASE28 = "/v1/host/openwop-app/environments";
+var BASE29 = "/v1/host/openwop-app/environments";
 var PROTECTION = ["open", "protected", "locked"];
 var ENVIRONMENTS_HELP = `Usage:
   openwop environments list [--drift] [--json]
@@ -25658,21 +26110,21 @@ var ENVIRONMENTS_HELP = `Usage:
   openwop environments apply --snapshot <hash> [--json]
   openwop environments promotions [--json]
 
-Config environments + promotion (host extension under ${BASE28}; toggle 'environments').
+Config environments + promotion (host extension under ${BASE29}; toggle 'environments').
 Reads need workspace:read; every write needs host:members:manage in the workspace.
 
-  list          GET   ${BASE28}[?drift=1]          environments, config domains, app version
-  create        POST  ${BASE28}                    add an environment to the chain
-  ensure-chain  POST  ${BASE28}/ensure-chain       create the default dev \u2192 staging \u2192 prod chain
-  protect       PATCH ${BASE28}/:name/protection   set open | protected | locked
-  settings      GET/PATCH ${BASE28}/settings       the promotion-approval gate
-  snapshots     GET   ${BASE28}/snapshots          stored config snapshots
-  snapshot      POST  ${BASE28}/snapshots          snapshot the current live config
-  preview       POST  ${BASE28}/preview            diff a snapshot against an environment (no change)
-  promote       POST  ${BASE28}/promote            promote an env's snapshot to the next (or --to) env
-  rollback      POST  ${BASE28}/rollback           point an env back at a historical snapshot
-  apply         POST  ${BASE28}/apply              apply a snapshot to the live config
-  promotions    GET   ${BASE28}/promotions         the promotion ledger
+  list          GET   ${BASE29}[?drift=1]          environments, config domains, app version
+  create        POST  ${BASE29}                    add an environment to the chain
+  ensure-chain  POST  ${BASE29}/ensure-chain       create the default dev \u2192 staging \u2192 prod chain
+  protect       PATCH ${BASE29}/:name/protection   set open | protected | locked
+  settings      GET/PATCH ${BASE29}/settings       the promotion-approval gate
+  snapshots     GET   ${BASE29}/snapshots          stored config snapshots
+  snapshot      POST  ${BASE29}/snapshots          snapshot the current live config
+  preview       POST  ${BASE29}/preview            diff a snapshot against an environment (no change)
+  promote       POST  ${BASE29}/promote            promote an env's snapshot to the next (or --to) env
+  rollback      POST  ${BASE29}/rollback           point an env back at a historical snapshot
+  apply         POST  ${BASE29}/apply              apply a snapshot to the live config
+  promotions    GET   ${BASE29}/promotions         the promotion ledger
 
 Exit codes: 0 ok \xB7 3 queued for approval (202 pending_approval) \xB7 2 usage / not found /
 feature off \xB7 4 permission denied.
@@ -25705,7 +26157,7 @@ async function runEnvironments(ctx, argv) {
   };
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, `${BASE28}${options.drift ? "?drift=1" : ""}`);
+      const res = await requestJson(ctx, `${BASE29}${options.drift ? "?drift=1" : ""}`);
       emit2(res.body, () => {
         const envs = arrayOf(res.body, "environments");
         if (envs.length === 0) {
@@ -25732,35 +26184,35 @@ async function runEnvironments(ctx, argv) {
         body.order = n;
       }
       if (options.protection !== void 0) body.protection = protectionOf(options.protection);
-      const res = await requestJson(ctx, BASE28, { method: "POST", body });
+      const res = await requestJson(ctx, BASE29, { method: "POST", body });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Created environment ${res.body?.name ?? name} (order ${res.body?.order ?? "?"}, ${res.body?.protection ?? "?"}).`));
       return 0;
     }
     case "ensure-chain": {
-      const res = await requestJson(ctx, `${BASE28}/ensure-chain`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE29}/ensure-chain`, { method: "POST", body: {} });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Chain: ${arrayOf(res.body, "environments").map((e) => e.name).join(" \u2192 ")}`));
       return 0;
     }
     case "protect": {
       const name = positionals[0];
       if (!name || options.protection === void 0) throw new CliError("Usage: openwop environments protect <name> --protection open|protected|locked", 2);
-      const res = await requestJson(ctx, `${BASE28}/${encodeURIComponent(name)}/protection`, { method: "PATCH", body: { protection: protectionOf(options.protection) } });
+      const res = await requestJson(ctx, `${BASE29}/${encodeURIComponent(name)}/protection`, { method: "PATCH", body: { protection: protectionOf(options.protection) } });
       emit2(res.body, () => writeLine(ctx.io.stdout, `${name} is now ${res.body?.protection ?? options.protection}.`));
       return 0;
     }
     case "settings": {
       if (positionals[0] === "set") {
         if (options.requireApproval === void 0) throw new CliError("Usage: openwop environments settings set --require-approval true|false", 2);
-        const res2 = await requestJson(ctx, `${BASE28}/settings`, { method: "PATCH", body: { requireApprovalForPromotion: parseBool("--require-approval", options.requireApproval) } });
+        const res2 = await requestJson(ctx, `${BASE29}/settings`, { method: "PATCH", body: { requireApprovalForPromotion: parseBool("--require-approval", options.requireApproval) } });
         emit2(res2.body, () => writeLine(ctx.io.stdout, `requireApprovalForPromotion: ${res2.body?.requireApprovalForPromotion}`));
         return 0;
       }
-      const res = await requestJson(ctx, `${BASE28}/settings`);
+      const res = await requestJson(ctx, `${BASE29}/settings`);
       emit2(res.body, () => writeLine(ctx.io.stdout, `requireApprovalForPromotion: ${res.body?.requireApprovalForPromotion ?? false}`));
       return 0;
     }
     case "snapshots": {
-      const res = await requestJson(ctx, `${BASE28}/snapshots`);
+      const res = await requestJson(ctx, `${BASE29}/snapshots`);
       emit2(res.body, () => {
         const snaps = arrayOf(res.body, "snapshots");
         if (snaps.length === 0) {
@@ -25780,13 +26232,13 @@ async function runEnvironments(ctx, argv) {
     case "snapshot": {
       const body = {};
       if (options.sourceEnv) body.sourceEnv = options.sourceEnv;
-      const res = await requestJson(ctx, `${BASE28}/snapshots`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE29}/snapshots`, { method: "POST", body });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Snapshot ${res.body?.hash ?? "?"}${res.body?.sourceEnv ? ` (from ${res.body.sourceEnv})` : ""}.`));
       return 0;
     }
     case "preview": {
       if (!options.to || !options.snapshot) throw new CliError("Usage: openwop environments preview --to <env> --snapshot <hash>", 2);
-      const res = await requestJson(ctx, `${BASE28}/preview`, { method: "POST", body: { toEnv: options.to, snapshotHash: options.snapshot } });
+      const res = await requestJson(ctx, `${BASE29}/preview`, { method: "POST", body: { toEnv: options.to, snapshotHash: options.snapshot } });
       writeJson(ctx.io.stdout, res.body);
       return 0;
     }
@@ -25794,18 +26246,18 @@ async function runEnvironments(ctx, argv) {
       if (!options.from) throw new CliError("Usage: openwop environments promote --from <env> [--to <env>]", 2);
       const body = { fromEnv: options.from };
       if (options.to) body.toEnv = options.to;
-      return movement(ctx, await requestJson(ctx, `${BASE28}/promote`, { method: "POST", body }), "Promoted");
+      return movement(ctx, await requestJson(ctx, `${BASE29}/promote`, { method: "POST", body }), "Promoted");
     }
     case "rollback": {
       if (!options.env || !options.snapshot) throw new CliError("Usage: openwop environments rollback --env <env> --snapshot <hash>", 2);
-      return movement(ctx, await requestJson(ctx, `${BASE28}/rollback`, { method: "POST", body: { env: options.env, snapshotHash: options.snapshot } }), "Rolled back");
+      return movement(ctx, await requestJson(ctx, `${BASE29}/rollback`, { method: "POST", body: { env: options.env, snapshotHash: options.snapshot } }), "Rolled back");
     }
     case "apply": {
       if (!options.snapshot) throw new CliError("Usage: openwop environments apply --snapshot <hash>", 2);
-      return movement(ctx, await requestJson(ctx, `${BASE28}/apply`, { method: "POST", body: { snapshotHash: options.snapshot } }), "Applied");
+      return movement(ctx, await requestJson(ctx, `${BASE29}/apply`, { method: "POST", body: { snapshotHash: options.snapshot } }), "Applied");
     }
     case "promotions": {
-      const res = await requestJson(ctx, `${BASE28}/promotions`);
+      const res = await requestJson(ctx, `${BASE29}/promotions`);
       emit2(res.body, () => {
         const rows = arrayOf(res.body, "promotions");
         if (rows.length === 0) {
@@ -25850,7 +26302,7 @@ function movement(ctx, res, verb) {
 }
 
 // src/cli/billing.ts
-var BASE29 = "/v1/host/openwop-app/billing";
+var BASE30 = "/v1/host/openwop-app/billing";
 var BILLING_HELP = `Usage:
   openwop billing subscription [--json]
   openwop billing balance [--json]
@@ -25868,7 +26320,7 @@ var BILLING_HELP = `Usage:
   openwop billing sync-seats [--json]
   openwop billing import (--body <json> | --body-file <path>) [--json]
 
-Workspace billing (host extension under ${BASE29}; toggle 'billing').
+Workspace billing (host extension under ${BASE30}; toggle 'billing').
   subscription     GET  /subscription               plan tier, status, seats, period
   balance          GET  /balance                    purchased token balance
   entitlements     GET  /entitlements               the plan's allowed features + limits
@@ -25915,7 +26367,7 @@ async function runBilling(ctx, argv) {
   const superadmin = (path, body, surface) => gatedRequest(ctx, path, { method: "POST", body }, surface, "superadmin");
   switch (sub) {
     case "subscription": {
-      const res = await requestJson(ctx, `${BASE29}/subscription`);
+      const res = await requestJson(ctx, `${BASE30}/subscription`);
       emit2(res.body, () => {
         const s = res.body ?? {};
         writeLine(ctx.io.stdout, `plan:    ${s.planTier ?? "?"} (${s.status ?? "?"})`);
@@ -25926,12 +26378,12 @@ async function runBilling(ctx, argv) {
       return 0;
     }
     case "balance": {
-      const res = await requestJson(ctx, `${BASE29}/balance`);
+      const res = await requestJson(ctx, `${BASE30}/balance`);
       emit2(res.body, () => writeLine(ctx.io.stdout, `tokens available: ${res.body?.totalAvailable ?? 0} (purchased total ${res.body?.purchasedTokensTotal ?? 0})`));
       return 0;
     }
     case "entitlements": {
-      const res = await requestJson(ctx, `${BASE29}/entitlements`);
+      const res = await requestJson(ctx, `${BASE30}/entitlements`);
       emit2(res.body, () => {
         const e = res.body ?? {};
         writeLine(ctx.io.stdout, `plan: ${e.plan ?? "?"}`);
@@ -25942,7 +26394,7 @@ async function runBilling(ctx, argv) {
       return 0;
     }
     case "bundles": {
-      const res = await requestJson(ctx, `${BASE29}/bundles`);
+      const res = await requestJson(ctx, `${BASE30}/bundles`);
       emit2(res.body, () => {
         const rows = arrayOf(res.body, "bundles");
         if (rows.length === 0) {
@@ -25962,19 +26414,19 @@ async function runBilling(ctx, argv) {
       const verb = positionals[0] ?? "list";
       if (verb === "get") {
         if (!positionals[1]) throw new CliError("Usage: openwop billing invoices get <invoiceId>", 2);
-        const res2 = await requestJson(ctx, `${BASE29}/invoices/${encodeURIComponent(positionals[1])}`);
+        const res2 = await requestJson(ctx, `${BASE30}/invoices/${encodeURIComponent(positionals[1])}`);
         emit2(res2.body, () => writeLine(ctx.io.stdout, res2.body?.markdown ?? JSON.stringify(res2.body, null, 2)));
         return 0;
       }
       if (verb === "create") {
         const amount = Number(options.amount);
         if (options.amount === void 0 || !Number.isFinite(amount)) throw new CliError("Usage: openwop billing invoices create --amount <n> [--currency <c>]", 2);
-        const res2 = await superadmin(`${BASE29}/invoices`, { amount, ...options.currency ? { currency: options.currency } : {} }, "Generating an invoice");
+        const res2 = await superadmin(`${BASE30}/invoices`, { amount, ...options.currency ? { currency: options.currency } : {} }, "Generating an invoice");
         emit2(res2.body, () => writeLine(ctx.io.stdout, `Created invoice ${res2.body?.invoiceId ?? "?"} (${res2.body?.amount} ${res2.body?.currency}).`));
         return 0;
       }
       if (verb !== "list") throw new CliError(`Unknown invoices verb: ${verb}`, 2);
-      const res = await requestJson(ctx, `${BASE29}/invoices`);
+      const res = await requestJson(ctx, `${BASE30}/invoices`);
       emit2(res.body, () => {
         const rows = arrayOf(res.body, "invoices");
         if (rows.length === 0) {
@@ -25992,18 +26444,18 @@ async function runBilling(ctx, argv) {
     }
     case "checkout": {
       if (!options.price) throw new CliError("Usage: openwop billing checkout --price <priceId>", 2);
-      const res = await requestJson(ctx, `${BASE29}/checkout`, { method: "POST", body: { priceId: options.price } });
+      const res = await requestJson(ctx, `${BASE30}/checkout`, { method: "POST", body: { priceId: options.price } });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Open to complete checkout (${res.body?.mode ?? "?"}): ${res.body?.url ?? "?"}`));
       return 0;
     }
     case "bundle-checkout": {
       if (!positionals[0]) throw new CliError("Usage: openwop billing bundle-checkout <bundleId>", 2);
-      const res = await requestJson(ctx, `${BASE29}/bundles/${encodeURIComponent(positionals[0])}/checkout`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE30}/bundles/${encodeURIComponent(positionals[0])}/checkout`, { method: "POST", body: {} });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Open to complete checkout (${res.body?.mode ?? "?"}): ${res.body?.url ?? "?"}`));
       return 0;
     }
     case "portal": {
-      const res = await requestJson(ctx, `${BASE29}/portal`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE30}/portal`, { method: "POST", body: {} });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Billing portal (${res.body?.mode ?? "?"}): ${res.body?.url ?? "?"}`));
       return 0;
     }
@@ -26016,19 +26468,19 @@ async function runBilling(ctx, argv) {
         if (!Number.isFinite(v)) throw new CliError("--value must be a number.", 2);
         body.value = v;
       }
-      const res = await superadmin(`${BASE29}/coupons`, body, "Creating a billing coupon");
+      const res = await superadmin(`${BASE30}/coupons`, body, "Creating a billing coupon");
       emit2(res.body, () => writeLine(ctx.io.stdout, `Created coupon ${res.body?.code ?? options.code} (${res.body?.type} ${res.body?.value}).`));
       return 0;
     }
     case "sync-seats": {
-      const res = await superadmin(`${BASE29}/sync-seats`, {}, "Billing seat sync");
+      const res = await superadmin(`${BASE30}/sync-seats`, {}, "Billing seat sync");
       emit2(res.body, () => writeLine(ctx.io.stdout, `Seats synced: ${res.body?.quantity ?? "?"}.`));
       return 0;
     }
     case "import": {
       const body = readBodyOption(ctx, options);
       if (!body) throw new CliError('Usage: openwop billing import (--body <json> | --body-file <path>)  \u2014 {"subscriptions":[...],"balances":[...]}', 2);
-      const res = await superadmin(`${BASE29}/import`, body, "Billing import");
+      const res = await superadmin(`${BASE30}/import`, body, "Billing import");
       emit2(res.body, () => writeLine(ctx.io.stdout, `Imported ${res.body?.subscriptions ?? 0} subscription(s), ${res.body?.balances ?? 0} balance(s).`));
       return 0;
     }
@@ -26099,15 +26551,15 @@ Run \`openwop site-config --help\` for usage.`);
 }
 
 // src/cli/runtimePosture.ts
-var BASE30 = "/v1/host/openwop-app/runtime-posture";
+var BASE31 = "/v1/host/openwop-app/runtime-posture";
 var SURFACE5 = "Runtime posture";
 var RUNTIME_POSTURE_HELP = `Usage:
   openwop runtime-posture [get] [--json]
   openwop runtime-posture request --warm|--cold [--json]
 
 The serving service's runtime posture (host extension, SUPER-ADMIN gated).
-  get      GET  ${BASE30}                   live posture (serving revision, warm/cold, rollout)
-  request  POST ${BASE30}/change-requests   ask for a warm/cold change; returns the commands to run
+  get      GET  ${BASE31}                   live posture (serving revision, warm/cold, rollout)
+  request  POST ${BASE31}/change-requests   ask for a warm/cold change; returns the commands to run
 
 A change request APPLIES NOTHING: the host records it in the audit log and returns the
 exact commands for an operator holding deploy rights. Without a super-admin principal
@@ -26131,7 +26583,7 @@ async function runRuntimePosture(ctx, argv) {
     return 0;
   }
   if (sub === "get") {
-    const res2 = await gatedRequest(ctx, BASE30, void 0, SURFACE5, "superadmin");
+    const res2 = await gatedRequest(ctx, BASE31, void 0, SURFACE5, "superadmin");
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
@@ -26150,7 +26602,7 @@ async function runRuntimePosture(ctx, argv) {
   if (sub !== "request") throw new CliError(`Unknown runtime-posture command: ${sub}
 Run \`openwop runtime-posture --help\` for usage.`);
   if (Boolean(options.warm) === Boolean(options.cold)) throw new CliError("Pass exactly one of --warm or --cold.", 2);
-  const res = await gatedRequest(ctx, `${BASE30}/change-requests`, { method: "POST", body: { warm: Boolean(options.warm) } }, SURFACE5, "superadmin");
+  const res = await gatedRequest(ctx, `${BASE31}/change-requests`, { method: "POST", body: { warm: Boolean(options.warm) } }, SURFACE5, "superadmin");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -26205,16 +26657,16 @@ Run \`openwop maintenance --help\` for usage.`);
 }
 
 // src/cli/menuConfig.ts
-var BASE31 = "/v1/host/openwop-app/menu-config";
+var BASE32 = "/v1/host/openwop-app/menu-config";
 var MENU_CONFIG_HELP = `Usage:
   openwop menu-config [get] [--json]
   openwop menu-config set me     (--body <json> | --body-file <path>) [--json]
   openwop menu-config set tenant (--body <json> | --body-file <path>) [--json]
 
 Navigation menu layout (host extension).
-  get         GET ${BASE31}          {tenant, user} layers for the caller
-  set me      PUT ${BASE31}/me       replace YOUR personal layer (signed-in user)
-  set tenant  PUT ${BASE31}/tenant   [super-admin] replace the workspace default layer
+  get         GET ${BASE32}          {tenant, user} layers for the caller
+  set me      PUT ${BASE32}/me       replace YOUR personal layer (signed-in user)
+  set tenant  PUT ${BASE32}/tenant   [super-admin] replace the workspace default layer
 
 The body is the menu config object ({"items": {...}, "headers": [...]}) or the full
 request ({"config": {...}}). A write REPLACES that layer. \`set tenant\` reads the current
@@ -26240,7 +26692,7 @@ async function runMenuConfig(ctx, argv) {
     return 0;
   }
   if (sub === "get") {
-    const res2 = await requestJson(ctx, BASE31);
+    const res2 = await requestJson(ctx, BASE32);
     writeJson(ctx.io.stdout, res2.body);
     return 0;
   }
@@ -26254,13 +26706,13 @@ Run \`openwop menu-config --help\` for usage.`);
   const body = "config" in raw ? raw : { config: raw };
   let res;
   if (layer === "me") {
-    res = await gatedRequest(ctx, `${BASE31}/me`, { method: "PUT", body }, "Editing your menu layout", "signed-in");
+    res = await gatedRequest(ctx, `${BASE32}/me`, { method: "PUT", body }, "Editing your menu layout", "signed-in");
   } else {
-    const current = await requestJson(ctx, BASE31);
+    const current = await requestJson(ctx, BASE32);
     const etag = current.headers.get("etag");
     res = await gatedRequest(
       ctx,
-      `${BASE31}/tenant`,
+      `${BASE32}/tenant`,
       { method: "PUT", body, ...etag ? { headers: { "if-match": etag } } : {} },
       "Editing the workspace default menu layout",
       "superadmin"
@@ -26650,7 +27102,7 @@ function renderKnowledge(ctx, agentId, k) {
 
 // src/cli/compatEndpoints.ts
 import { readFileSync as readFileSync19 } from "node:fs";
-var BASE32 = "/v1/host/openwop-app/compat-endpoints";
+var BASE33 = "/v1/host/openwop-app/compat-endpoints";
 var COMPAT_ENDPOINTS_HELP = `Usage:
   openwop compat-endpoints list --org <orgId> [--json]
   openwop compat-endpoints create --org <orgId> --label <l> --base-url-endpoint <https://\u2026> [--api-key-file <path> | --api-key-env <VAR>] [--model <m>]... [--vision] [--tools] [--long-context] [--json]
@@ -26700,7 +27152,7 @@ async function runCompatEndpoints(ctx, argv) {
     switch (sub) {
       case "list": {
         const org2 = requireOrg(options.org);
-        const res = await requestJson(ctx, `${BASE32}?orgId=${encodeURIComponent(org2)}`);
+        const res = await requestJson(ctx, `${BASE33}?orgId=${encodeURIComponent(org2)}`);
         if (ctx.json) {
           writeJson(ctx.io.stdout, res.body);
           return 0;
@@ -26733,7 +27185,7 @@ async function runCompatEndpoints(ctx, argv) {
         const apiKey = readApiKey(ctx, options);
         if (apiKey) body.apiKey = apiKey;
         if (Array.isArray(options.model) && options.model.length) body.models = options.model;
-        const res = await requestJson(ctx, BASE32, { method: "POST", body });
+        const res = await requestJson(ctx, BASE33, { method: "POST", body });
         if (ctx.json) {
           writeJson(ctx.io.stdout, res.body);
           return 0;
@@ -26747,7 +27199,7 @@ async function runCompatEndpoints(ctx, argv) {
           writeLine(ctx.io.stderr, `Refusing to delete ${positionals[0]} (and its stored key) without --yes.`);
           return 2;
         }
-        await requestJson(ctx, `${BASE32}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+        await requestJson(ctx, `${BASE33}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
         writeLine(ctx.io.stdout, `Deleted compat endpoint ${positionals[0]}.`);
         return 0;
       }
@@ -26777,7 +27229,7 @@ function readApiKey(ctx, options) {
 }
 
 // src/cli/hostEvents.ts
-var BASE33 = "/v1/host/openwop-app/host-events/bindings";
+var BASE34 = "/v1/host/openwop-app/host-events/bindings";
 var HOST_EVENTS_HELP = `Usage:
   openwop host-events list [--json]
   openwop host-events bind --event <host.\u2026> --workflow <workflowId> [--json]
@@ -26820,7 +27272,7 @@ async function runHostEvents(ctx, argv) {
   }
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, BASE33);
+      const res = await requestJson(ctx, BASE34);
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -26841,7 +27293,7 @@ async function runHostEvents(ctx, argv) {
     case "bind": {
       if (!options.event || !options.workflow) throw new CliError("bind needs --event <host.\u2026> and --workflow <workflowId>.", 2);
       if (!String(options.event).startsWith("host.")) throw new CliError('--event must be a host-extension event name starting with "host.".', 2);
-      const res = await requestJson(ctx, BASE33, { method: "POST", body: { eventType: options.event, workflowId: options.workflow } });
+      const res = await requestJson(ctx, BASE34, { method: "POST", body: { eventType: options.event, workflowId: options.workflow } });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -26852,7 +27304,7 @@ async function runHostEvents(ctx, argv) {
     case "enable":
     case "disable": {
       if (positionals.length !== 1) throw new CliError(`Usage: openwop host-events ${sub} <bindingId> [--json]`, 2);
-      const res = await requestJson(ctx, `${BASE33}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: { enabled: sub === "enable" } });
+      const res = await requestJson(ctx, `${BASE34}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: { enabled: sub === "enable" } });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -26866,7 +27318,7 @@ async function runHostEvents(ctx, argv) {
         writeLine(ctx.io.stderr, `Refusing to delete binding ${positionals[0]} without --yes.`);
         return 2;
       }
-      await requestJson(ctx, `${BASE33}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      await requestJson(ctx, `${BASE34}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted binding ${positionals[0]}.`);
       return 0;
     }
@@ -27010,8 +27462,10 @@ var OPENAPI_HELP = `Usage:
   openwop openapi [--out <file>] [--json]
   openwop openapi paths [--filter <text>] [--json]
 
-Fetch the host's OpenAPI document (GET /v1/openapi.json \u2014 the document the
-host serves, which lists the operations it implements).
+Fetch the host's OpenAPI document \u2014 the document the host serves, which lists
+the operations it implements. A host that speaks protocol major 2 is asked for
+GET /openapi.json with OpenWOP-Version: 2.0 (its v2 document); a v1-only host
+for GET /v1/openapi.json.
 
   (default)  Prints the document's title, version and operation count; --json
              prints the whole document; --out <file> saves it.
@@ -27063,7 +27517,7 @@ Run \`openwop openapi --help\` for usage.`);
 }
 
 // src/cli/assistant.ts
-var BASE34 = "/v1/host/openwop-app/assistant";
+var BASE35 = "/v1/host/openwop-app/assistant";
 var ASSISTANT_HELP = `Usage:
   openwop assistant workspace [--json]
   openwop assistant briefing [--json]
@@ -27126,7 +27580,7 @@ async function runAssistant(ctx, argv) {
       return await runWorkspace2(ctx, rest);
     case "briefing":
     case "brief":
-      return await simpleRead(ctx, rest, `${BASE34}/briefing`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.brief ?? b, null, 2)));
+      return await simpleRead(ctx, rest, `${BASE35}/briefing`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.brief ?? b, null, 2)));
     case "projects":
     case "project":
       return await runProjects2(ctx, rest);
@@ -27139,7 +27593,7 @@ async function runAssistant(ctx, argv) {
     case "meeting":
       return await runMeetings(ctx, rest);
     case "stakeholders":
-      return await simpleRead(ctx, rest, `${BASE34}/stakeholders`, (b) => table2(ctx, b?.stakeholders, (s) => ({
+      return await simpleRead(ctx, rest, `${BASE35}/stakeholders`, (b) => table2(ctx, b?.stakeholders, (s) => ({
         stakeholderId: s.stakeholderId,
         name: s.person?.name ?? s.person?.email ?? "",
         importance: String(s.importance ?? ""),
@@ -27152,7 +27606,7 @@ async function runAssistant(ctx, argv) {
     case "loop":
       return await runLoops(ctx, rest);
     case "health":
-      return await simpleRead(ctx, rest, `${BASE34}/health`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.health ?? b, null, 2)));
+      return await simpleRead(ctx, rest, `${BASE35}/health`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.health ?? b, null, 2)));
     default:
       throw new CliError(`Unknown assistant command: ${sub}
 Run \`openwop assistant --help\` for usage.`, 2);
@@ -27182,7 +27636,7 @@ async function runWorkspace2(ctx, argv) {
     write(ctx.io.stdout, ASSISTANT_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, `${BASE34}/workspace-conversation`, { method: "POST", body: {} });
+  const res = await requestJson(ctx, `${BASE35}/workspace-conversation`, { method: "POST", body: {} });
   return emit(ctx, res.body, () => {
     writeLine(ctx.io.stdout, `${res.status === 201 ? "Opened" : "Resumed"} workspace conversation ${res.body?.sessionId}.`);
     writeLine(ctx.io.stdout, `Talk to the assistant: openwop chat messages send ${res.body?.sessionId} --content "\u2026"`);
@@ -27208,7 +27662,7 @@ async function runProjects2(ctx, argv) {
   const id = positionals[0];
   const needId = () => {
     if (!id) throw new CliError(`assistant projects ${sub} requires <projectId>.`, 2);
-    return `${BASE34}/projects/${enc(id)}`;
+    return `${BASE35}/projects/${enc(id)}`;
   };
   const fields = () => {
     const body = {};
@@ -27221,7 +27675,7 @@ async function runProjects2(ctx, argv) {
   };
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, `${BASE34}/projects`);
+      const res = await requestJson(ctx, `${BASE35}/projects`);
       return emit(ctx, res.body, () => table2(ctx, res.body?.projects, projectRow, "No assistant projects. Create one with `openwop assistant projects create --name <n>`."));
     }
     case "get": {
@@ -27242,7 +27696,7 @@ async function runProjects2(ctx, argv) {
     }
     case "create": {
       if (!options.name) throw new CliError("assistant projects create requires --name <n>.", 2);
-      const res = await requestJson(ctx, `${BASE34}/projects`, { method: "POST", body: fields() });
+      const res = await requestJson(ctx, `${BASE35}/projects`, { method: "POST", body: fields() });
       return emit(ctx, res.body, () => writeLine(ctx.io.stdout, `Created project ${res.body?.projectId} (${res.body?.name ?? options.name}).`));
     }
     case "update": {
@@ -27289,14 +27743,14 @@ async function runCommitments(ctx, argv) {
   const id = positionals[0];
   const needId = () => {
     if (!id) throw new CliError(`assistant commitments ${sub} requires <commitmentId>.`, 2);
-    return `${BASE34}/commitments/${enc(id)}`;
+    return `${BASE35}/commitments/${enc(id)}`;
   };
   switch (sub) {
     case "list": {
       const q = new URLSearchParams();
       if (options.status) q.set("status", options.status);
       if (options.project) q.set("projectId", options.project);
-      const res = await requestJson(ctx, `${BASE34}/commitments${q.size ? `?${q}` : ""}`);
+      const res = await requestJson(ctx, `${BASE35}/commitments${q.size ? `?${q}` : ""}`);
       return emit(ctx, res.body, () => table2(ctx, res.body?.commitments, commitmentRow, "No commitments."));
     }
     case "get": {
@@ -27346,7 +27800,7 @@ async function runDecisions(ctx, argv) {
     write(ctx.io.stdout, ASSISTANT_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, `${BASE34}/decisions${options.project ? `?projectId=${enc(options.project)}` : ""}`);
+  const res = await requestJson(ctx, `${BASE35}/decisions${options.project ? `?projectId=${enc(options.project)}` : ""}`);
   return emit(ctx, res.body, () => table2(ctx, res.body?.decisions, (d) => ({
     decisionId: d.decisionId,
     decidedAt: d.decidedAt ?? "",
@@ -27363,7 +27817,7 @@ async function runMeetings(ctx, argv) {
     return 0;
   }
   if (sub === "list") {
-    const res = await requestJson(ctx, `${BASE34}/meetings`);
+    const res = await requestJson(ctx, `${BASE35}/meetings`);
     return emit(ctx, res.body, () => table2(ctx, res.body?.meetings, (m) => ({
       meetingId: m.meetingId,
       startAt: m.startAt ?? "",
@@ -27373,7 +27827,7 @@ async function runMeetings(ctx, argv) {
   }
   if (sub === "get") {
     if (!positionals[0]) throw new CliError("assistant meetings get requires <meetingId>.", 2);
-    const res = await requestJson(ctx, `${BASE34}/meetings/${enc(positionals[0])}`);
+    const res = await requestJson(ctx, `${BASE35}/meetings/${enc(positionals[0])}`);
     const m = res.body ?? {};
     return emit(ctx, res.body, () => writeFields(ctx, [
       ["meetingId", m.meetingId],
@@ -27402,11 +27856,11 @@ async function runPending(ctx, argv) {
   const id = positionals[0];
   const needId = () => {
     if (!id) throw new CliError(`assistant pending ${sub} requires <actionId>.`, 2);
-    return `${BASE34}/pending-actions/${enc(id)}`;
+    return `${BASE35}/pending-actions/${enc(id)}`;
   };
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, `${BASE34}/pending-actions${options.status ? `?status=${enc(options.status)}` : ""}`);
+      const res = await requestJson(ctx, `${BASE35}/pending-actions${options.status ? `?status=${enc(options.status)}` : ""}`);
       return emit(ctx, res.body, () => table2(ctx, res.body?.pendingActions, (a) => ({
         actionId: a.actionId,
         kind: a.kind ?? "",
@@ -27450,7 +27904,7 @@ async function runLoops(ctx, argv) {
     return 0;
   }
   if (sub === "list") {
-    const res = await requestJson(ctx, `${BASE34}/loops`);
+    const res = await requestJson(ctx, `${BASE35}/loops`);
     return emit(ctx, res.body, () => table2(ctx, res.body?.loops, (l) => ({
       loopId: l.loopId,
       label: l.label ?? "",
@@ -27465,7 +27919,7 @@ async function runLoops(ctx, argv) {
     if (!loopId) throw new CliError(`assistant loops ${sub} requires <loopId>.`, 2);
     const body = {};
     if (sub === "enable" && options.cron) body.cronExpr = options.cron;
-    const res = await requestJson(ctx, `${BASE34}/loops/${enc(loopId)}/${sub}`, { method: "POST", body });
+    const res = await requestJson(ctx, `${BASE35}/loops/${enc(loopId)}/${sub}`, { method: "POST", body });
     return emit(ctx, res.body, () => writeLine(ctx.io.stdout, `Loop ${loopId}: ${res.body?.enabled ? "enabled" : "disabled"} (job ${res.body?.jobId ?? ""}).`));
   }
   throw new CliError(`Unknown assistant loops command: ${sub}
@@ -27473,7 +27927,7 @@ Run \`openwop assistant --help\` for usage.`, 2);
 }
 
 // src/cli/channels.ts
-var BASE35 = "/v1/host/openwop-app/channels";
+var BASE36 = "/v1/host/openwop-app/channels";
 var CHANNELS_HELP = `Usage:
   openwop channels list [--json]
   openwop channels create --name <n> [--description d] [--private] [--member <userId>]... [--agent <agentId>]... [--json]
@@ -27572,7 +28026,7 @@ function oneId(argv, usage6, spec = {}) {
   const { options, positionals } = parseOptions(argv, { ...spec, bool: ["--help", ...spec.bool ?? []] });
   if (options.help) return { help: true, options, positionals };
   if (!positionals[0]) throw new CliError(`Usage: openwop channels ${usage6}`, 2);
-  return { help: false, options, positionals, path: `${BASE35}/${enc(positionals[0])}` };
+  return { help: false, options, positionals, path: `${BASE36}/${enc(positionals[0])}` };
 }
 function channelSummary(res) {
   const c = res?.channel ?? {};
@@ -27585,7 +28039,7 @@ async function runList4(ctx, argv) {
     write(ctx.io.stdout, CHANNELS_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, BASE35);
+  const res = await requestJson(ctx, BASE36);
   return emit(ctx, res.body, () => {
     const rows = Array.isArray(res.body?.channels) ? res.body.channels : [];
     if (!rows.length) {
@@ -27618,7 +28072,7 @@ async function runCreate(ctx, argv) {
   if (options.description) body.description = options.description;
   if (Array.isArray(options.member) && options.member.length) body.memberUserIds = options.member;
   if (Array.isArray(options.agent) && options.agent.length) body.agentIds = options.agent;
-  const res = await requestJson(ctx, BASE35, { method: "POST", body });
+  const res = await requestJson(ctx, BASE36, { method: "POST", body });
   return emit(ctx, res.body, () => writeLine(ctx.io.stdout, `Created channel ${channelSummary(res.body)}.`));
 }
 async function runGet5(ctx, argv) {
@@ -28588,7 +29042,7 @@ Run \`openwop agent-author --help\` for usage.`, 2);
 }
 
 // src/cli/workflowAuthor.ts
-var BASE36 = "/v1/host/openwop-app/workflow-author";
+var BASE37 = "/v1/host/openwop-app/workflow-author";
 var WORKFLOW_AUTHOR_HELP = `Usage:
   openwop workflow-author catalog [--json]
   openwop workflow-author draft --intent <text> [--provider p] [--model m] [--max-attempts n]
@@ -28624,7 +29078,7 @@ async function runWorkflowAuthor(ctx, argv) {
     return 0;
   }
   if (sub === "catalog") {
-    const res = await requestJson(ctx, `${BASE36}/catalog`);
+    const res = await requestJson(ctx, `${BASE37}/catalog`);
     return emit(ctx, res.body, () => {
       const nodes = Array.isArray(res.body?.nodes) ? res.body.nodes : [];
       if (!nodes.length) writeLine(ctx.io.stdout, "No authorable nodes in this workspace.");
@@ -28640,7 +29094,7 @@ async function runWorkflowAuthor(ctx, argv) {
     if (options.model) body.model = options.model;
     const maxAttempts = intFlag(options.maxAttempts, "--max-attempts");
     if (maxAttempts) body.maxAttempts = maxAttempts;
-    const res = await requestJson(ctx, `${BASE36}/draft`, { method: "POST", body, headers: idempotencyHeaders(options.idempotencyKey) });
+    const res = await requestJson(ctx, `${BASE37}/draft`, { method: "POST", body, headers: idempotencyHeaders(options.idempotencyKey) });
     const runId = res.body?.runId;
     if (!options.follow) {
       return emit(ctx, res.body, () => {
@@ -28667,7 +29121,7 @@ Run \`openwop workflow-author --help\` for usage.`, 2);
 }
 
 // src/cli/workflowProposals.ts
-var BASE37 = "/v1/host/openwop-app/workflow-proposals/admin/policies";
+var BASE38 = "/v1/host/openwop-app/workflow-proposals/admin/policies";
 var WORKFLOW_PROPOSALS_HELP = `Usage:
   openwop workflow-proposals policies --tenant <tenantId> [--json]
   openwop workflow-proposals enable --tenant <tenantId> --agent-profile <agentProfileId> [--json]
@@ -28698,7 +29152,7 @@ async function runWorkflowProposals(ctx, argv) {
   }
   if (!options.tenant) throw new CliError("workflow-proposals requires --tenant <tenantId>.", 2);
   if (sub === "policies" || sub === "list") {
-    const res = await requestJson(ctx, `${BASE37}?tenantId=${enc(options.tenant)}`);
+    const res = await requestJson(ctx, `${BASE38}?tenantId=${enc(options.tenant)}`);
     return emit(ctx, res.body, () => {
       const items = Array.isArray(res.body?.items) ? res.body.items : [];
       if (!items.length) {
@@ -28710,7 +29164,7 @@ async function runWorkflowProposals(ctx, argv) {
   }
   if (sub === "enable" || sub === "disable") {
     if (!options.agentProfile) throw new CliError(`workflow-proposals ${sub} requires --agent-profile <agentProfileId>.`, 2);
-    const path = `${BASE37}/${enc(options.tenant)}/${enc(options.agentProfile)}`;
+    const path = `${BASE38}/${enc(options.tenant)}/${enc(options.agentProfile)}`;
     const res = await requestJson(ctx, path, { method: sub === "enable" ? "PUT" : "DELETE" });
     return emit(ctx, res.body, () => writeLine(ctx.io.stdout, sub === "enable" ? `Auto-approval enabled for ${options.agentProfile} in ${options.tenant}.` : res.body?.removed ? `Auto-approval disabled for ${options.agentProfile} in ${options.tenant}.` : `No policy was set for ${options.agentProfile} in ${options.tenant}.`));
   }
@@ -29656,6 +30110,10 @@ async function runCli(argv, options = {}) {
         return await runConformance(ctx, commandArgs);
       case "onboard":
         return await runOnboard(ctx, commandArgs);
+      case "login":
+        return await runLogin(ctx, commandArgs);
+      case "logout":
+        return await runLogout(ctx, commandArgs);
       case "providers":
       case "provider":
         return await runProviders(ctx, commandArgs);
@@ -29984,6 +30442,8 @@ var HELP_MAP = {
   packs: PACKS_HELP,
   pack: PACKS_HELP,
   onboard: ONBOARD_HELP,
+  login: LOGIN_HELP,
+  logout: LOGIN_HELP,
   providers: PROVIDERS_HELP,
   provider: PROVIDERS_HELP,
   agents: AGENTS_HELP,
@@ -30182,6 +30642,7 @@ Exit codes:
 
 Commands:
   onboard             Guided first-run setup (host + provider + model + BYOK key)
+  login | logout      Sign this terminal in to an openwop-app host by a code (no key to copy)
   providers list      List stored BYOK credential refs (never values)
   providers add       Store a credential ref against the configured host
   providers remove    Remove a credential ref