@openwop/cli 1.3.0 → 1.4.1

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.3.0",
+  version: "1.4.1",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1078,7 +1078,7 @@ import { createInterface as createInterface2 } from "node:readline";
 
 // src/ids.ts
 function projectTenantBoundId(id) {
-  if (id.includes("~")) return id;
+  if (id.includes("~") && !id.includes("/")) return id;
   let out = "";
   for (const byte of new TextEncoder().encode(id)) {
     const ch = String.fromCharCode(byte);
@@ -2632,7 +2632,19 @@ async function runInterrupts(ctx, argv) {
         write(ctx.io.stdout, "Usage: openwop interrupts list <runId> [--json]\n");
         return 2;
       }
-      const res = await requestJson(ctx, `/v1/host/openwop-app/runs/${encodeURIComponent(rest[0])}/interrupts`);
+      let res;
+      try {
+        res = await requestJson(ctx, `/v1/host/openwop-app/runs/${encodeURIComponent(rest[0])}/interrupts`);
+      } catch (err) {
+        const env = err instanceof HttpError ? errorEnvelope(err.body) : {};
+        if (err instanceof HttpError && err.status === 404 && /^no operation at /i.test(env.message ?? "")) {
+          throw new CliError(
+            "interrupts: `list` reads the openwop-app host extension (GET /v1/host/openwop-app/runs/{runId}/interrupts), which this host does not serve. On any host an open interrupt appears as interrupt.requested in the run's events; answer it with `openwop interrupts respond <runId> <nodeId>`.",
+            1
+          );
+        }
+        throw err;
+      }
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -3599,6 +3611,24 @@ async function readDiscovery(ctx) {
   ctx.discovery = { doc: res.body, servedVersion };
   return { doc: res.body, servedVersion, major };
 }
+async function advertisedRecord(ctx, pick) {
+  const doc = (d) => d && typeof d === "object" ? d : {};
+  let readAny = false;
+  const v1 = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (v1.ok) {
+    readAny = true;
+    const r = pick(doc(v1.body));
+    if (r) return r;
+  }
+  try {
+    const { doc: negotiated } = await readDiscovery(ctx);
+    readAny = true;
+    const r = pick(doc(negotiated));
+    if (r) return r;
+  } catch {
+  }
+  return readAny ? null : void 0;
+}
 function isV2Discovery(caps, servedVersion) {
   if (typeof servedVersion === "string" && servedVersion.startsWith("2.")) return true;
   if (!caps || typeof caps !== "object" || "capabilities" in caps || "supportedTransports" in caps) return false;
@@ -4496,7 +4526,7 @@ async function runCatalogPacks(ctx, argv = []) {
     write(ctx.io.stdout, CATALOG_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, "/v1/packs", { auth: false });
+  const res = await catalogRead(ctx, "", { auth: false });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -4505,6 +4535,14 @@ async function runCatalogPacks(ctx, argv = []) {
   writeLine(ctx.io.stdout, formatTable(rows, ["name", "nodes"]));
   return 0;
 }
+async function catalogRead(ctx, rest, options = {}) {
+  try {
+    return await requestJson(ctx, `/v1/host/openwop-app/packs${rest}`, options);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) return requestJson(ctx, `/v1/packs${rest}`, options);
+    throw err;
+  }
+}
 async function runCatalogPacksVerb(ctx, verb, argv) {
   const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--out"] });
   if (options.help) {
@@ -4513,7 +4551,7 @@ async function runCatalogPacksVerb(ctx, verb, argv) {
   }
   if (verb === "search") {
     const q = positionals[0] ?? "";
-    const res2 = await requestJson(ctx, `/v1/packs/-/search${q ? `?q=${encodeURIComponent(q)}` : ""}`);
+    const res2 = await catalogRead(ctx, `/-/search${q ? `?q=${encodeURIComponent(q)}` : ""}`);
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
@@ -4529,7 +4567,7 @@ async function runCatalogPacksVerb(ctx, verb, argv) {
   }
   if (verb === "get") {
     if (positionals.length !== 1) throw new CliError("Usage: openwop catalog packs get <packName> [--json]", 2);
-    const res2 = await requestJson(ctx, `/v1/packs/${encodeURIComponent(positionals[0])}`);
+    const res2 = await catalogRead(ctx, `/${encodeURIComponent(positionals[0])}`);
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
@@ -4540,7 +4578,7 @@ async function runCatalogPacksVerb(ctx, verb, argv) {
     for (const n of nodes) writeLine(ctx.io.stdout, `  ${n}`);
     return 0;
   }
-  const res = await requestJson(ctx, "/v1/packs/export");
+  const res = await catalogRead(ctx, "/export");
   if (options.out) {
     writeFileSync4(String(options.out), `${JSON.stringify(res.body, null, 2)}
 `);
@@ -14860,6 +14898,153 @@ async function runOnboard(ctx, argv) {
   return 0;
 }
 
+// src/cli/login.ts
+import { hostname } from "node:os";
+var BASE10 = "/v1/host/openwop-app/cli-login";
+var LOGIN_HELP = `Usage:
+  openwop login [--label <name>] [--timeout <seconds>] [--profile <name>] [--json]
+  openwop logout [--profile <name>] [--json]
+
+Sign this terminal in to an openwop-app host without copying an API key
+(host extension under ${BASE10}).
+
+  login    Shows a short code. Open the host's Access \u2192 API keys page, type the
+           code under "Sign in the OpenWOP CLI", and approve. The host then issues
+           this CLI a key (30 days by default), saved to your config file.
+  logout   Revokes that key on the host and removes it from your config file.
+
+The key is never printed. It is listed in the app as "CLI: <label>", where you can
+revoke it. Sign in again to renew.
+
+  --label <name>      What to call this terminal in the app (default: this machine's hostname).
+  --timeout <seconds> Give up waiting for approval after this long (default: the host's own limit).
+  --profile <name>    Use the named config profile.
+
+Approve a code ONLY if you just ran \`openwop login\` yourself.
+
+Exit codes: 0 signed in / signed out \xB7 1 denied, expired or not available on this host \xB7 2 usage.
+
+Examples:
+  export OPENWOP_BASE_URL=https://app.openwop.dev/api
+  openwop login
+  openwop login --label "work laptop"
+  openwop logout
+`;
+var sleep2 = (ms2) => new Promise((r) => setTimeout(r, ms2));
+function approvalUrl(baseUrl, path) {
+  const p = typeof path === "string" && path.startsWith("/") ? path : "/access?tab=api-keys";
+  try {
+    return `${new URL(baseUrl).origin}${p}`;
+  } catch {
+    return p;
+  }
+}
+function notAvailable(ctx) {
+  return new CliError(
+    `${ctx.baseUrl} does not serve the CLI sign-in (${BASE10}/start is not there). Create an API key on the host and set OPENWOP_API_KEY instead.`,
+    1
+  );
+}
+async function runLogin(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--label", "--timeout", "--profile"] });
+  if (options.help) {
+    write(ctx.io.stdout, LOGIN_HELP);
+    return 0;
+  }
+  const timeoutS = options.timeout === void 0 ? void 0 : Number(options.timeout);
+  if (timeoutS !== void 0 && !(Number.isFinite(timeoutS) && timeoutS > 0)) {
+    writeLine(ctx.io.stderr, "--timeout must be a positive number of seconds.");
+    return 2;
+  }
+  const label = String(options.label ?? hostname() ?? "this machine").slice(0, 60);
+  const anon = { ...ctx, apiKey: void 0 };
+  let started;
+  try {
+    started = (await requestJson(anon, `${BASE10}/start`, { method: "POST", body: { label } })).body;
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) throw notAvailable(ctx);
+    throw err;
+  }
+  const deviceCode = started?.deviceCode;
+  const userCode = started?.userCode;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string") throw notAvailable(ctx);
+  writeLine(ctx.io.stderr, "");
+  writeLine(ctx.io.stderr, `  1. Open   ${approvalUrl(ctx.baseUrl, started.verificationPath)}`);
+  writeLine(ctx.io.stderr, `  2. Enter  ${userCode}   under "Sign in the OpenWOP CLI", and approve.`);
+  writeLine(ctx.io.stderr, "");
+  writeLine(ctx.io.stderr, "Waiting for approval\u2026");
+  const hostLimitS = Number.isFinite(Number(started.expiresIn)) ? Number(started.expiresIn) : 600;
+  const deadline = Date.now() + Math.min(timeoutS ?? hostLimitS, hostLimitS) * 1e3;
+  let intervalS = Number.isFinite(Number(started.interval)) ? Number(started.interval) : 3;
+  for (; ; ) {
+    if (Date.now() >= deadline) throw new CliError("Timed out waiting for approval. Run `openwop login` again for a new code.", 1);
+    await sleep2(Math.max(0, intervalS) * 1e3);
+    let res;
+    try {
+      res = (await requestJson(anon, `${BASE10}/poll`, { method: "POST", body: { deviceCode } })).body;
+    } catch (err) {
+      if (err instanceof HttpError && err.status === 404) {
+        throw new CliError("That sign-in expired or was already used. Run `openwop login` again for a new code.", 1);
+      }
+      throw err;
+    }
+    if (res?.status === "pending") {
+      if (Number.isFinite(Number(res.interval))) intervalS = Number(res.interval);
+      continue;
+    }
+    if (res?.status === "denied") throw new CliError("The sign-in was denied in the app.", 1);
+    if (res?.status === "failed") throw new CliError(`The host could not issue a key: ${String(res.message ?? "unknown reason")}`, 1);
+    if (res?.status === "approved" && typeof res.token === "string") {
+      const configPath = configPathFor(options.profile, ctx.env);
+      saveConfig(configPath, mergeConfig(readConfigSafe(configPath), { host: { baseUrl: ctx.baseUrl, apiKey: res.token } }));
+      const key = res.key ?? {};
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, { status: "signed-in", keyId: key.keyId ?? null, name: key.name ?? null, expiresAt: key.expiresAt ?? null, configPath });
+        return 0;
+      }
+      writeLine(ctx.io.stdout, `Signed in to ${ctx.baseUrl} as \u201C${key.name ?? `CLI: ${label}`}\u201D.`);
+      if (key.expiresAt) writeLine(ctx.io.stdout, `The key expires ${String(key.expiresAt).slice(0, 10)}; run \`openwop login\` again to renew.`);
+      writeLine(ctx.io.stdout, `Saved to ${configPath}. Revoke it any time with \`openwop logout\` or in the app.`);
+      return 0;
+    }
+    throw new CliError("The host answered the sign-in in a shape this CLI does not understand.", 1);
+  }
+}
+async function runLogout(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--profile"] });
+  if (options.help) {
+    write(ctx.io.stdout, LOGIN_HELP);
+    return 0;
+  }
+  const configPath = configPathFor(options.profile, ctx.env);
+  const config = readConfigSafe(configPath);
+  const saved = config?.host?.apiKey;
+  if (typeof saved !== "string" || saved.length === 0) {
+    if (ctx.json) writeJson(ctx.io.stdout, { status: "not-signed-in" });
+    else writeLine(ctx.io.stdout, "Not signed in: no key is saved in your config.");
+    return 0;
+  }
+  let revoked = false;
+  let note = "";
+  try {
+    await requestJson({ ...ctx, apiKey: saved }, `${BASE10}/logout`, { method: "POST", body: {} });
+    revoked = true;
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 401) note = "The host no longer recognised the key (already revoked or expired).";
+    else if (err instanceof HttpError && err.status === 404) note = "This host has no sign-out route; the key was NOT revoked there \u2014 revoke it in the app.";
+    else if (err instanceof HttpError && err.status === 400) note = "The saved key is not one a sign-in issued; it was NOT revoked on the host \u2014 revoke it in the app.";
+    else throw err;
+  }
+  unsetByPath(config, "host.apiKey");
+  saveConfig(configPath, config);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { status: "signed-out", revokedOnHost: revoked, ...note ? { note } : {} });
+    return 0;
+  }
+  writeLine(ctx.io.stdout, revoked ? "Signed out. The key was revoked on the host and removed from your config." : `Removed the key from your config. ${note}`);
+  return 0;
+}
+
 // src/cli/providers.ts
 var PROVIDERS_HELP = `Usage:
   openwop providers list [--json]
@@ -18086,7 +18271,7 @@ Examples:
   openwop profiles pin r_123
   openwop profiles activity --limit 10 --status failed
 `;
-var BASE10 = "/v1/host/openwop-app/profiles";
+var BASE11 = "/v1/host/openwop-app/profiles";
 async function profilesRequest(ctx, path, options, notFoundMsg) {
   try {
     return await requestJson(ctx, path, options);
@@ -18183,7 +18368,7 @@ async function runList2(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles list [--json]\n");
     return 0;
   }
-  const res = await profilesRequest(ctx, BASE10);
+  const res = await profilesRequest(ctx, BASE11);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18209,7 +18394,7 @@ async function runGet3(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles get [<userId>] [--json]\n");
     return options.help ? 0 : 2;
   }
-  const path = positionals.length === 1 ? `${BASE10}/${encodeURIComponent(positionals[0])}` : `${BASE10}/me`;
+  const path = positionals.length === 1 ? `${BASE11}/${encodeURIComponent(positionals[0])}` : `${BASE11}/me`;
   const res = await profilesRequest(ctx, path, void 0, `Profile not found: ${positionals[0] ?? "me"}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -18228,7 +18413,7 @@ async function runActivity(ctx, argv) {
   if (options.limit !== void 0) qs2.set("limit", String(options.limit));
   if (options.status !== void 0) qs2.set("status", String(options.status));
   const q = qs2.toString();
-  const res = await profilesRequest(ctx, `${BASE10}/me/activity${q ? `?${q}` : ""}`);
+  const res = await profilesRequest(ctx, `${BASE11}/me/activity${q ? `?${q}` : ""}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18267,7 +18452,7 @@ async function runEdit(ctx, argv) {
   if (Array.isArray(options.interests)) body.interests = options.interests;
   if (Array.isArray(options.growthInterests)) body.growthInterests = options.growthInterests;
   if (options.location !== void 0 || Array.isArray(options.link)) {
-    const current = (await profilesRequest(ctx, `${BASE10}/me`)).body?.contact ?? {};
+    const current = (await profilesRequest(ctx, `${BASE11}/me`)).body?.contact ?? {};
     const contact = { ...current };
     if (options.location !== void 0) contact.location = options.location;
     if (Array.isArray(options.link)) {
@@ -18294,7 +18479,7 @@ async function runEdit(ctx, argv) {
   }
   if (Object.keys(avail).length) body.availability = avail;
   if (Object.keys(body).length === 0) throw new CliError("Nothing to edit \u2014 pass at least one field.", 2);
-  const res = await profilesRequest(ctx, `${BASE10}/me`, { method: "PATCH", body });
+  const res = await profilesRequest(ctx, `${BASE11}/me`, { method: "PATCH", body });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18320,7 +18505,7 @@ async function runSkillsSet(ctx, argv) {
     if (!Number.isFinite(prof2) || prof2 < 1 || prof2 > 5) throw new CliError(`--skill proficiency must be 1..5 (got '${e}')`, 2);
     return { name, proficiency: prof2 };
   });
-  const res = await profilesRequest(ctx, `${BASE10}/me/skills`, { method: "PUT", body: { skills } });
+  const res = await profilesRequest(ctx, `${BASE11}/me/skills`, { method: "PUT", body: { skills } });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18335,7 +18520,7 @@ async function runPortfolioAdd(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles portfolio add --token <mediaToken> [--json]\n");
     return options.help ? 0 : 2;
   }
-  const res = await profilesRequest(ctx, `${BASE10}/me/portfolio`, { method: "POST", body: { token: options.token } });
+  const res = await profilesRequest(ctx, `${BASE11}/me/portfolio`, { method: "POST", body: { token: options.token } });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18349,7 +18534,7 @@ async function runPortfolioRemove(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop profiles portfolio remove <mediaToken> [--json]\n");
     return options.help ? 0 : 2;
   }
-  const res = await profilesRequest(ctx, `${BASE10}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
+  const res = await profilesRequest(ctx, `${BASE11}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -18364,7 +18549,7 @@ async function runPin(ctx, argv, pinned) {
 `);
     return options.help ? 0 : 2;
   }
-  const path = `${BASE10}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
+  const path = `${BASE11}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
   const res = await profilesRequest(ctx, path, { method: pinned ? "PUT" : "DELETE" }, `Agent not found: ${positionals[0]}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -18381,7 +18566,7 @@ async function runEndorse(ctx, argv, add) {
     return options.help ? 0 : 2;
   }
   const [userId, skill] = positionals;
-  const path = `${BASE10}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
+  const path = `${BASE11}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
   const res = await profilesRequest(ctx, path, { method: add ? "POST" : "DELETE" }, `Profile or skill not found: ${userId} / ${skill}`);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -19476,7 +19661,7 @@ Examples:
   openwop auth saml validate --idp-url http://localhost:9100/idp --variant valid
   openwop auth scim provision --op create-user --user-name jo@acme.com --email jo@acme.com
 `;
-var BASE11 = "/v1/host/openwop-app/auth";
+var BASE12 = "/v1/host/openwop-app/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
   return redactSecrets(value, { secret: SECRET_KEY2 });
@@ -19527,7 +19712,7 @@ async function runStatus(ctx, argv) {
   const profiles = disc.ok && Array.isArray(disc.body?.capabilities?.auth?.profiles) ? disc.body.capabilities.auth.profiles : [];
   const samlAdvertised = profiles.includes("openwop-auth-saml");
   const scimAdvertised = profiles.includes("openwop-auth-scim");
-  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE11}/saml/sso/metadata`)).ok : false;
+  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE12}/saml/sso/metadata`)).ok : false;
   if (ctx.json) {
     writeJson(ctx.io.stdout, {
       authProfilesAdvertised: profiles,
@@ -19552,7 +19737,7 @@ async function runSamlMetadata(ctx, argv) {
     write(ctx.io.stdout, "Usage: openwop auth saml metadata [--json]\n");
     return 0;
   }
-  const res = await authRequest(ctx, `${BASE11}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
+  const res = await authRequest(ctx, `${BASE12}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
   const xml = typeof res.body?.raw === "string" ? res.body.raw : typeof res.body === "string" ? res.body : JSON.stringify(res.body);
   if (ctx.json) {
     writeJson(ctx.io.stdout, { metadata: xml });
@@ -19570,7 +19755,7 @@ async function runSamlLoginUrl(ctx, argv) {
   }
   const returnTo = options.returnTo ?? "/";
   const base16 = ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`;
-  const url = new URL(`${BASE11}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base16);
+  const url = new URL(`${BASE12}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base16);
   const res = await ctx.fetchImpl(url, { method: "GET", redirect: "manual" });
   if (res.status === 404) {
     throw new CliError("SAML SSO is not configured on this host (set OPENWOP_SAML_*).", 1);
@@ -19595,7 +19780,7 @@ async function runSamlValidate(ctx, argv) {
   const body = { idpUrl: options.idpUrl, variant: options.variant };
   let res;
   try {
-    res = await requestJson(ctx, `${BASE11}/saml/validate`, { method: "POST", body });
+    res = await requestJson(ctx, `${BASE12}/saml/validate`, { method: "POST", body });
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
       throw new CliError("SAML validation seam not configured on this host (set OPENWOP_TEST_SAML_IDP_URL).", 1);
@@ -19638,7 +19823,7 @@ async function runScimProvision(ctx, argv) {
   if (options.displayName !== void 0) user.displayName = options.displayName;
   const body = { op: options.op, user };
   if (options.group !== void 0) body.group = options.group;
-  const res = await authRequest(ctx, `${BASE11}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
+  const res = await authRequest(ctx, `${BASE12}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
   const safe = redact2(res.body ?? {});
   if (ctx.json) {
     writeJson(ctx.io.stdout, safe);
@@ -19662,7 +19847,7 @@ async function runBreakGlass(ctx, argv) {
   const token = await readSecretInput(ctx, options.tokenFile !== void 0 ? { valueFile: options.tokenFile } : {}, "Break-glass token");
   let res;
   try {
-    res = await requestJson(ctx, `${BASE11}/break-glass`, { method: "POST", body: { token } });
+    res = await requestJson(ctx, `${BASE12}/break-glass`, { method: "POST", body: { token } });
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) throw new CliError("Break-glass login is not enabled on this host (OPENWOP_BREAKGLASS_ENABLED is not true).", 1);
     if (err instanceof HttpError && err.status === 401) throw new CliError("Break-glass login refused (wrong, short, or already-used token, or the host is misconfigured). The attempt was audited.", 4);
@@ -19991,10 +20176,9 @@ function exitForState(state) {
   return 1;
 }
 async function ensureAdvertised3(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  const advertised = !!(body.capabilities?.agents?.proposals ?? body.agents?.proposals);
+  const record = await advertisedRecord(ctx, (b) => b.capabilities?.agents?.proposals ?? b.agents?.proposals);
+  if (record === void 0) return;
+  const advertised = !!record;
   if (!advertised) {
     throw new CliError(
       "proposals: this host does not advertise the reviewable-learning proposal capability (capabilities.agents.proposals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -20323,10 +20507,9 @@ function exitForState2(state) {
   return 1;
 }
 async function ensureAdvertised4(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  const advertised = !!(body.capabilities?.agents?.goals ?? body.agents?.goals);
+  const record = await advertisedRecord(ctx, (b) => b.capabilities?.agents?.goals ?? b.agents?.goals);
+  if (record === void 0) return;
+  const advertised = !!record;
   if (!advertised) {
     throw new CliError(
       "goals: this host does not advertise the standing-goals capability (capabilities.agents.goals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -20594,10 +20777,9 @@ function redact3(value) {
   return redactSecrets(value, { secret: SECRET_KEY3, keep: REF_ONLY_KEY });
 }
 async function ensureAdvertised5(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  const advertised = !!(body.capabilities?.portability ?? body.portability);
+  const record = await advertisedRecord(ctx, (b) => b.capabilities?.portability ?? b.portability);
+  if (record === void 0) return;
+  const advertised = !!record;
   if (!advertised) {
     throw new CliError(
       "portability: this host does not advertise the export/import capability (capabilities.portability is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -20844,10 +21026,7 @@ function exitForState3(state) {
   return 1;
 }
 async function triggerBridgeCaps(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return void 0;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  return body.capabilities?.triggerBridge ?? body.triggerBridge ?? null;
+  return advertisedRecord(ctx, (b) => b.capabilities?.triggerBridge ?? b.triggerBridge);
 }
 async function ensureAdvertised6(ctx) {
   const tb = await triggerBridgeCaps(ctx);
@@ -21107,10 +21286,7 @@ function exitForState4(state) {
   return 1;
 }
 async function a2aCaps(ctx) {
-  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
-  if (!wk.ok) return void 0;
-  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
-  return body.capabilities?.a2a ?? body.a2a ?? null;
+  return advertisedRecord(ctx, (b) => b.capabilities?.a2a ?? b.a2a);
 }
 async function runStatus2(ctx, argv) {
   const { options } = parseOptions(argv, { bool: ["--help"] });
@@ -21127,7 +21303,7 @@ async function runStatus2(ctx, argv) {
     writeLine(ctx.io.stdout, "This host does not advertise A2A (capabilities.a2a absent).");
     return 1;
   }
-  writeLine(ctx.io.stdout, `a2a.supported: ${a2a.supported ? "yes" : "no"}`);
+  writeLine(ctx.io.stdout, `a2a.supported: ${a2a.supported ?? true ? "yes" : "no"}`);
   if (a2a.agentCardUrl) writeLine(ctx.io.stdout, `agentCardUrl: ${a2a.agentCardUrl}`);
   writeLine(ctx.io.stdout, `streaming: ${a2a.streaming ? "yes" : "no"}`);
   writeLine(ctx.io.stdout, `pushNotifications: ${a2a.pushNotifications ? "yes" : "no"}`);
@@ -21316,7 +21492,7 @@ Run \`openwop docs --help\` for usage.`);
 }
 
 // src/cli/knowledgeSync.ts
-var BASE12 = "/v1/host/openwop-app/knowledge-sync";
+var BASE13 = "/v1/host/openwop-app/knowledge-sync";
 var KNOWLEDGE_SYNC_HELP = `Usage:
   openwop knowledge-sync list --org <orgId> [--json]
   openwop knowledge-sync get <sourceId> [--json]
@@ -21376,12 +21552,12 @@ async function runKnowledgeSync(ctx, argv) {
   switch (sub) {
     case "list": {
       if (!options.org) return usage4(ctx, "list --org <orgId>");
-      const res = await requestJson(ctx, withQuery(BASE12, { orgId: String(options.org) }));
+      const res = await requestJson(ctx, withQuery(BASE13, { orgId: String(options.org) }));
       return renderList(ctx, res.body, pickArray(res.body, "sources"), ["id", "provider", "collectionId", "cadence", "status", "lastSyncedAt"], "No sync sources.");
     }
     case "get": {
       if (!id) return usage4(ctx, "get <sourceId>");
-      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE12}/${enc2(id)}`)).body);
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE13}/${enc2(id)}`)).body);
       return 0;
     }
     case "create": {
@@ -21397,12 +21573,12 @@ async function runKnowledgeSync(ctx, argv) {
       if (options.cadence) body.cadence = String(options.cadence);
       if (options.provider) body.provider = String(options.provider);
       if (options.noMedia) body.includeMedia = false;
-      const res = await requestJson(ctx, BASE12, { method: "POST", body });
+      const res = await requestJson(ctx, BASE13, { method: "POST", body });
       return renderDone(ctx, res.body, `Created sync source ${res.body?.source?.id ?? ""}.`);
     }
     case "browse": {
       if (!options.org || !options.connection) return usage4(ctx, "browse --org <orgId> --connection <connectionId> [--folder id]");
-      const res = await requestJson(ctx, withQuery(`${BASE12}/browse`, {
+      const res = await requestJson(ctx, withQuery(`${BASE13}/browse`, {
         orgId: String(options.org),
         connectionId: String(options.connection),
         folderId: options.folder
@@ -21411,18 +21587,18 @@ async function runKnowledgeSync(ctx, argv) {
     }
     case "update": {
       if (!id || !options.includeMedia && !options.noMedia) return usage4(ctx, "update <sourceId> (--include-media | --no-media)");
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}`, { method: "PATCH", body: { includeMedia: !options.noMedia } });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}`, { method: "PATCH", body: { includeMedia: !options.noMedia } });
       return renderDone(ctx, res.body, `Updated sync source ${id} (media ${options.noMedia ? "excluded" : "included"}).`);
     }
     case "pause":
     case "resume": {
       if (!id) return usage4(ctx, `${sub} <sourceId>`);
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}/${sub}`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}/${sub}`, { method: "POST", body: {} });
       return renderDone(ctx, res.body, `${sub === "pause" ? "Paused" : "Resumed"} sync source ${id}.`);
     }
     case "sync": {
       if (!id) return usage4(ctx, "sync <sourceId>");
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}/sync`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}/sync`, { method: "POST", body: {} });
       const r = res.body?.result ?? {};
       const counts = Object.entries(r).filter(([, v]) => typeof v === "number").map(([k, v]) => `${k}=${v}`).join(" ");
       return renderDone(ctx, res.body, `Synced source ${id}${counts ? `: ${counts}` : "."}`);
@@ -21430,7 +21606,7 @@ async function runKnowledgeSync(ctx, argv) {
     case "delete": {
       if (!id) return usage4(ctx, "delete <sourceId> [--yes]");
       if (!options.yes) throw new CliError(`Refusing to delete sync source ${id} without --yes.`, 2);
-      const res = await requestJson(ctx, `${BASE12}/${enc2(id)}`, { method: "DELETE" });
+      const res = await requestJson(ctx, `${BASE13}/${enc2(id)}`, { method: "DELETE" });
       return renderDone(ctx, res.body, `Deleted sync source ${id}.`);
     }
     default:
@@ -21442,7 +21618,7 @@ Run \`openwop knowledge-sync --help\` for usage.`);
 // src/cli/entities.ts
 import { readFileSync as readFileSync18, writeFileSync as writeFileSync14 } from "node:fs";
 import { resolve as resolvePath9 } from "node:path";
-var BASE13 = "/v1/host/openwop-app/entities";
+var BASE14 = "/v1/host/openwop-app/entities";
 var PUBLIC_BASE2 = "/v1/host/openwop-app/public-entities";
 var ENTITIES_HELP = `Usage:
   openwop entities locale-context [--json]
@@ -21564,7 +21740,7 @@ async function runEntities(ctx, argv) {
   const q = (path, extra = {}) => withQuery(path, { projectId: project4, ...extra });
   switch (family) {
     case "locale-context": {
-      const res = await requestJson(ctx, q(`${BASE13}/locale-context`));
+      const res = await requestJson(ctx, q(`${BASE14}/locale-context`));
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -21596,10 +21772,10 @@ Run \`openwop entities --help\` for usage.`);
 }
 async function types(ctx, sub, pos, o, project4, q) {
   const name = pos[0];
-  const typePath = (n) => `${BASE13}/types/${enc2(n)}`;
+  const typePath = (n) => `${BASE14}/types/${enc2(n)}`;
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, q(`${BASE13}/types`));
+      const res = await requestJson(ctx, q(`${BASE14}/types`));
       return renderList(
         ctx,
         res.body,
@@ -21623,7 +21799,7 @@ async function types(ctx, sub, pos, o, project4, q) {
         projectId: project4
       });
       if (!body.name) return usage5(ctx, "types create --name <n> [--fields <json>]");
-      const res = await requestJson(ctx, `${BASE13}/types`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE14}/types`, { method: "POST", body });
       return renderDone(ctx, res.body, `Created entity type ${res.body?.name ?? body.name}.`);
     }
     case "update": {
@@ -21698,7 +21874,7 @@ async function types(ctx, sub, pos, o, project4, q) {
 async function records(ctx, sub, pos, o, _project, q) {
   const [type, id] = pos;
   if (!type) return usage5(ctx, `${sub} <type>${sub === "list" || sub === "create" ? "" : " <entityId>"}`);
-  const coll = `${BASE13}/types/${enc2(type)}/entities`;
+  const coll = `${BASE14}/types/${enc2(type)}/entities`;
   const recordBody = () => mergeBody(ctx, o, {
     values: o.values !== void 0 ? parseJsonFlag("--values", o.values) : void 0,
     termIds: csv(o.termIds),
@@ -21743,7 +21919,7 @@ async function records(ctx, sub, pos, o, _project, q) {
 async function taxonomies(ctx, sub, pos, o, project4, q) {
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, q(`${BASE13}/taxonomies`));
+      const res = await requestJson(ctx, q(`${BASE14}/taxonomies`));
       return renderList(ctx, res.body, pickArray(res.body, "taxonomies"), ["name", "displayName"], "No taxonomies.");
     }
     case "create": {
@@ -21753,14 +21929,14 @@ async function taxonomies(ctx, sub, pos, o, project4, q) {
         projectId: project4
       });
       if (!body.name) return usage5(ctx, "taxonomies create --name <n> [--display-name d]");
-      const res = await requestJson(ctx, `${BASE13}/taxonomies`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE14}/taxonomies`, { method: "POST", body });
       return renderDone(ctx, res.body, `Created taxonomy ${res.body?.name ?? body.name}.`);
     }
     case "delete": {
       const name = pos[0];
       if (!name) return usage5(ctx, "taxonomies delete <taxonomy> --yes");
       confirm(o, `taxonomy ${name}`);
-      await requestJson(ctx, q(`${BASE13}/taxonomies/${enc2(name)}`), { method: "DELETE" });
+      await requestJson(ctx, q(`${BASE14}/taxonomies/${enc2(name)}`), { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted taxonomy ${name}.`);
       return 0;
     }
@@ -21771,7 +21947,7 @@ async function taxonomies(ctx, sub, pos, o, project4, q) {
 async function terms(ctx, sub, pos, o, project4, q) {
   const [tax, slug] = pos;
   if (!tax) return usage5(ctx, `terms ${sub} <taxonomy>`);
-  const coll = `${BASE13}/taxonomies/${enc2(tax)}/terms`;
+  const coll = `${BASE14}/taxonomies/${enc2(tax)}/terms`;
   switch (sub) {
     case "list": {
       const res = await requestJson(ctx, q(coll));
@@ -21823,7 +21999,7 @@ async function terms(ctx, sub, pos, o, project4, q) {
 async function relationships(ctx, sub, pos, o, project4, q) {
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, q(`${BASE13}/relationships`));
+      const res = await requestJson(ctx, q(`${BASE14}/relationships`));
       return renderList(ctx, res.body, pickArray(res.body, "relationships"), ["fromTypeName", "toTypeName", "cardinality", "onDelete"], "No relationships.");
     }
     case "create": {
@@ -21835,14 +22011,14 @@ async function relationships(ctx, sub, pos, o, project4, q) {
         projectId: project4
       });
       if (!body.fromTypeName || !body.toTypeName) return usage5(ctx, "relationships create --from <type> --to <type>");
-      const res = await requestJson(ctx, `${BASE13}/relationships`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE14}/relationships`, { method: "POST", body });
       return renderDone(ctx, res.body, `Created relationship ${body.fromTypeName} \u2192 ${body.toTypeName}.`);
     }
     case "delete": {
       const [from, to] = pos;
       if (!from || !to) return usage5(ctx, "relationships delete <fromType> <toType> --yes");
       confirm(o, `relationship ${from} \u2192 ${to}`);
-      await requestJson(ctx, q(`${BASE13}/relationships/${enc2(from)}/${enc2(to)}`), { method: "DELETE" });
+      await requestJson(ctx, q(`${BASE14}/relationships/${enc2(from)}/${enc2(to)}`), { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted relationship ${from} \u2192 ${to}.`);
       return 0;
     }
@@ -22430,7 +22606,7 @@ Run \`openwop production --help\` for usage.`);
 }
 
 // src/cli/tutorials.ts
-var BASE14 = "/v1/host/openwop-app/tutorials";
+var BASE15 = "/v1/host/openwop-app/tutorials";
 var TUTORIALS_HELP = `Usage:
   openwop tutorials list [--json]
   openwop tutorials get <slug> [--json]
@@ -22438,9 +22614,9 @@ var TUTORIALS_HELP = `Usage:
   openwop tutorials progress set <tutorialId> --steps <id,id,...> [--json]
   openwop tutorials progress clear <tutorialId> [--json]
 
-The tutorial library (GET ${BASE14}) and one tutorial in full (GET ${BASE14}/<slug>).
-\`progress\` reads YOUR saved steps (GET ${BASE14}/progress); \`progress set\` replaces a
-tutorial's completed steps and \`progress clear\` resets them (POST ${BASE14}/progress,
+The tutorial library (GET ${BASE15}) and one tutorial in full (GET ${BASE15}/<slug>).
+\`progress\` reads YOUR saved steps (GET ${BASE15}/progress); \`progress set\` replaces a
+tutorial's completed steps and \`progress clear\` resets them (POST ${BASE15}/progress,
 body { tutorialId, completedStepIds, mode? }). The server stamps the user \u2014 you can
 only write your own progress; anonymous sessions cannot save.
 
@@ -22464,7 +22640,7 @@ async function runTutorials(ctx, argv) {
   }
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, BASE14);
+      const res = await requestJson(ctx, BASE15);
       const items = Array.isArray(res.body?.tutorials) ? res.body.tutorials : [];
       const code = renderList(ctx, res.body, items, ["id", "category", "title", "source"], "No tutorials.");
       if (!ctx.json && res.body?.degraded) writeLine(ctx.io.stdout, "(shipped copy \u2014 the tenant library was unreachable)");
@@ -22476,13 +22652,13 @@ async function runTutorials(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop tutorials get <slug>\n");
         return 2;
       }
-      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE14}/${enc2(slug)}`)).body);
+      writeJson(ctx.io.stdout, (await requestJson(ctx, `${BASE15}/${enc2(slug)}`)).body);
       return 0;
     }
     case "progress": {
       const action = positionals[0];
       if (!action) {
-        const res2 = await requestJson(ctx, `${BASE14}/progress`);
+        const res2 = await requestJson(ctx, `${BASE15}/progress`);
         const items = Array.isArray(res2.body?.progress) ? res2.body.progress : [];
         const code = renderList(
           ctx,
@@ -22505,7 +22681,7 @@ async function runTutorials(ctx, argv) {
         return 2;
       }
       const body = action === "set" ? { tutorialId, completedStepIds: csv(options.steps) ?? [] } : { tutorialId, completedStepIds: [], mode: "clear" };
-      const res = await requestJson(ctx, `${BASE14}/progress`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE15}/progress`, { method: "POST", body });
       return renderDone(ctx, res.body, action === "set" ? `Saved ${Array.isArray(res.body?.completedStepIds) ? res.body.completedStepIds.length : body.completedStepIds.length} completed step(s) for ${tutorialId}.` : `Cleared progress for ${tutorialId}.`);
     }
     default:
@@ -22515,16 +22691,16 @@ Run \`openwop tutorials --help\` for usage.`);
 }
 
 // src/cli/walkthroughs.ts
-var BASE15 = "/v1/host/openwop-app/walkthroughs";
+var BASE16 = "/v1/host/openwop-app/walkthroughs";
 var WALKTHROUGHS_HELP = `Usage:
   openwop walkthroughs progress [--json]
   openwop walkthroughs progress set <walkthroughId> --status started|completed --run <runId> [--json]
   openwop walkthroughs funnel <walkthroughId> [--json]
 
-\`progress\` reads your walkthrough progress (GET ${BASE15}/progress); \`progress set\`
-records one (POST ${BASE15}/progress, body { walkthroughId, status, runId }).
+\`progress\` reads your walkthrough progress (GET ${BASE16}/progress); \`progress set\`
+records one (POST ${BASE16}/progress, body { walkthroughId, status, runId }).
 \`funnel\` shows run-status counts + where runs stalled for one walkthrough
-(GET ${BASE15}/funnel?walkthroughId=\u2026) \u2014 a recent-window view over the newest runs.
+(GET ${BASE16}/funnel?walkthroughId=\u2026) \u2014 a recent-window view over the newest runs.
 
 Exit codes: 0 ok \xB7 2 usage / validation / feature off \xB7 4 forbidden.
 
@@ -22552,10 +22728,10 @@ async function runWalkthroughs(ctx, argv) {
           write(ctx.io.stderr, "Usage: openwop walkthroughs progress set <walkthroughId> --status started|completed --run <runId>\n");
           return 2;
         }
-        const res2 = await requestJson(ctx, `${BASE15}/progress`, { method: "POST", body: { walkthroughId, status: String(options.status), runId: String(options.run) } });
+        const res2 = await requestJson(ctx, `${BASE16}/progress`, { method: "POST", body: { walkthroughId, status: String(options.status), runId: String(options.run) } });
         return renderDone(ctx, res2.body, `Recorded ${walkthroughId} as ${String(options.status)}.`);
       }
-      const res = await requestJson(ctx, `${BASE15}/progress`);
+      const res = await requestJson(ctx, `${BASE16}/progress`);
       const items = Array.isArray(res.body?.progress) ? res.body.progress : [];
       return renderList(ctx, res.body, items, ["walkthroughId", "status", "runId", "updatedAt"], "No walkthrough progress.");
     }
@@ -22565,7 +22741,7 @@ async function runWalkthroughs(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop walkthroughs funnel <walkthroughId>\n");
         return 2;
       }
-      const res = await requestJson(ctx, withQuery(`${BASE15}/funnel`, { walkthroughId }));
+      const res = await requestJson(ctx, withQuery(`${BASE16}/funnel`, { walkthroughId }));
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -22586,7 +22762,7 @@ Run \`openwop walkthroughs --help\` for usage.`);
 }
 
 // src/cli/widgets.ts
-var BASE16 = "/v1/host/openwop-app/widgets";
+var BASE17 = "/v1/host/openwop-app/widgets";
 var WIDGETS_HELP = `Usage:
   openwop widgets list [--json]
   openwop widgets summary [--json]
@@ -22594,8 +22770,8 @@ var WIDGETS_HELP = `Usage:
   openwop widgets archive <widgetId> [--json]
   openwop widgets seed [--json]
 
-The reference example domain (GET/POST ${BASE16}, GET ${BASE16}/summary,
-POST ${BASE16}/<id>/archive, POST ${BASE16}/seed). Mounted only when the host sets
+The reference example domain (GET/POST ${BASE17}, GET ${BASE17}/summary,
+POST ${BASE17}/<id>/archive, POST ${BASE17}/seed). Mounted only when the host sets
 OPENWOP_EXAMPLE_WIDGETS_ENABLED=true. \`seed\` is idempotent (\`seeded: false\` on a
 re-run). Archiving an already-archived widget is a conflict (exit 2), never a
 silent success.
@@ -22621,12 +22797,12 @@ async function runWidgets(ctx, argv) {
   try {
     switch (sub) {
       case "list": {
-        const res = await requestJson(ctx, BASE16);
+        const res = await requestJson(ctx, BASE17);
         const items = Array.isArray(res.body?.widgets) ? res.body.widgets : [];
         return renderList(ctx, res.body, items, ["id", "name", "status"], "No widgets.");
       }
       case "summary": {
-        const res = await requestJson(ctx, `${BASE16}/summary`);
+        const res = await requestJson(ctx, `${BASE17}/summary`);
         if (ctx.json) {
           writeJson(ctx.io.stdout, res.body);
           return 0;
@@ -22640,7 +22816,7 @@ async function runWidgets(ctx, argv) {
           write(ctx.io.stderr, "widgets create needs --name.\n");
           return 2;
         }
-        const res = await requestJson(ctx, BASE16, { method: "POST", body: { name: String(options.name) } });
+        const res = await requestJson(ctx, BASE17, { method: "POST", body: { name: String(options.name) } });
         return renderDone(ctx, res.body, `Created widget ${res.body?.id ?? ""} (${String(options.name)}).`);
       }
       case "archive": {
@@ -22649,11 +22825,11 @@ async function runWidgets(ctx, argv) {
           write(ctx.io.stderr, "Usage: openwop widgets archive <widgetId>\n");
           return 2;
         }
-        const res = await requestJson(ctx, `${BASE16}/${enc2(id)}/archive`, { method: "POST", body: {} });
+        const res = await requestJson(ctx, `${BASE17}/${enc2(id)}/archive`, { method: "POST", body: {} });
         return renderDone(ctx, res.body, `Archived widget ${id}.`);
       }
       case "seed": {
-        const res = await requestJson(ctx, `${BASE16}/seed`, { method: "POST", body: {} });
+        const res = await requestJson(ctx, `${BASE17}/seed`, { method: "POST", body: {} });
         return renderDone(ctx, res.body, res.body?.seeded === false ? "Example widgets already seeded (no-op)." : "Seeded example widgets.");
       }
       default:
@@ -22673,17 +22849,17 @@ Run \`openwop widgets --help\` for usage.`);
 }
 
 // src/cli/uiState.ts
-var BASE17 = "/v1/host/openwop-app/ui-state";
+var BASE18 = "/v1/host/openwop-app/ui-state";
 var UI_STATE_HELP = `Usage:
   openwop ui-state list [--resource-type <t>] [--resource-id <id>] [--json]
   openwop ui-state get <resourceType> <resourceId> <key> [--json]
   openwop ui-state set <resourceType> <resourceId> <key> --value <json> [--json]
   openwop ui-state delete <resourceType> <resourceId> <key>
 
-\`list\` reads your rows (GET ${BASE17}?resourceType=&resourceId=); \`get\` filters one
-key from that list. \`set\` writes one key (PUT ${BASE17}, body { resourceType,
+\`list\` reads your rows (GET ${BASE18}?resourceType=&resourceId=); \`get\` filters one
+key from that list. \`set\` writes one key (PUT ${BASE18}, body { resourceType,
 resourceId, key, value }); --value is parsed as JSON, falling back to a string.
-\`delete\` removes one key (DELETE ${BASE17}/<type>/<id>/<key>).
+\`delete\` removes one key (DELETE ${BASE18}/<type>/<id>/<key>).
 
 Exit codes: 0 ok \xB7 2 usage / not found \xB7 4 forbidden.
 
@@ -22706,7 +22882,7 @@ async function runUiState(ctx, argv) {
   const [resourceType, resourceId, key] = positionals;
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, withQuery(BASE17, { resourceType: options.resourceType, resourceId: options.resourceId }));
+      const res = await requestJson(ctx, withQuery(BASE18, { resourceType: options.resourceType, resourceId: options.resourceId }));
       const items = Array.isArray(res.body?.items) ? res.body.items : [];
       return renderList(ctx, res.body, items, ["resourceType", "resourceId", "key", "value"], "No saved UI state.");
     }
@@ -22715,7 +22891,7 @@ async function runUiState(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop ui-state get <resourceType> <resourceId> <key>\n");
         return 2;
       }
-      const res = await requestJson(ctx, withQuery(BASE17, { resourceType, resourceId }));
+      const res = await requestJson(ctx, withQuery(BASE18, { resourceType, resourceId }));
       const items = Array.isArray(res.body?.items) ? res.body.items : [];
       const hit = items.find((i) => i?.key === key);
       if (!hit) throw new CliError(`No ui-state for ${resourceType}/${resourceId}/${key}.`, 2);
@@ -22734,7 +22910,7 @@ async function runUiState(ctx, argv) {
       } catch {
         value = String(options.value);
       }
-      const res = await requestJson(ctx, BASE17, { method: "PUT", body: { resourceType, resourceId, key, value } });
+      const res = await requestJson(ctx, BASE18, { method: "PUT", body: { resourceType, resourceId, key, value } });
       return renderDone(ctx, res.body, `Saved ${resourceType}/${resourceId}/${key}.`);
     }
     case "delete": {
@@ -22742,7 +22918,7 @@ async function runUiState(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop ui-state delete <resourceType> <resourceId> <key>\n");
         return 2;
       }
-      await requestJson(ctx, `${BASE17}/${enc2(resourceType)}/${enc2(resourceId)}/${enc2(key)}`, { method: "DELETE" });
+      await requestJson(ctx, `${BASE18}/${enc2(resourceType)}/${enc2(resourceId)}/${enc2(key)}`, { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted ${resourceType}/${resourceId}/${key}.`);
       return 0;
     }
@@ -22755,8 +22931,8 @@ Run \`openwop ui-state --help\` for usage.`);
 // src/cli/uiPlugin.ts
 import { writeFileSync as writeFileSync16 } from "node:fs";
 import { resolve as resolvePath11 } from "node:path";
-var BASE18 = "/v1/host/openwop-app/ui-plugin";
-var RPC_PRODUCT = `${BASE18}/rpc`;
+var BASE19 = "/v1/host/openwop-app/ui-plugin";
+var RPC_PRODUCT = `${BASE19}/rpc`;
 var RPC_CONFORMANCE = "/v1/host/sample/ui-plugin/rpc";
 var UI_PLUGIN_HELP = `Usage:
   openwop ui-plugin packs [--json]
@@ -22767,11 +22943,11 @@ var UI_PLUGIN_HELP = `Usage:
   openwop ui-plugin rpc --body <json> | --body-file <path>
 
 \`packs\` lists served plugins + the host's isolation mechanism + each plugin's tier
-(GET ${BASE18}/packs). \`entry\` fetches a plugin's sandboxed entry bundle
-(GET ${BASE18}/packs/<name>/plugins/<id>/entry); \`trusted-entry\` fetches a signed
-pack's main-frame ES module (GET ${BASE18}/trusted/<name>/plugins/<id>/entry.mjs \u2014
+(GET ${BASE19}/packs). \`entry\` fetches a plugin's sandboxed entry bundle
+(GET ${BASE19}/packs/<name>/plugins/<id>/entry); \`trusted-entry\` fetches a signed
+pack's main-frame ES module (GET ${BASE19}/trusted/<name>/plugins/<id>/entry.mjs \u2014
 404 unless the trusted-plugins toggle is on and the signature verifies).
-\`demo-artifact\` ensures the idempotent demo artifact (POST ${BASE18}/demo-artifact).
+\`demo-artifact\` ensures the idempotent demo artifact (POST ${BASE19}/demo-artifact).
 \`rpc\` sends one ui-plugin/1 request (POST ${RPC_PRODUCT}, body { message }); the
 message is { openwop: "ui-plugin/1", type: "request", id (integer,
 default 1), method, params } unless you pass a
@@ -22812,7 +22988,7 @@ async function runUiPlugin(ctx, argv) {
   }
   switch (sub) {
     case "packs": {
-      const res = await requestJson(ctx, `${BASE18}/packs`);
+      const res = await requestJson(ctx, `${BASE19}/packs`);
       const items = Array.isArray(res.body?.plugins) ? res.body.plugins : [];
       const code = renderList(ctx, res.body, items, ["packName", "pluginId", "tier"], "No UI plugins served.");
       if (!ctx.json && res.body?.isolation !== void 0) writeLine(ctx.io.stdout, `isolation: ${typeof res.body.isolation === "string" ? res.body.isolation : JSON.stringify(res.body.isolation)}`);
@@ -22826,7 +23002,7 @@ async function runUiPlugin(ctx, argv) {
 `);
         return 2;
       }
-      const path = sub === "entry" ? `${BASE18}/packs/${enc2(name)}/plugins/${enc2(pluginId)}/entry` : `${BASE18}/trusted/${enc2(name)}/plugins/${enc2(pluginId)}/entry.mjs`;
+      const path = sub === "entry" ? `${BASE19}/packs/${enc2(name)}/plugins/${enc2(pluginId)}/entry` : `${BASE19}/trusted/${enc2(name)}/plugins/${enc2(pluginId)}/entry.mjs`;
       const res = await fetchRawText(ctx, path);
       if (options.output) {
         writeFileSync16(resolvePath11(ctx.cwd, String(options.output)), res.text);
@@ -22838,7 +23014,7 @@ async function runUiPlugin(ctx, argv) {
       return 0;
     }
     case "demo-artifact": {
-      const res = await requestJson(ctx, `${BASE18}/demo-artifact`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE19}/demo-artifact`, { method: "POST", body: {} });
       return renderDone(ctx, res.body, `Demo artifact ${res.body?.artifactId ?? ""} (version ${res.body?.version ?? ""}).`);
     }
     case "rpc": {
@@ -22868,18 +23044,18 @@ Run \`openwop ui-plugin --help\` for usage.`);
 }
 
 // src/cli/canvasCollab.ts
-var BASE19 = "/v1/host/openwop-app/canvas-collab";
+var BASE20 = "/v1/host/openwop-app/canvas-collab";
 var CANVAS_COLLAB_HELP = `Usage:
   openwop canvas-collab ticket <canvasId> [--json]
   openwop canvas-collab claim-seed <canvasId> [--json]
   openwop canvas-collab debug [--json]
 
 \`ticket\` mints a short-lived collaboration ticket for one canvas
-(POST ${BASE19}/<canvasId>/ticket) \u2014 a credential for the collaboration socket's
+(POST ${BASE20}/<canvasId>/ticket) \u2014 a credential for the collaboration socket's
 ?ticket= parameter; it is printed once and never stored. \`claim-seed\` runs the
-seeder election (POST ${BASE19}/<canvasId>/claim-seed) \u2192 { seed: true } for the one
+seeder election (POST ${BASE20}/<canvasId>/claim-seed) \u2192 { seed: true } for the one
 caller that should seed a fresh room. \`debug\` lists this server instance's live
-rooms (GET ${BASE19}/_debug; super-admin only; lifecycle metadata, never content).
+rooms (GET ${BASE20}/_debug; super-admin only; lifecycle metadata, never content).
 
 Exit codes: 0 ok \xB7 2 usage / not found (uniform) \xB7 4 forbidden (debug without super-admin).
 
@@ -22913,7 +23089,7 @@ async function runCanvasCollab(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop canvas-collab ticket <canvasId>\n");
         return 2;
       }
-      const res = await requestJson(ctx, `${BASE19}/${enc2(id)}/ticket`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/ticket`, { method: "POST", body: {} });
       return printTicketOnce(ctx, res.body, `canvas ${id}`);
     }
     case "claim-seed": {
@@ -22921,13 +23097,13 @@ async function runCanvasCollab(ctx, argv) {
         write(ctx.io.stderr, "Usage: openwop canvas-collab claim-seed <canvasId>\n");
         return 2;
       }
-      const res = await requestJson(ctx, `${BASE19}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
       if (ctx.json) writeJson(ctx.io.stdout, res.body);
       else writeLine(ctx.io.stdout, res.body?.seed ? `You won the seed election for ${id} \u2014 seed the room.` : `Another client seeds ${id} (seed: false).`);
       return 0;
     }
     case "debug": {
-      const res = await requestJson(ctx, `${BASE19}/_debug`);
+      const res = await requestJson(ctx, `${BASE20}/_debug`);
       const items = Array.isArray(res.body?.instanceRooms) ? res.body.instanceRooms : [];
       return renderList(ctx, res.body, items, ["roomId", "tenantId", "clients", "openedAt"], "No live collaboration rooms on this instance.");
     }
@@ -22938,14 +23114,14 @@ Run \`openwop canvas-collab --help\` for usage.`);
 }
 
 // src/cli/workflowCollab.ts
-var BASE20 = "/v1/host/openwop-app/workflow-collab";
+var BASE21 = "/v1/host/openwop-app/workflow-collab";
 var WORKFLOW_COLLAB_HELP = `Usage:
   openwop workflow-collab ticket <workflowId> [--json]
   openwop workflow-collab claim-seed <workflowId> [--json]
 
 \`ticket\` mints a short-lived collaboration ticket for one workflow draft
-(POST ${BASE20}/<workflowId>/ticket) \u2014 shown once, never stored. \`claim-seed\` runs
-the seeder election (POST ${BASE20}/<workflowId>/claim-seed) \u2192 { seed }.
+(POST ${BASE21}/<workflowId>/ticket) \u2014 shown once, never stored. \`claim-seed\` runs
+the seeder election (POST ${BASE21}/<workflowId>/claim-seed) \u2192 { seed }.
 
 Exit codes: 0 ok \xB7 2 usage / not found / feature off \xB7 4 forbidden.
 
@@ -22972,11 +23148,11 @@ async function runWorkflowCollab(ctx, argv) {
   }
   switch (sub) {
     case "ticket": {
-      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/ticket`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE21}/${enc2(id)}/ticket`, { method: "POST", body: {} });
       return printTicketOnce(ctx, res.body, `workflow ${id}`);
     }
     case "claim-seed": {
-      const res = await requestJson(ctx, `${BASE20}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE21}/${enc2(id)}/claim-seed`, { method: "POST", body: {} });
       if (ctx.json) writeJson(ctx.io.stdout, res.body);
       else writeLine(ctx.io.stdout, res.body?.seed ? `You won the seed election for ${id} \u2014 seed the room.` : `Another client seeds ${id} (seed: false).`);
       return 0;
@@ -23020,7 +23196,7 @@ Run \`openwop canvas-packs --help\` for usage.`);
 }
 
 // src/cli/present.ts
-var BASE21 = "/v1/host/openwop-app/present";
+var BASE22 = "/v1/host/openwop-app/present";
 var ACTIONS = ["next", "prev", "goto", "blank"];
 var PRESENT_HELP = `Usage:
   openwop present outline <token> [--json]
@@ -23030,11 +23206,11 @@ var PRESENT_HELP = `Usage:
   openwop present events <token> [--max <n>] [--timeout <seconds>] [--json]
 
 Drive a live presentation with its remote token (no API key \u2014 the token is the
-credential). \`outline\` reads { title, frames, current? } (GET ${BASE21}/<token>/outline).
-\`command\` sends a navigation command (POST ${BASE21}/<token>/command, body
+credential). \`outline\` reads { title, frames, current? } (GET ${BASE22}/<token>/outline).
+\`command\` sends a navigation command (POST ${BASE22}/<token>/command, body
 { action, index? }). \`state\` reports the presenter's current frame
-(POST ${BASE21}/<token>/state, body { current }). \`events\` follows the navigation
-feed (GET ${BASE21}/<token>/events, server-sent events) \u2014 one line per event, or one
+(POST ${BASE22}/<token>/state, body { current }). \`events\` follows the navigation
+feed (GET ${BASE22}/<token>/events, server-sent events) \u2014 one line per event, or one
 JSON object per line with --json; stops after --max events or --timeout seconds.
 
 Exit codes: 0 ok \xB7 2 usage / unknown or expired session.
@@ -23061,7 +23237,7 @@ async function runPresent(ctx, argv) {
 `);
     return 2;
   }
-  const base16 = `${BASE21}/${enc2(token)}`;
+  const base16 = `${BASE22}/${enc2(token)}`;
   switch (sub) {
     case "outline": {
       const res = await requestJson(ctx, `${base16}/outline`, { auth: false });
@@ -24069,8 +24245,8 @@ async function runCampaignBrief(ctx, argv) {
 }
 
 // src/cli/campaignConnectors.ts
-var BASE22 = `${APP}/campaign-connectors`;
-var orgBase2 = (org2) => `${BASE22}/orgs/${enc2(org2)}`;
+var BASE23 = `${APP}/campaign-connectors`;
+var orgBase2 = (org2) => `${BASE23}/orgs/${enc2(org2)}`;
 var CAMPAIGN_CONNECTORS_HELP = `Usage:
   openwop campaign-connectors platforms [--json]
   openwop campaign-connectors sync --org <orgId> --platform meta|google [--json]
@@ -24119,7 +24295,7 @@ var TABLE2 = {
     usage: "platforms [--json]",
     args: 0,
     run: async (ctx) => {
-      const body = (await requestJson(ctx, `${BASE22}/platforms`)).body;
+      const body = (await requestJson(ctx, `${BASE23}/platforms`)).body;
       if (ctx.json) {
         writeJson(ctx.io.stdout, body);
         return 0;
@@ -24136,7 +24312,7 @@ var TABLE2 = {
     requires: ["platform"],
     run: async (ctx, a) => {
       const req2 = assign({ ...a.body }, { orgId: orgOf(a), platform: a.options.platform });
-      const body = (await requestJson(ctx, `${BASE22}/sync`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE23}/sync`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Sync ${body?.outcome ?? "done"}${body?.imported !== void 0 ? ` (${body.imported} imported)` : ""}.`);
     }
   },
@@ -24149,7 +24325,7 @@ var TABLE2 = {
     run: async (ctx, a) => {
       const o = a.options;
       const req2 = assign({ ...a.body }, { orgId: orgOf(a), segmentId: o.segment, adAccountId: o.adAccount, platform: o.platform, audienceName: o.audienceName });
-      const body = (await requestJson(ctx, `${BASE22}/audience-sync`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE23}/audience-sync`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Audience sync: ${body?.outcome ?? "done"}.`);
     }
   },
@@ -24172,7 +24348,7 @@ var TABLE2 = {
         writeLine(ctx.io.stderr, "openwop: missing --csv-file");
         return 2;
       }
-      const body = (await requestJson(ctx, `${BASE22}/import`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE23}/import`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Imported ${body?.imported ?? 0} rows (${body?.deduped ?? 0} deduped, ${Array.isArray(body?.invalid) ? body.invalid.length : body?.invalid ?? 0} invalid).`);
     }
   },
@@ -24182,7 +24358,7 @@ var TABLE2 = {
     value: ["--org", "--campaign"],
     run: async (ctx, a) => listOut(
       ctx,
-      (await requestJson(ctx, `${BASE22}/records${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body,
+      (await requestJson(ctx, `${BASE23}/records${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body,
       "records",
       ["date", "platform", "campaignId", "impressions", "clicks", "spend", "conversions"],
       "No performance records."
@@ -24192,7 +24368,7 @@ var TABLE2 = {
     usage: "kpi --org <orgId> [--campaign <id>] [--json]",
     args: 0,
     value: ["--org", "--campaign"],
-    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE22}/kpi${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body)
+    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE23}/kpi${qs({ orgId: orgOf(a), campaignId: a.options.campaign })}`)).body)
   },
   "sync-status": {
     usage: "sync-status --org <orgId> [--json]",
@@ -24314,7 +24490,7 @@ async function runCampaignConnectors(ctx, argv) {
 }
 
 // src/cli/campaignIntel.ts
-var BASE23 = `${APP}/campaign-intel`;
+var BASE24 = `${APP}/campaign-intel`;
 var CAMPAIGN_INTEL_HELP = `Usage:
   openwop campaign-intel budget --org <orgId> [--campaign <id>] [--json]
   openwop campaign-intel forecast --org <orgId> [--campaign <id>] [--json]
@@ -24353,7 +24529,7 @@ var read = (name, withCampaign) => ({
   args: 0,
   value: ["--org", ...withCampaign ? ["--campaign"] : []],
   run: async (ctx, a) => {
-    const body = (await requestJson(ctx, `${BASE23}/${name}${qs({ orgId: orgOf2(a), campaignId: withCampaign ? a.options.campaign : void 0 })}`)).body;
+    const body = (await requestJson(ctx, `${BASE24}/${name}${qs({ orgId: orgOf2(a), campaignId: withCampaign ? a.options.campaign : void 0 })}`)).body;
     if (name === "anomalies") return listOut(ctx, body, "anomalies", ["date", "platform", "campaignId", "metric", "severity", "message"], "No anomalies.");
     if (name === "forecast") return listOut(ctx, body, "forecasts", ["campaignId", "platform", "horizonDays", "projectedSpend", "projectedConversions"], "No forecasts (no performance records).");
     return detail(ctx, body);
@@ -24388,7 +24564,7 @@ var TABLE3 = {
           return 2;
         }
       }
-      return detail(ctx, (await requestJson(ctx, `${BASE23}/plan-budget`, { method: "POST", body: req2 })).body);
+      return detail(ctx, (await requestJson(ctx, `${BASE24}/plan-budget`, { method: "POST", body: req2 })).body);
     }
   },
   apply: {
@@ -24413,7 +24589,7 @@ var TABLE3 = {
         dailyBudgetMinor: o.dailyBudgetMinor !== void 0 ? num(o.dailyBudgetMinor, "--daily-budget-minor") : void 0,
         dryRun: dryRun ? true : void 0
       });
-      const body = (await requestJson(ctx, `${BASE23}/recommendations/apply`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE24}/recommendations/apply`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Budget ${dryRun ? "preview" : "update"}: ${body?.outcome ?? "done"}.`);
     }
   }
@@ -24473,7 +24649,7 @@ async function runCampaignJourneys(ctx, argv) {
 }
 
 // src/cli/cdp.ts
-var BASE24 = `${APP}/cdp`;
+var BASE25 = `${APP}/cdp`;
 var CDP_HELP = `Usage:
   openwop cdp resolve --type <identifierType> --value <v> [--json]
   openwop cdp schemas list [--json]
@@ -24520,7 +24696,7 @@ var limited = (path, key, columns, empty) => ({
   usage: `${path === "governance-decisions" ? "governance" : path === "collected-events" ? "events" : path} [--limit <n>] [--json]`,
   args: 0,
   value: ["--limit"],
-  run: async (ctx, a) => listOut(ctx, (await requestJson(ctx, `${BASE24}/${path}${qs({ limit: a.options.limit })}`)).body, key, columns, empty)
+  run: async (ctx, a) => listOut(ctx, (await requestJson(ctx, `${BASE25}/${path}${qs({ limit: a.options.limit })}`)).body, key, columns, empty)
 });
 var TABLE5 = {
   resolve: {
@@ -24528,7 +24704,7 @@ var TABLE5 = {
     args: 0,
     value: ["--type", "--value"],
     requires: ["type", "value"],
-    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE24}/identity/resolve${qs({ type: a.options.type, value: a.options.value })}`)).body)
+    run: async (ctx, a) => detail(ctx, (await requestJson(ctx, `${BASE25}/identity/resolve${qs({ type: a.options.type, value: a.options.value })}`)).body)
   },
   collect: {
     usage: "collect --event-type <t> [--payload-json '{...}'] [--dedupe-key <k>] [--json]",
@@ -24543,7 +24719,7 @@ var TABLE5 = {
         payload: o.payloadJson !== void 0 ? parseJsonFlag2(o.payloadJson, "--payload-json") : void 0,
         dedupeKey: o.dedupeKey
       });
-      const body = (await requestJson(ctx, `${BASE24}/collect`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE25}/collect`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Collected ${req2.eventType} event ${body?.eventId ?? body?.event?.eventId ?? ""}${body?.deduped ? " (deduplicated)" : ""}.`);
     }
   },
@@ -24558,7 +24734,7 @@ var TABLE5 = {
         writeLine(ctx.io.stderr, "openwop: missing --events-json or --events-file");
         return 2;
       }
-      return detail(ctx, (await requestJson(ctx, `${BASE24}/collect/batch`, { method: "POST", body: req2 })).body);
+      return detail(ctx, (await requestJson(ctx, `${BASE25}/collect/batch`, { method: "POST", body: req2 })).body);
     }
   },
   import: {
@@ -24578,7 +24754,7 @@ var TABLE5 = {
         writeLine(ctx.io.stderr, "openwop: missing --csv-file");
         return 2;
       }
-      return detail(ctx, (await requestJson(ctx, `${BASE24}/collect/import`, { method: "POST", body: req2 })).body);
+      return detail(ctx, (await requestJson(ctx, `${BASE25}/collect/import`, { method: "POST", body: req2 })).body);
     }
   },
   events: limited("collected-events", "events", ["eventId", "eventType", ["at", (e) => e.at ?? e.receivedAt ?? e.createdAt], "dedupeKey"], "No collected events."),
@@ -24588,7 +24764,7 @@ var TABLE5 = {
     usage: "audit-verify [--json]",
     args: 0,
     run: async (ctx) => {
-      const body = (await requestJson(ctx, `${BASE24}/audit-chain/verify`)).body;
+      const body = (await requestJson(ctx, `${BASE25}/audit-chain/verify`)).body;
       if (ctx.json) {
         writeJson(ctx.io.stdout, body);
         return body?.valid === false || body?.ok === false ? 1 : 0;
@@ -24606,7 +24782,7 @@ var SCHEMAS = {
     args: 0,
     run: async (ctx) => listOut(
       ctx,
-      (await requestJson(ctx, `${BASE24}/event-schemas`)).body,
+      (await requestJson(ctx, `${BASE25}/event-schemas`)).body,
       "schemas",
       ["eventType", "version", ["updatedAt", (s) => s.updatedAt ?? s.registeredAt ?? s.createdAt]],
       "No event schemas registered."
@@ -24627,7 +24803,7 @@ var SCHEMAS = {
         writeLine(ctx.io.stderr, "openwop: missing --schema-json or --schema-file");
         return 2;
       }
-      const body = (await requestJson(ctx, `${BASE24}/event-schemas`, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, `${BASE25}/event-schemas`, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Registered the ${req2.eventType} event schema${body?.version !== void 0 ? ` (version ${body.version})` : ""}.`);
     }
   },
@@ -24640,7 +24816,7 @@ var SCHEMAS = {
       const req2 = assign({ ...a.body }, { payload: jsonFrom(ctx, a.options.payloadJson, a.options.payloadFile, "--payload-json", "--payload-file") });
       let body;
       try {
-        body = (await requestJson(ctx, `${BASE24}/event-schemas/${enc2(a.positionals[0])}/validate`, { method: "POST", body: req2 })).body;
+        body = (await requestJson(ctx, `${BASE25}/event-schemas/${enc2(a.positionals[0])}/validate`, { method: "POST", body: req2 })).body;
       } catch (err) {
         if (!(err instanceof HttpError) || err.status !== 422) throw err;
         body = err.body;
@@ -24664,7 +24840,7 @@ async function runCdp(ctx, argv) {
 }
 
 // src/cli/destinationSync.ts
-var BASE25 = `${APP}/destination-sync/syncs`;
+var BASE26 = `${APP}/destination-sync/syncs`;
 var DESTINATION_SYNC_HELP = `Usage:
   openwop destination-sync list [--json]
   openwop destination-sync get <syncId> [--json]
@@ -24698,14 +24874,14 @@ function jsonFrom2(ctx, inline, file, inlineFlag, fileFlag) {
   if (file !== void 0) return parseJsonFlag2(readText(ctx, String(file), fileFlag), fileFlag);
   return void 0;
 }
-var item = (id) => `${BASE25}/${enc2(id)}`;
+var item = (id) => `${BASE26}/${enc2(id)}`;
 var TABLE6 = {
   list: {
     usage: "list [--json]",
     args: 0,
     run: async (ctx) => listOut(
       ctx,
-      (await requestJson(ctx, BASE25)).body,
+      (await requestJson(ctx, BASE26)).body,
       "syncs",
       [["id", (s) => s.id ?? s.syncId], "name", "destinationKind", "sourceObject", "syncMode", "cursor"],
       "No destination syncs."
@@ -24733,7 +24909,7 @@ var TABLE6 = {
         cursorField: o.cursorField,
         connectionId: o.connection
       });
-      const body = (await requestJson(ctx, BASE25, { method: "POST", body: req2 })).body;
+      const body = (await requestJson(ctx, BASE26, { method: "POST", body: req2 })).body;
       return done(ctx, body, `Created destination sync ${body?.id ?? body?.syncId ?? ""} (${req2.name}).`);
     }
   },
@@ -25563,7 +25739,7 @@ async function runPublic(ctx, argv) {
 }
 
 // src/cli/vault.ts
-var BASE26 = "/v1/host/openwop-app/vault";
+var BASE27 = "/v1/host/openwop-app/vault";
 var SURFACE2 = "The secrets vault";
 var VAULT_HELP = `Usage:
   openwop vault list [--json]
@@ -25575,10 +25751,10 @@ The super-admin secrets vault (host extension). Every route is SUPER-ADMIN gated
 without a super-admin principal the command fails closed with exit 4 and says how to
 get one (OPENWOP_SUPERADMIN_TENANTS on the server).
 
-  list     GET    ${BASE26}                                  inventory of refs (never values)
-  set      POST   ${BASE26}/secrets                          store a new secret under a ref
-  rotate   POST   ${BASE26}/secrets/:credentialRef/rotate    overwrite an EXISTING secret
-  delete   DELETE ${BASE26}/secrets/:credentialRef           remove (refused while the ref has live consumers unless --force)
+  list     GET    ${BASE27}                                  inventory of refs (never values)
+  set      POST   ${BASE27}/secrets                          store a new secret under a ref
+  rotate   POST   ${BASE27}/secrets/:credentialRef/rotate    overwrite an EXISTING secret
+  delete   DELETE ${BASE27}/secrets/:credentialRef           remove (refused while the ref has live consumers unless --force)
 
 SECRETS ARE REFS, NEVER VALUES. The value for set/rotate is read from --value-file or a
 no-echo prompt (a piped line also works) \u2014 never from a command-line flag. The host's
@@ -25634,7 +25810,7 @@ async function vaultList(ctx, argv) {
     write(ctx.io.stdout, VAULT_HELP);
     return 0;
   }
-  const res = await gatedRequest(ctx, BASE26, void 0, SURFACE2, "superadmin");
+  const res = await gatedRequest(ctx, BASE27, void 0, SURFACE2, "superadmin");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -25665,7 +25841,7 @@ async function vaultWrite(ctx, argv, verb) {
   const scope = scopeOf(options);
   const value = await readSecretInput(ctx, options, `Secret value for "${ref}"`);
   const body = { value, ...scope === "host" ? { scope: "host" } : {} };
-  const path = verb === "set" ? `${BASE26}/secrets` : `${BASE26}/secrets/${encodeURIComponent(ref)}/rotate`;
+  const path = verb === "set" ? `${BASE27}/secrets` : `${BASE27}/secrets/${encodeURIComponent(ref)}/rotate`;
   if (verb === "set") body.credentialRef = ref;
   const res = await gatedRequest(ctx, path, { method: "POST", body }, SURFACE2, "superadmin");
   if (ctx.json) {
@@ -25689,7 +25865,7 @@ async function vaultDelete(ctx, argv) {
   if (scopeOf(options) === "host") qs2.set("scope", "host");
   if (options.force) qs2.set("force", "true");
   const q = qs2.toString() ? `?${qs2}` : "";
-  const res = await gatedRequest(ctx, `${BASE26}/secrets/${encodeURIComponent(positionals[0])}${q}`, { method: "DELETE" }, SURFACE2, "superadmin");
+  const res = await gatedRequest(ctx, `${BASE27}/secrets/${encodeURIComponent(positionals[0])}${q}`, { method: "DELETE" }, SURFACE2, "superadmin");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -25699,27 +25875,40 @@ async function vaultDelete(ctx, argv) {
 }
 
 // src/cli/developerKeys.ts
-var BASE27 = "/v1/host/openwop-app/developer-keys";
+var BASE28 = "/v1/host/openwop-app/developer-keys";
 var SURFACE3 = "Managing developer API keys";
 var DEVELOPER_KEYS_HELP = `Usage:
   openwop developer-keys list [--json]
   openwop developer-keys create --name <n> [--scope <s>]... [--expires-at <iso>] [--json]
   openwop developer-keys revoke <keyId> --yes [--json]
 
-Developer API keys for this workspace (host extension under ${BASE27}). Requires an
+Developer API keys for this workspace (host extension under ${BASE28}). Requires an
 authenticated principal (not an anonymous session); an admin or owner sees and can
 revoke every key in the workspace, anyone else only their own.
 
-  list     GET    ${BASE27}          keys (public fields only \u2014 never the token or its hash)
-  create   POST   ${BASE27}          issue a key; the token is shown ONCE
-  revoke   DELETE ${BASE27}/:keyId   revoke (404 when the key is not yours / not in this workspace)
+  list     GET    ${BASE28}          keys (public fields only \u2014 never the token or its hash)
+  create   POST   ${BASE28}          issue a key; the token is shown ONCE
+  revoke   DELETE ${BASE28}/:keyId   revoke (404 when the key is not yours / not in this workspace)
 
 ONE-TIME SECRET: \`create\` prints the new token exactly once, on stdout, with a warning.
 Store it immediately \u2014 the host keeps only a hash and cannot show it again. The CLI does
 not save it anywhere.
 
+A KEY CANNOT MANAGE KEYS: openwop-app refuses \`list\`, \`create\` and \`revoke\` (403)
+when the CLI is itself signed in with a developer key (owk_\u2026). Create and revoke keys
+in the app (Access \u2192 API keys), or sign in with an operator key.
+
+SCOPES ARE REQUIRED AND NARROW: openwop-app refuses a key with no --scope, and a key is
+limited to exactly the scopes it declares. To start a run and read it back a key needs
+runs:create AND runs:read; reaching the rest of the workspace (agents, memory, BYOK)
+needs workspace:read / workspace:write. \`--scope '*'\` is a key with your full authority.
+A scope the host does not know is refused by name.
+
+EXPIRY: openwop-app gives a key 90 days unless --expires-at says otherwise, and refuses
+an expiry in the past or more than its maximum (366 days by default) away.
+
   --name <n>          (create) Display name. Required.
-  --scope <s>         (create) Scope granted to the key (repeatable).
+  --scope <s>         (create) Scope granted to the key (repeatable; at least one).
   --expires-at <iso>  (create) Expiry timestamp.
   --yes               (revoke) Required confirmation.
 
@@ -25727,7 +25916,7 @@ Exit codes: 0 ok \xB7 2 usage / not found \xB7 4 not signed in.
 
 Examples:
   openwop developer-keys list
-  openwop developer-keys create --name "CI deploy" --scope runs:write
+  openwop developer-keys create --name "CI deploy" --scope runs:create --scope runs:read
   openwop developer-keys revoke dk:0123abcd --yes
 `;
 async function runDeveloperKeys(ctx, argv) {
@@ -25756,7 +25945,7 @@ async function keysList(ctx, argv) {
     write(ctx.io.stdout, DEVELOPER_KEYS_HELP);
     return 0;
   }
-  const res = await gatedRequest(ctx, BASE27, void 0, SURFACE3, "signed-in");
+  const res = await gatedRequest(ctx, BASE28, void 0, SURFACE3, "signed-in");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -25785,7 +25974,7 @@ async function keysCreate(ctx, argv) {
   const body = { name: options.name };
   if (Array.isArray(options.scope) && options.scope.length) body.scopes = options.scope;
   if (options.expiresAt) body.expiresAt = options.expiresAt;
-  const res = await gatedRequest(ctx, BASE27, { method: "POST", body }, SURFACE3, "signed-in");
+  const res = await gatedRequest(ctx, BASE28, { method: "POST", body }, SURFACE3, "signed-in");
   writeLine(ctx.io.stderr, "WARNING: this token is shown ONCE. Store it now \u2014 it cannot be retrieved again.");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
@@ -25806,7 +25995,7 @@ async function keysRevoke(ctx, argv) {
     writeLine(ctx.io.stderr, `Refusing to revoke ${positionals[0]} without --yes.`);
     return 2;
   }
-  await gatedRequest(ctx, `${BASE27}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, SURFACE3, "signed-in");
+  await gatedRequest(ctx, `${BASE28}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, SURFACE3, "signed-in");
   if (ctx.json) {
     writeJson(ctx.io.stdout, { keyId: positionals[0], revoked: true });
     return 0;
@@ -25875,44 +26064,44 @@ Run \`openwop custom-domains --help\` for usage.`);
     })), ["hostname", "status", "verifiedAt", "lastError"]));
     return 0;
   }
-  const hostname = positionals[0];
-  if (!hostname) throw new CliError(`Usage: openwop custom-domains ${sub} <hostname> --org <orgId>`, 2);
+  const hostname2 = positionals[0];
+  if (!hostname2) throw new CliError(`Usage: openwop custom-domains ${sub} <hostname> --org <orgId>`, 2);
   if (sub === "add") {
-    const res2 = await requestJson(ctx, base14(orgId), { method: "POST", body: { hostname } });
+    const res2 = await requestJson(ctx, base14(orgId), { method: "POST", body: { hostname: hostname2 } });
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
     }
     const d = res2.body?.domain ?? {};
-    writeLine(ctx.io.stdout, `Added ${d.hostname ?? hostname} (status ${d.status ?? "pending"}).`);
-    writeLine(ctx.io.stdout, `Publish TXT _openwop-verify.${d.hostname ?? hostname} = ${d.verificationToken ?? "(see --json)"} then run \`openwop custom-domains verify ${d.hostname ?? hostname} --org ${orgId}\`.`);
+    writeLine(ctx.io.stdout, `Added ${d.hostname ?? hostname2} (status ${d.status ?? "pending"}).`);
+    writeLine(ctx.io.stdout, `Publish TXT _openwop-verify.${d.hostname ?? hostname2} = ${d.verificationToken ?? "(see --json)"} then run \`openwop custom-domains verify ${d.hostname ?? hostname2} --org ${orgId}\`.`);
     return 0;
   }
   if (sub === "verify") {
-    const res2 = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname)}/verify`, { method: "POST", body: {} });
+    const res2 = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname2)}/verify`, { method: "POST", body: {} });
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
     }
     const d = res2.body?.domain ?? {};
-    writeLine(ctx.io.stdout, `${d.hostname ?? hostname}: ${d.status ?? "?"}${d.lastError ? ` \u2014 ${d.lastError}` : ""}`);
+    writeLine(ctx.io.stdout, `${d.hostname ?? hostname2}: ${d.status ?? "?"}${d.lastError ? ` \u2014 ${d.lastError}` : ""}`);
     return d.status === "live" ? 0 : 3;
   }
   if (!options.yes) {
-    writeLine(ctx.io.stderr, `Refusing to remove ${hostname} without --yes.`);
+    writeLine(ctx.io.stderr, `Refusing to remove ${hostname2} without --yes.`);
     return 2;
   }
-  const res = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname)}`, { method: "DELETE" });
+  const res = await requestJson(ctx, `${base14(orgId)}/${encodeURIComponent(hostname2)}`, { method: "DELETE" });
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
   }
-  writeLine(ctx.io.stdout, `Removed ${hostname}.`);
+  writeLine(ctx.io.stdout, `Removed ${hostname2}.`);
   return 0;
 }
 
 // src/cli/environments.ts
-var BASE28 = "/v1/host/openwop-app/environments";
+var BASE29 = "/v1/host/openwop-app/environments";
 var PROTECTION = ["open", "protected", "locked"];
 var ENVIRONMENTS_HELP = `Usage:
   openwop environments list [--drift] [--json]
@@ -25929,21 +26118,21 @@ var ENVIRONMENTS_HELP = `Usage:
   openwop environments apply --snapshot <hash> [--json]
   openwop environments promotions [--json]
 
-Config environments + promotion (host extension under ${BASE28}; toggle 'environments').
+Config environments + promotion (host extension under ${BASE29}; toggle 'environments').
 Reads need workspace:read; every write needs host:members:manage in the workspace.
 
-  list          GET   ${BASE28}[?drift=1]          environments, config domains, app version
-  create        POST  ${BASE28}                    add an environment to the chain
-  ensure-chain  POST  ${BASE28}/ensure-chain       create the default dev \u2192 staging \u2192 prod chain
-  protect       PATCH ${BASE28}/:name/protection   set open | protected | locked
-  settings      GET/PATCH ${BASE28}/settings       the promotion-approval gate
-  snapshots     GET   ${BASE28}/snapshots          stored config snapshots
-  snapshot      POST  ${BASE28}/snapshots          snapshot the current live config
-  preview       POST  ${BASE28}/preview            diff a snapshot against an environment (no change)
-  promote       POST  ${BASE28}/promote            promote an env's snapshot to the next (or --to) env
-  rollback      POST  ${BASE28}/rollback           point an env back at a historical snapshot
-  apply         POST  ${BASE28}/apply              apply a snapshot to the live config
-  promotions    GET   ${BASE28}/promotions         the promotion ledger
+  list          GET   ${BASE29}[?drift=1]          environments, config domains, app version
+  create        POST  ${BASE29}                    add an environment to the chain
+  ensure-chain  POST  ${BASE29}/ensure-chain       create the default dev \u2192 staging \u2192 prod chain
+  protect       PATCH ${BASE29}/:name/protection   set open | protected | locked
+  settings      GET/PATCH ${BASE29}/settings       the promotion-approval gate
+  snapshots     GET   ${BASE29}/snapshots          stored config snapshots
+  snapshot      POST  ${BASE29}/snapshots          snapshot the current live config
+  preview       POST  ${BASE29}/preview            diff a snapshot against an environment (no change)
+  promote       POST  ${BASE29}/promote            promote an env's snapshot to the next (or --to) env
+  rollback      POST  ${BASE29}/rollback           point an env back at a historical snapshot
+  apply         POST  ${BASE29}/apply              apply a snapshot to the live config
+  promotions    GET   ${BASE29}/promotions         the promotion ledger
 
 Exit codes: 0 ok \xB7 3 queued for approval (202 pending_approval) \xB7 2 usage / not found /
 feature off \xB7 4 permission denied.
@@ -25976,7 +26165,7 @@ async function runEnvironments(ctx, argv) {
   };
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, `${BASE28}${options.drift ? "?drift=1" : ""}`);
+      const res = await requestJson(ctx, `${BASE29}${options.drift ? "?drift=1" : ""}`);
       emit2(res.body, () => {
         const envs = arrayOf(res.body, "environments");
         if (envs.length === 0) {
@@ -26003,35 +26192,35 @@ async function runEnvironments(ctx, argv) {
         body.order = n;
       }
       if (options.protection !== void 0) body.protection = protectionOf(options.protection);
-      const res = await requestJson(ctx, BASE28, { method: "POST", body });
+      const res = await requestJson(ctx, BASE29, { method: "POST", body });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Created environment ${res.body?.name ?? name} (order ${res.body?.order ?? "?"}, ${res.body?.protection ?? "?"}).`));
       return 0;
     }
     case "ensure-chain": {
-      const res = await requestJson(ctx, `${BASE28}/ensure-chain`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE29}/ensure-chain`, { method: "POST", body: {} });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Chain: ${arrayOf(res.body, "environments").map((e) => e.name).join(" \u2192 ")}`));
       return 0;
     }
     case "protect": {
       const name = positionals[0];
       if (!name || options.protection === void 0) throw new CliError("Usage: openwop environments protect <name> --protection open|protected|locked", 2);
-      const res = await requestJson(ctx, `${BASE28}/${encodeURIComponent(name)}/protection`, { method: "PATCH", body: { protection: protectionOf(options.protection) } });
+      const res = await requestJson(ctx, `${BASE29}/${encodeURIComponent(name)}/protection`, { method: "PATCH", body: { protection: protectionOf(options.protection) } });
       emit2(res.body, () => writeLine(ctx.io.stdout, `${name} is now ${res.body?.protection ?? options.protection}.`));
       return 0;
     }
     case "settings": {
       if (positionals[0] === "set") {
         if (options.requireApproval === void 0) throw new CliError("Usage: openwop environments settings set --require-approval true|false", 2);
-        const res2 = await requestJson(ctx, `${BASE28}/settings`, { method: "PATCH", body: { requireApprovalForPromotion: parseBool("--require-approval", options.requireApproval) } });
+        const res2 = await requestJson(ctx, `${BASE29}/settings`, { method: "PATCH", body: { requireApprovalForPromotion: parseBool("--require-approval", options.requireApproval) } });
         emit2(res2.body, () => writeLine(ctx.io.stdout, `requireApprovalForPromotion: ${res2.body?.requireApprovalForPromotion}`));
         return 0;
       }
-      const res = await requestJson(ctx, `${BASE28}/settings`);
+      const res = await requestJson(ctx, `${BASE29}/settings`);
       emit2(res.body, () => writeLine(ctx.io.stdout, `requireApprovalForPromotion: ${res.body?.requireApprovalForPromotion ?? false}`));
       return 0;
     }
     case "snapshots": {
-      const res = await requestJson(ctx, `${BASE28}/snapshots`);
+      const res = await requestJson(ctx, `${BASE29}/snapshots`);
       emit2(res.body, () => {
         const snaps = arrayOf(res.body, "snapshots");
         if (snaps.length === 0) {
@@ -26051,13 +26240,13 @@ async function runEnvironments(ctx, argv) {
     case "snapshot": {
       const body = {};
       if (options.sourceEnv) body.sourceEnv = options.sourceEnv;
-      const res = await requestJson(ctx, `${BASE28}/snapshots`, { method: "POST", body });
+      const res = await requestJson(ctx, `${BASE29}/snapshots`, { method: "POST", body });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Snapshot ${res.body?.hash ?? "?"}${res.body?.sourceEnv ? ` (from ${res.body.sourceEnv})` : ""}.`));
       return 0;
     }
     case "preview": {
       if (!options.to || !options.snapshot) throw new CliError("Usage: openwop environments preview --to <env> --snapshot <hash>", 2);
-      const res = await requestJson(ctx, `${BASE28}/preview`, { method: "POST", body: { toEnv: options.to, snapshotHash: options.snapshot } });
+      const res = await requestJson(ctx, `${BASE29}/preview`, { method: "POST", body: { toEnv: options.to, snapshotHash: options.snapshot } });
       writeJson(ctx.io.stdout, res.body);
       return 0;
     }
@@ -26065,18 +26254,18 @@ async function runEnvironments(ctx, argv) {
       if (!options.from) throw new CliError("Usage: openwop environments promote --from <env> [--to <env>]", 2);
       const body = { fromEnv: options.from };
       if (options.to) body.toEnv = options.to;
-      return movement(ctx, await requestJson(ctx, `${BASE28}/promote`, { method: "POST", body }), "Promoted");
+      return movement(ctx, await requestJson(ctx, `${BASE29}/promote`, { method: "POST", body }), "Promoted");
     }
     case "rollback": {
       if (!options.env || !options.snapshot) throw new CliError("Usage: openwop environments rollback --env <env> --snapshot <hash>", 2);
-      return movement(ctx, await requestJson(ctx, `${BASE28}/rollback`, { method: "POST", body: { env: options.env, snapshotHash: options.snapshot } }), "Rolled back");
+      return movement(ctx, await requestJson(ctx, `${BASE29}/rollback`, { method: "POST", body: { env: options.env, snapshotHash: options.snapshot } }), "Rolled back");
     }
     case "apply": {
       if (!options.snapshot) throw new CliError("Usage: openwop environments apply --snapshot <hash>", 2);
-      return movement(ctx, await requestJson(ctx, `${BASE28}/apply`, { method: "POST", body: { snapshotHash: options.snapshot } }), "Applied");
+      return movement(ctx, await requestJson(ctx, `${BASE29}/apply`, { method: "POST", body: { snapshotHash: options.snapshot } }), "Applied");
     }
     case "promotions": {
-      const res = await requestJson(ctx, `${BASE28}/promotions`);
+      const res = await requestJson(ctx, `${BASE29}/promotions`);
       emit2(res.body, () => {
         const rows = arrayOf(res.body, "promotions");
         if (rows.length === 0) {
@@ -26121,7 +26310,7 @@ function movement(ctx, res, verb) {
 }
 
 // src/cli/billing.ts
-var BASE29 = "/v1/host/openwop-app/billing";
+var BASE30 = "/v1/host/openwop-app/billing";
 var BILLING_HELP = `Usage:
   openwop billing subscription [--json]
   openwop billing balance [--json]
@@ -26139,7 +26328,7 @@ var BILLING_HELP = `Usage:
   openwop billing sync-seats [--json]
   openwop billing import (--body <json> | --body-file <path>) [--json]
 
-Workspace billing (host extension under ${BASE29}; toggle 'billing').
+Workspace billing (host extension under ${BASE30}; toggle 'billing').
   subscription     GET  /subscription               plan tier, status, seats, period
   balance          GET  /balance                    purchased token balance
   entitlements     GET  /entitlements               the plan's allowed features + limits
@@ -26186,7 +26375,7 @@ async function runBilling(ctx, argv) {
   const superadmin = (path, body, surface) => gatedRequest(ctx, path, { method: "POST", body }, surface, "superadmin");
   switch (sub) {
     case "subscription": {
-      const res = await requestJson(ctx, `${BASE29}/subscription`);
+      const res = await requestJson(ctx, `${BASE30}/subscription`);
       emit2(res.body, () => {
         const s = res.body ?? {};
         writeLine(ctx.io.stdout, `plan:    ${s.planTier ?? "?"} (${s.status ?? "?"})`);
@@ -26197,12 +26386,12 @@ async function runBilling(ctx, argv) {
       return 0;
     }
     case "balance": {
-      const res = await requestJson(ctx, `${BASE29}/balance`);
+      const res = await requestJson(ctx, `${BASE30}/balance`);
       emit2(res.body, () => writeLine(ctx.io.stdout, `tokens available: ${res.body?.totalAvailable ?? 0} (purchased total ${res.body?.purchasedTokensTotal ?? 0})`));
       return 0;
     }
     case "entitlements": {
-      const res = await requestJson(ctx, `${BASE29}/entitlements`);
+      const res = await requestJson(ctx, `${BASE30}/entitlements`);
       emit2(res.body, () => {
         const e = res.body ?? {};
         writeLine(ctx.io.stdout, `plan: ${e.plan ?? "?"}`);
@@ -26213,7 +26402,7 @@ async function runBilling(ctx, argv) {
       return 0;
     }
     case "bundles": {
-      const res = await requestJson(ctx, `${BASE29}/bundles`);
+      const res = await requestJson(ctx, `${BASE30}/bundles`);
       emit2(res.body, () => {
         const rows = arrayOf(res.body, "bundles");
         if (rows.length === 0) {
@@ -26233,19 +26422,19 @@ async function runBilling(ctx, argv) {
       const verb = positionals[0] ?? "list";
       if (verb === "get") {
         if (!positionals[1]) throw new CliError("Usage: openwop billing invoices get <invoiceId>", 2);
-        const res2 = await requestJson(ctx, `${BASE29}/invoices/${encodeURIComponent(positionals[1])}`);
+        const res2 = await requestJson(ctx, `${BASE30}/invoices/${encodeURIComponent(positionals[1])}`);
         emit2(res2.body, () => writeLine(ctx.io.stdout, res2.body?.markdown ?? JSON.stringify(res2.body, null, 2)));
         return 0;
       }
       if (verb === "create") {
         const amount = Number(options.amount);
         if (options.amount === void 0 || !Number.isFinite(amount)) throw new CliError("Usage: openwop billing invoices create --amount <n> [--currency <c>]", 2);
-        const res2 = await superadmin(`${BASE29}/invoices`, { amount, ...options.currency ? { currency: options.currency } : {} }, "Generating an invoice");
+        const res2 = await superadmin(`${BASE30}/invoices`, { amount, ...options.currency ? { currency: options.currency } : {} }, "Generating an invoice");
         emit2(res2.body, () => writeLine(ctx.io.stdout, `Created invoice ${res2.body?.invoiceId ?? "?"} (${res2.body?.amount} ${res2.body?.currency}).`));
         return 0;
       }
       if (verb !== "list") throw new CliError(`Unknown invoices verb: ${verb}`, 2);
-      const res = await requestJson(ctx, `${BASE29}/invoices`);
+      const res = await requestJson(ctx, `${BASE30}/invoices`);
       emit2(res.body, () => {
         const rows = arrayOf(res.body, "invoices");
         if (rows.length === 0) {
@@ -26263,18 +26452,18 @@ async function runBilling(ctx, argv) {
     }
     case "checkout": {
       if (!options.price) throw new CliError("Usage: openwop billing checkout --price <priceId>", 2);
-      const res = await requestJson(ctx, `${BASE29}/checkout`, { method: "POST", body: { priceId: options.price } });
+      const res = await requestJson(ctx, `${BASE30}/checkout`, { method: "POST", body: { priceId: options.price } });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Open to complete checkout (${res.body?.mode ?? "?"}): ${res.body?.url ?? "?"}`));
       return 0;
     }
     case "bundle-checkout": {
       if (!positionals[0]) throw new CliError("Usage: openwop billing bundle-checkout <bundleId>", 2);
-      const res = await requestJson(ctx, `${BASE29}/bundles/${encodeURIComponent(positionals[0])}/checkout`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE30}/bundles/${encodeURIComponent(positionals[0])}/checkout`, { method: "POST", body: {} });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Open to complete checkout (${res.body?.mode ?? "?"}): ${res.body?.url ?? "?"}`));
       return 0;
     }
     case "portal": {
-      const res = await requestJson(ctx, `${BASE29}/portal`, { method: "POST", body: {} });
+      const res = await requestJson(ctx, `${BASE30}/portal`, { method: "POST", body: {} });
       emit2(res.body, () => writeLine(ctx.io.stdout, `Billing portal (${res.body?.mode ?? "?"}): ${res.body?.url ?? "?"}`));
       return 0;
     }
@@ -26287,19 +26476,19 @@ async function runBilling(ctx, argv) {
         if (!Number.isFinite(v)) throw new CliError("--value must be a number.", 2);
         body.value = v;
       }
-      const res = await superadmin(`${BASE29}/coupons`, body, "Creating a billing coupon");
+      const res = await superadmin(`${BASE30}/coupons`, body, "Creating a billing coupon");
       emit2(res.body, () => writeLine(ctx.io.stdout, `Created coupon ${res.body?.code ?? options.code} (${res.body?.type} ${res.body?.value}).`));
       return 0;
     }
     case "sync-seats": {
-      const res = await superadmin(`${BASE29}/sync-seats`, {}, "Billing seat sync");
+      const res = await superadmin(`${BASE30}/sync-seats`, {}, "Billing seat sync");
       emit2(res.body, () => writeLine(ctx.io.stdout, `Seats synced: ${res.body?.quantity ?? "?"}.`));
       return 0;
     }
     case "import": {
       const body = readBodyOption(ctx, options);
       if (!body) throw new CliError('Usage: openwop billing import (--body <json> | --body-file <path>)  \u2014 {"subscriptions":[...],"balances":[...]}', 2);
-      const res = await superadmin(`${BASE29}/import`, body, "Billing import");
+      const res = await superadmin(`${BASE30}/import`, body, "Billing import");
       emit2(res.body, () => writeLine(ctx.io.stdout, `Imported ${res.body?.subscriptions ?? 0} subscription(s), ${res.body?.balances ?? 0} balance(s).`));
       return 0;
     }
@@ -26370,15 +26559,15 @@ Run \`openwop site-config --help\` for usage.`);
 }
 
 // src/cli/runtimePosture.ts
-var BASE30 = "/v1/host/openwop-app/runtime-posture";
+var BASE31 = "/v1/host/openwop-app/runtime-posture";
 var SURFACE5 = "Runtime posture";
 var RUNTIME_POSTURE_HELP = `Usage:
   openwop runtime-posture [get] [--json]
   openwop runtime-posture request --warm|--cold [--json]
 
 The serving service's runtime posture (host extension, SUPER-ADMIN gated).
-  get      GET  ${BASE30}                   live posture (serving revision, warm/cold, rollout)
-  request  POST ${BASE30}/change-requests   ask for a warm/cold change; returns the commands to run
+  get      GET  ${BASE31}                   live posture (serving revision, warm/cold, rollout)
+  request  POST ${BASE31}/change-requests   ask for a warm/cold change; returns the commands to run
 
 A change request APPLIES NOTHING: the host records it in the audit log and returns the
 exact commands for an operator holding deploy rights. Without a super-admin principal
@@ -26402,7 +26591,7 @@ async function runRuntimePosture(ctx, argv) {
     return 0;
   }
   if (sub === "get") {
-    const res2 = await gatedRequest(ctx, BASE30, void 0, SURFACE5, "superadmin");
+    const res2 = await gatedRequest(ctx, BASE31, void 0, SURFACE5, "superadmin");
     if (ctx.json) {
       writeJson(ctx.io.stdout, res2.body);
       return 0;
@@ -26421,7 +26610,7 @@ async function runRuntimePosture(ctx, argv) {
   if (sub !== "request") throw new CliError(`Unknown runtime-posture command: ${sub}
 Run \`openwop runtime-posture --help\` for usage.`);
   if (Boolean(options.warm) === Boolean(options.cold)) throw new CliError("Pass exactly one of --warm or --cold.", 2);
-  const res = await gatedRequest(ctx, `${BASE30}/change-requests`, { method: "POST", body: { warm: Boolean(options.warm) } }, SURFACE5, "superadmin");
+  const res = await gatedRequest(ctx, `${BASE31}/change-requests`, { method: "POST", body: { warm: Boolean(options.warm) } }, SURFACE5, "superadmin");
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
@@ -26476,16 +26665,16 @@ Run \`openwop maintenance --help\` for usage.`);
 }
 
 // src/cli/menuConfig.ts
-var BASE31 = "/v1/host/openwop-app/menu-config";
+var BASE32 = "/v1/host/openwop-app/menu-config";
 var MENU_CONFIG_HELP = `Usage:
   openwop menu-config [get] [--json]
   openwop menu-config set me     (--body <json> | --body-file <path>) [--json]
   openwop menu-config set tenant (--body <json> | --body-file <path>) [--json]
 
 Navigation menu layout (host extension).
-  get         GET ${BASE31}          {tenant, user} layers for the caller
-  set me      PUT ${BASE31}/me       replace YOUR personal layer (signed-in user)
-  set tenant  PUT ${BASE31}/tenant   [super-admin] replace the workspace default layer
+  get         GET ${BASE32}          {tenant, user} layers for the caller
+  set me      PUT ${BASE32}/me       replace YOUR personal layer (signed-in user)
+  set tenant  PUT ${BASE32}/tenant   [super-admin] replace the workspace default layer
 
 The body is the menu config object ({"items": {...}, "headers": [...]}) or the full
 request ({"config": {...}}). A write REPLACES that layer. \`set tenant\` reads the current
@@ -26511,7 +26700,7 @@ async function runMenuConfig(ctx, argv) {
     return 0;
   }
   if (sub === "get") {
-    const res2 = await requestJson(ctx, BASE31);
+    const res2 = await requestJson(ctx, BASE32);
     writeJson(ctx.io.stdout, res2.body);
     return 0;
   }
@@ -26525,13 +26714,13 @@ Run \`openwop menu-config --help\` for usage.`);
   const body = "config" in raw ? raw : { config: raw };
   let res;
   if (layer === "me") {
-    res = await gatedRequest(ctx, `${BASE31}/me`, { method: "PUT", body }, "Editing your menu layout", "signed-in");
+    res = await gatedRequest(ctx, `${BASE32}/me`, { method: "PUT", body }, "Editing your menu layout", "signed-in");
   } else {
-    const current = await requestJson(ctx, BASE31);
+    const current = await requestJson(ctx, BASE32);
     const etag = current.headers.get("etag");
     res = await gatedRequest(
       ctx,
-      `${BASE31}/tenant`,
+      `${BASE32}/tenant`,
       { method: "PUT", body, ...etag ? { headers: { "if-match": etag } } : {} },
       "Editing the workspace default menu layout",
       "superadmin"
@@ -26921,7 +27110,7 @@ function renderKnowledge(ctx, agentId, k) {
 
 // src/cli/compatEndpoints.ts
 import { readFileSync as readFileSync19 } from "node:fs";
-var BASE32 = "/v1/host/openwop-app/compat-endpoints";
+var BASE33 = "/v1/host/openwop-app/compat-endpoints";
 var COMPAT_ENDPOINTS_HELP = `Usage:
   openwop compat-endpoints list --org <orgId> [--json]
   openwop compat-endpoints create --org <orgId> --label <l> --base-url-endpoint <https://\u2026> [--api-key-file <path> | --api-key-env <VAR>] [--model <m>]... [--vision] [--tools] [--long-context] [--json]
@@ -26971,7 +27160,7 @@ async function runCompatEndpoints(ctx, argv) {
     switch (sub) {
       case "list": {
         const org2 = requireOrg(options.org);
-        const res = await requestJson(ctx, `${BASE32}?orgId=${encodeURIComponent(org2)}`);
+        const res = await requestJson(ctx, `${BASE33}?orgId=${encodeURIComponent(org2)}`);
         if (ctx.json) {
           writeJson(ctx.io.stdout, res.body);
           return 0;
@@ -27004,7 +27193,7 @@ async function runCompatEndpoints(ctx, argv) {
         const apiKey = readApiKey(ctx, options);
         if (apiKey) body.apiKey = apiKey;
         if (Array.isArray(options.model) && options.model.length) body.models = options.model;
-        const res = await requestJson(ctx, BASE32, { method: "POST", body });
+        const res = await requestJson(ctx, BASE33, { method: "POST", body });
         if (ctx.json) {
           writeJson(ctx.io.stdout, res.body);
           return 0;
@@ -27018,7 +27207,7 @@ async function runCompatEndpoints(ctx, argv) {
           writeLine(ctx.io.stderr, `Refusing to delete ${positionals[0]} (and its stored key) without --yes.`);
           return 2;
         }
-        await requestJson(ctx, `${BASE32}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+        await requestJson(ctx, `${BASE33}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
         writeLine(ctx.io.stdout, `Deleted compat endpoint ${positionals[0]}.`);
         return 0;
       }
@@ -27048,7 +27237,7 @@ function readApiKey(ctx, options) {
 }
 
 // src/cli/hostEvents.ts
-var BASE33 = "/v1/host/openwop-app/host-events/bindings";
+var BASE34 = "/v1/host/openwop-app/host-events/bindings";
 var HOST_EVENTS_HELP = `Usage:
   openwop host-events list [--json]
   openwop host-events bind --event <host.\u2026> --workflow <workflowId> [--json]
@@ -27091,7 +27280,7 @@ async function runHostEvents(ctx, argv) {
   }
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, BASE33);
+      const res = await requestJson(ctx, BASE34);
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -27112,7 +27301,7 @@ async function runHostEvents(ctx, argv) {
     case "bind": {
       if (!options.event || !options.workflow) throw new CliError("bind needs --event <host.\u2026> and --workflow <workflowId>.", 2);
       if (!String(options.event).startsWith("host.")) throw new CliError('--event must be a host-extension event name starting with "host.".', 2);
-      const res = await requestJson(ctx, BASE33, { method: "POST", body: { eventType: options.event, workflowId: options.workflow } });
+      const res = await requestJson(ctx, BASE34, { method: "POST", body: { eventType: options.event, workflowId: options.workflow } });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -27123,7 +27312,7 @@ async function runHostEvents(ctx, argv) {
     case "enable":
     case "disable": {
       if (positionals.length !== 1) throw new CliError(`Usage: openwop host-events ${sub} <bindingId> [--json]`, 2);
-      const res = await requestJson(ctx, `${BASE33}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: { enabled: sub === "enable" } });
+      const res = await requestJson(ctx, `${BASE34}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body: { enabled: sub === "enable" } });
       if (ctx.json) {
         writeJson(ctx.io.stdout, res.body);
         return 0;
@@ -27137,7 +27326,7 @@ async function runHostEvents(ctx, argv) {
         writeLine(ctx.io.stderr, `Refusing to delete binding ${positionals[0]} without --yes.`);
         return 2;
       }
-      await requestJson(ctx, `${BASE33}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      await requestJson(ctx, `${BASE34}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
       writeLine(ctx.io.stdout, `Deleted binding ${positionals[0]}.`);
       return 0;
     }
@@ -27336,7 +27525,7 @@ Run \`openwop openapi --help\` for usage.`);
 }
 
 // src/cli/assistant.ts
-var BASE34 = "/v1/host/openwop-app/assistant";
+var BASE35 = "/v1/host/openwop-app/assistant";
 var ASSISTANT_HELP = `Usage:
   openwop assistant workspace [--json]
   openwop assistant briefing [--json]
@@ -27399,7 +27588,7 @@ async function runAssistant(ctx, argv) {
       return await runWorkspace2(ctx, rest);
     case "briefing":
     case "brief":
-      return await simpleRead(ctx, rest, `${BASE34}/briefing`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.brief ?? b, null, 2)));
+      return await simpleRead(ctx, rest, `${BASE35}/briefing`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.brief ?? b, null, 2)));
     case "projects":
     case "project":
       return await runProjects2(ctx, rest);
@@ -27412,7 +27601,7 @@ async function runAssistant(ctx, argv) {
     case "meeting":
       return await runMeetings(ctx, rest);
     case "stakeholders":
-      return await simpleRead(ctx, rest, `${BASE34}/stakeholders`, (b) => table2(ctx, b?.stakeholders, (s) => ({
+      return await simpleRead(ctx, rest, `${BASE35}/stakeholders`, (b) => table2(ctx, b?.stakeholders, (s) => ({
         stakeholderId: s.stakeholderId,
         name: s.person?.name ?? s.person?.email ?? "",
         importance: String(s.importance ?? ""),
@@ -27425,7 +27614,7 @@ async function runAssistant(ctx, argv) {
     case "loop":
       return await runLoops(ctx, rest);
     case "health":
-      return await simpleRead(ctx, rest, `${BASE34}/health`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.health ?? b, null, 2)));
+      return await simpleRead(ctx, rest, `${BASE35}/health`, (b) => writeLine(ctx.io.stdout, JSON.stringify(b?.health ?? b, null, 2)));
     default:
       throw new CliError(`Unknown assistant command: ${sub}
 Run \`openwop assistant --help\` for usage.`, 2);
@@ -27455,7 +27644,7 @@ async function runWorkspace2(ctx, argv) {
     write(ctx.io.stdout, ASSISTANT_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, `${BASE34}/workspace-conversation`, { method: "POST", body: {} });
+  const res = await requestJson(ctx, `${BASE35}/workspace-conversation`, { method: "POST", body: {} });
   return emit(ctx, res.body, () => {
     writeLine(ctx.io.stdout, `${res.status === 201 ? "Opened" : "Resumed"} workspace conversation ${res.body?.sessionId}.`);
     writeLine(ctx.io.stdout, `Talk to the assistant: openwop chat messages send ${res.body?.sessionId} --content "\u2026"`);
@@ -27481,7 +27670,7 @@ async function runProjects2(ctx, argv) {
   const id = positionals[0];
   const needId = () => {
     if (!id) throw new CliError(`assistant projects ${sub} requires <projectId>.`, 2);
-    return `${BASE34}/projects/${enc(id)}`;
+    return `${BASE35}/projects/${enc(id)}`;
   };
   const fields = () => {
     const body = {};
@@ -27494,7 +27683,7 @@ async function runProjects2(ctx, argv) {
   };
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, `${BASE34}/projects`);
+      const res = await requestJson(ctx, `${BASE35}/projects`);
       return emit(ctx, res.body, () => table2(ctx, res.body?.projects, projectRow, "No assistant projects. Create one with `openwop assistant projects create --name <n>`."));
     }
     case "get": {
@@ -27515,7 +27704,7 @@ async function runProjects2(ctx, argv) {
     }
     case "create": {
       if (!options.name) throw new CliError("assistant projects create requires --name <n>.", 2);
-      const res = await requestJson(ctx, `${BASE34}/projects`, { method: "POST", body: fields() });
+      const res = await requestJson(ctx, `${BASE35}/projects`, { method: "POST", body: fields() });
       return emit(ctx, res.body, () => writeLine(ctx.io.stdout, `Created project ${res.body?.projectId} (${res.body?.name ?? options.name}).`));
     }
     case "update": {
@@ -27562,14 +27751,14 @@ async function runCommitments(ctx, argv) {
   const id = positionals[0];
   const needId = () => {
     if (!id) throw new CliError(`assistant commitments ${sub} requires <commitmentId>.`, 2);
-    return `${BASE34}/commitments/${enc(id)}`;
+    return `${BASE35}/commitments/${enc(id)}`;
   };
   switch (sub) {
     case "list": {
       const q = new URLSearchParams();
       if (options.status) q.set("status", options.status);
       if (options.project) q.set("projectId", options.project);
-      const res = await requestJson(ctx, `${BASE34}/commitments${q.size ? `?${q}` : ""}`);
+      const res = await requestJson(ctx, `${BASE35}/commitments${q.size ? `?${q}` : ""}`);
       return emit(ctx, res.body, () => table2(ctx, res.body?.commitments, commitmentRow, "No commitments."));
     }
     case "get": {
@@ -27619,7 +27808,7 @@ async function runDecisions(ctx, argv) {
     write(ctx.io.stdout, ASSISTANT_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, `${BASE34}/decisions${options.project ? `?projectId=${enc(options.project)}` : ""}`);
+  const res = await requestJson(ctx, `${BASE35}/decisions${options.project ? `?projectId=${enc(options.project)}` : ""}`);
   return emit(ctx, res.body, () => table2(ctx, res.body?.decisions, (d) => ({
     decisionId: d.decisionId,
     decidedAt: d.decidedAt ?? "",
@@ -27636,7 +27825,7 @@ async function runMeetings(ctx, argv) {
     return 0;
   }
   if (sub === "list") {
-    const res = await requestJson(ctx, `${BASE34}/meetings`);
+    const res = await requestJson(ctx, `${BASE35}/meetings`);
     return emit(ctx, res.body, () => table2(ctx, res.body?.meetings, (m) => ({
       meetingId: m.meetingId,
       startAt: m.startAt ?? "",
@@ -27646,7 +27835,7 @@ async function runMeetings(ctx, argv) {
   }
   if (sub === "get") {
     if (!positionals[0]) throw new CliError("assistant meetings get requires <meetingId>.", 2);
-    const res = await requestJson(ctx, `${BASE34}/meetings/${enc(positionals[0])}`);
+    const res = await requestJson(ctx, `${BASE35}/meetings/${enc(positionals[0])}`);
     const m = res.body ?? {};
     return emit(ctx, res.body, () => writeFields(ctx, [
       ["meetingId", m.meetingId],
@@ -27675,11 +27864,11 @@ async function runPending(ctx, argv) {
   const id = positionals[0];
   const needId = () => {
     if (!id) throw new CliError(`assistant pending ${sub} requires <actionId>.`, 2);
-    return `${BASE34}/pending-actions/${enc(id)}`;
+    return `${BASE35}/pending-actions/${enc(id)}`;
   };
   switch (sub) {
     case "list": {
-      const res = await requestJson(ctx, `${BASE34}/pending-actions${options.status ? `?status=${enc(options.status)}` : ""}`);
+      const res = await requestJson(ctx, `${BASE35}/pending-actions${options.status ? `?status=${enc(options.status)}` : ""}`);
       return emit(ctx, res.body, () => table2(ctx, res.body?.pendingActions, (a) => ({
         actionId: a.actionId,
         kind: a.kind ?? "",
@@ -27723,7 +27912,7 @@ async function runLoops(ctx, argv) {
     return 0;
   }
   if (sub === "list") {
-    const res = await requestJson(ctx, `${BASE34}/loops`);
+    const res = await requestJson(ctx, `${BASE35}/loops`);
     return emit(ctx, res.body, () => table2(ctx, res.body?.loops, (l) => ({
       loopId: l.loopId,
       label: l.label ?? "",
@@ -27738,7 +27927,7 @@ async function runLoops(ctx, argv) {
     if (!loopId) throw new CliError(`assistant loops ${sub} requires <loopId>.`, 2);
     const body = {};
     if (sub === "enable" && options.cron) body.cronExpr = options.cron;
-    const res = await requestJson(ctx, `${BASE34}/loops/${enc(loopId)}/${sub}`, { method: "POST", body });
+    const res = await requestJson(ctx, `${BASE35}/loops/${enc(loopId)}/${sub}`, { method: "POST", body });
     return emit(ctx, res.body, () => writeLine(ctx.io.stdout, `Loop ${loopId}: ${res.body?.enabled ? "enabled" : "disabled"} (job ${res.body?.jobId ?? ""}).`));
   }
   throw new CliError(`Unknown assistant loops command: ${sub}
@@ -27746,7 +27935,7 @@ Run \`openwop assistant --help\` for usage.`, 2);
 }
 
 // src/cli/channels.ts
-var BASE35 = "/v1/host/openwop-app/channels";
+var BASE36 = "/v1/host/openwop-app/channels";
 var CHANNELS_HELP = `Usage:
   openwop channels list [--json]
   openwop channels create --name <n> [--description d] [--private] [--member <userId>]... [--agent <agentId>]... [--json]
@@ -27845,7 +28034,7 @@ function oneId(argv, usage6, spec = {}) {
   const { options, positionals } = parseOptions(argv, { ...spec, bool: ["--help", ...spec.bool ?? []] });
   if (options.help) return { help: true, options, positionals };
   if (!positionals[0]) throw new CliError(`Usage: openwop channels ${usage6}`, 2);
-  return { help: false, options, positionals, path: `${BASE35}/${enc(positionals[0])}` };
+  return { help: false, options, positionals, path: `${BASE36}/${enc(positionals[0])}` };
 }
 function channelSummary(res) {
   const c = res?.channel ?? {};
@@ -27858,7 +28047,7 @@ async function runList4(ctx, argv) {
     write(ctx.io.stdout, CHANNELS_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, BASE35);
+  const res = await requestJson(ctx, BASE36);
   return emit(ctx, res.body, () => {
     const rows = Array.isArray(res.body?.channels) ? res.body.channels : [];
     if (!rows.length) {
@@ -27891,7 +28080,7 @@ async function runCreate(ctx, argv) {
   if (options.description) body.description = options.description;
   if (Array.isArray(options.member) && options.member.length) body.memberUserIds = options.member;
   if (Array.isArray(options.agent) && options.agent.length) body.agentIds = options.agent;
-  const res = await requestJson(ctx, BASE35, { method: "POST", body });
+  const res = await requestJson(ctx, BASE36, { method: "POST", body });
   return emit(ctx, res.body, () => writeLine(ctx.io.stdout, `Created channel ${channelSummary(res.body)}.`));
 }
 async function runGet5(ctx, argv) {
@@ -28861,7 +29050,7 @@ Run \`openwop agent-author --help\` for usage.`, 2);
 }
 
 // src/cli/workflowAuthor.ts
-var BASE36 = "/v1/host/openwop-app/workflow-author";
+var BASE37 = "/v1/host/openwop-app/workflow-author";
 var WORKFLOW_AUTHOR_HELP = `Usage:
   openwop workflow-author catalog [--json]
   openwop workflow-author draft --intent <text> [--provider p] [--model m] [--max-attempts n]
@@ -28897,7 +29086,7 @@ async function runWorkflowAuthor(ctx, argv) {
     return 0;
   }
   if (sub === "catalog") {
-    const res = await requestJson(ctx, `${BASE36}/catalog`);
+    const res = await requestJson(ctx, `${BASE37}/catalog`);
     return emit(ctx, res.body, () => {
       const nodes = Array.isArray(res.body?.nodes) ? res.body.nodes : [];
       if (!nodes.length) writeLine(ctx.io.stdout, "No authorable nodes in this workspace.");
@@ -28913,7 +29102,7 @@ async function runWorkflowAuthor(ctx, argv) {
     if (options.model) body.model = options.model;
     const maxAttempts = intFlag(options.maxAttempts, "--max-attempts");
     if (maxAttempts) body.maxAttempts = maxAttempts;
-    const res = await requestJson(ctx, `${BASE36}/draft`, { method: "POST", body, headers: idempotencyHeaders(options.idempotencyKey) });
+    const res = await requestJson(ctx, `${BASE37}/draft`, { method: "POST", body, headers: idempotencyHeaders(options.idempotencyKey) });
     const runId = res.body?.runId;
     if (!options.follow) {
       return emit(ctx, res.body, () => {
@@ -28940,7 +29129,7 @@ Run \`openwop workflow-author --help\` for usage.`, 2);
 }
 
 // src/cli/workflowProposals.ts
-var BASE37 = "/v1/host/openwop-app/workflow-proposals/admin/policies";
+var BASE38 = "/v1/host/openwop-app/workflow-proposals/admin/policies";
 var WORKFLOW_PROPOSALS_HELP = `Usage:
   openwop workflow-proposals policies --tenant <tenantId> [--json]
   openwop workflow-proposals enable --tenant <tenantId> --agent-profile <agentProfileId> [--json]
@@ -28971,7 +29160,7 @@ async function runWorkflowProposals(ctx, argv) {
   }
   if (!options.tenant) throw new CliError("workflow-proposals requires --tenant <tenantId>.", 2);
   if (sub === "policies" || sub === "list") {
-    const res = await requestJson(ctx, `${BASE37}?tenantId=${enc(options.tenant)}`);
+    const res = await requestJson(ctx, `${BASE38}?tenantId=${enc(options.tenant)}`);
     return emit(ctx, res.body, () => {
       const items = Array.isArray(res.body?.items) ? res.body.items : [];
       if (!items.length) {
@@ -28983,7 +29172,7 @@ async function runWorkflowProposals(ctx, argv) {
   }
   if (sub === "enable" || sub === "disable") {
     if (!options.agentProfile) throw new CliError(`workflow-proposals ${sub} requires --agent-profile <agentProfileId>.`, 2);
-    const path = `${BASE37}/${enc(options.tenant)}/${enc(options.agentProfile)}`;
+    const path = `${BASE38}/${enc(options.tenant)}/${enc(options.agentProfile)}`;
     const res = await requestJson(ctx, path, { method: sub === "enable" ? "PUT" : "DELETE" });
     return emit(ctx, res.body, () => writeLine(ctx.io.stdout, sub === "enable" ? `Auto-approval enabled for ${options.agentProfile} in ${options.tenant}.` : res.body?.removed ? `Auto-approval disabled for ${options.agentProfile} in ${options.tenant}.` : `No policy was set for ${options.agentProfile} in ${options.tenant}.`));
   }
@@ -29929,6 +30118,10 @@ async function runCli(argv, options = {}) {
         return await runConformance(ctx, commandArgs);
       case "onboard":
         return await runOnboard(ctx, commandArgs);
+      case "login":
+        return await runLogin(ctx, commandArgs);
+      case "logout":
+        return await runLogout(ctx, commandArgs);
       case "providers":
       case "provider":
         return await runProviders(ctx, commandArgs);
@@ -30257,6 +30450,8 @@ var HELP_MAP = {
   packs: PACKS_HELP,
   pack: PACKS_HELP,
   onboard: ONBOARD_HELP,
+  login: LOGIN_HELP,
+  logout: LOGIN_HELP,
   providers: PROVIDERS_HELP,
   provider: PROVIDERS_HELP,
   agents: AGENTS_HELP,
@@ -30455,6 +30650,7 @@ Exit codes:
 
 Commands:
   onboard             Guided first-run setup (host + provider + model + BYOK key)
+  login | logout      Sign this terminal in to an openwop-app host by a code (no key to copy)
   providers list      List stored BYOK credential refs (never values)
   providers add       Store a credential ref against the configured host
   providers remove    Remove a credential ref