@paradigma-inc/flywheel 0.1.115 → 0.1.134

package/src/runtime/vendor/flywheel-cli-dist/main.js

@@ -1,27 +1,37 @@
 #!/usr/bin/env node
-import { randomUUID } from 'node:crypto';
-import { access, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import { resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { loadAuthConfig, DEFAULT_BASE_URL, resolveConfigPath, saveAuthConfig, } from './auth/config.js';
-import { baseUrlsEqual } from './auth/baseurl.js';
-import { getKey } from './auth/keychain.js';
-import { loadProfile } from './auth/profile.js';
-import { RUNTIME_ALIASES } from './commands/aliases.js';
-import { BUILTIN_PROFILE_NAMES, isBuiltinProfileName, resolveBuiltinBaseUrl, } from './auth/profiles.js';
-import { renderCommandHelp, renderCommandHelpAsJson, renderHelp, renderHelpAsJson, } from './commands/help.js';
-import { renderUsageSpec } from './commands/usage-spec.js';
-import { getCommandByName } from './commands/registry.js';
-import { MVP_COMMAND_HANDLERS } from './commands/index.js';
-import { CliApprovalPendingError, CliAuthRequirementError, CliFinalizeFailedError, CliUsageError, CliWaitTimeoutError, } from './errors.js';
-import { EXIT_TRANSPORT, EXIT_USAGE } from './exit-codes.js';
-import { extractGlobals, GLOBAL_FLAG_NAMES } from './grammar/globals.js';
-import { parseCliArgs } from './grammar/parse.js';
-import { CliHttpError, createHttpClient, } from './http/client.js';
-import { maskSensitiveForOutput } from './http/debug.js';
-import { renderOutput } from './output/format.js';
-import { CLI_VERSION } from './version.js';
+import { randomUUID } from "node:crypto";
+import { access, writeFile } from "node:fs/promises";
+import os from "node:os";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { processStdoutIsPipe, writeCredentialStream } from "./credential-output.js";
+import { loadFlywheelConfig, saveFlywheelConfig, FlywheelConfigError, resolveFlywheelConfigPath, } from "./config/index.js";
+import { baseUrlsEqual } from "./auth/baseurl.js";
+import { CredentialStoreError, readCredential, resolveCredentialFilePath, } from "./auth/credentials.js";
+import { RUNTIME_ALIASES } from "./commands/aliases.js";
+import { BUILTIN_PROFILE_NAMES, isBuiltinProfileName, resolveBuiltinBaseUrl, } from "./auth/profiles.js";
+import { renderCommandHelp, renderCommandHelpAsJson, renderHelp, renderHelpAsJson, } from "./commands/help.js";
+import { renderUsageSpec } from "./commands/usage-spec.js";
+import { getCommandByName } from "./commands/registry.js";
+import { MVP_COMMAND_HANDLERS } from "./commands/index.js";
+import { repositoryLocalOperationNames } from "./commands/repository-operation.js";
+import { repositoryProjectionNames } from "./commands/repository-projection.js";
+import { repositoryEditNames } from "./commands/repository-edit.js";
+import { hostedGraphMutationNames } from "./commands/hosted-graph.js";
+import { NODE_CREATE_SCHEMA } from "./commands/node-create-schema.js";
+import { RETIRED_COMMAND_NAMES } from "./commands/retired-command-names.js";
+import { renderRepositoryHumanOutput } from "./commands/repository-output.js";
+import { RepositorySelectionError, resolveRepositorySelection, shellQuote, } from "./commands/repository-selection.js";
+import { CliApprovalPendingError, CliAuthRequirementError, CliUsageError, CliWaitTimeoutError, } from "./errors.js";
+import { EXIT_TRANSPORT, EXIT_USAGE } from "./exit-codes.js";
+import { extractGlobals, GLOBAL_BOOLEAN_FLAG_NAMES, GLOBAL_FLAG_NAMES } from "./grammar/globals.js";
+import { parseCliArgs } from "./grammar/parse.js";
+import { CliHttpError, createHttpClient, } from "./http/client.js";
+import { maskSensitiveForOutput } from "./http/debug.js";
+import { renderOutput } from "./output/format.js";
+import { CLI_VERSION } from "./version.js";
+import { LocalRepositoryAdapter } from "./local/adapter.js";
+const DEFAULT_BASE_URL = "http://localhost:8000";
 function defaultStdout(chunk) {
     process.stdout.write(chunk);
 }
@@ -29,140 +39,132 @@ function defaultStderr(chunk) {
     process.stderr.write(chunk);
 }
 function writeLine(writer, text) {
-    if (text.endsWith('\n')) {
+    if (text.endsWith("\n")) {
         writer(text);
         return;
     }
     writer(`${text}\n`);
 }
-/**
- * Derive the active built-in profile state from the already-loaded
- * AuthConfig. Reading from `config` (instead of re-reading the file at
- * `configPath`) keeps the injectable `loadConfig` dependency
- * authoritative — tests and programmatic embedders that hand the CLI an
- * in-memory config must not be silently overridden by stale on-disk
- * state.
- */
+function requestsJsonOutput(argv) {
+    return argv.some((token, index) => token === "--format=json" ||
+        (token === "--format" && argv[index + 1] === "json"));
+}
+function emitRetiredCommandName(command, argv, stderr) {
+    const remediation = RETIRED_COMMAND_NAMES[command];
+    if (!remediation)
+        return undefined;
+    const message = `${command} is retired. Use: ${remediation}`;
+    if (requestsJsonOutput(argv)) {
+        writeLine(stderr, JSON.stringify({
+            error: {
+                code: "retired_command_name",
+                message,
+                remediation,
+                exit_code: 1,
+            },
+        }));
+    }
+    else {
+        writeLine(stderr, message);
+    }
+    return 1;
+}
 function activeBuiltinFromConfig(config) {
-    const empty = {
-        name: undefined,
-        baseUrl: undefined,
-        apiKey: undefined,
-    };
     const rawName = config.activeProfile;
-    if (typeof rawName !== 'string' || !rawName.trim())
-        return empty;
+    if (typeof rawName !== "string" ||
+        !rawName.trim() ||
+        !isBuiltinProfileName(rawName.trim())) {
+        return { name: undefined, baseUrl: undefined };
+    }
     const name = rawName.trim();
-    if (!isBuiltinProfileName(name))
-        return empty;
-    const baseUrl = resolveBuiltinBaseUrl(name);
-    const bucket = config.profileKeys?.[name];
-    const candidate = bucket?.apiKey;
-    const apiKey = typeof candidate === 'string' && candidate.trim() ? candidate : undefined;
-    return { name, baseUrl, apiKey };
+    return { name, baseUrl: resolveBuiltinBaseUrl(name) };
+}
+function assertRepositoryTransportOrigin(baseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        throw new CliHttpError("repository remotes require HTTPS or loopback HTTP", EXIT_TRANSPORT);
+    }
+    const loopbackHttp = parsed.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "[::1]", "::1"].includes(parsed.hostname.toLowerCase());
+    if (parsed.protocol === "https:" || loopbackHttp)
+        return;
+    throw new CliHttpError("repository remotes require HTTPS or loopback HTTP", EXIT_TRANSPORT);
 }
-async function resolveRuntimeAuthConfig(config, profile, resolveEnvApiKey) {
+async function resolveRuntimeAuthConfig(config, profile, resolveEnvApiKey, resolveCredentialFile, credentialLookupEnabled, readStoredCredential, repositoryRemote = false) {
     const envBaseUrl = process.env.FLYWHEEL_BASE_URL?.trim();
-    // Resolution order:
-    //   FLYWHEEL_BASE_URL → --env=<name>'s profile.baseUrl → active built-in
-    //   profile pointer in config.activeProfile → legacy config.baseUrl →
-    //   DEFAULT_BASE_URL. Built-in baseUrls are ephemeral constants — they are
-    //   never written into config.baseUrl, so upstream URL changes flow through
-    //   automatically.
     const activeBuiltin = activeBuiltinFromConfig(config);
-    const baseUrl = envBaseUrl ||
-        profile?.baseUrl ||
-        activeBuiltin.baseUrl ||
-        config.baseUrl ||
-        DEFAULT_BASE_URL;
-    let apiKey = process.env.FLYWHEEL_API_KEY?.trim() || undefined;
-    // Token-scoping guard: a profile's `api_key_env` / `api_key_keychain`
-    // credentials are minted for the profile's declared baseUrl. If the
-    // resolved baseUrl has since moved off that origin (typically via
-    // FLYWHEEL_BASE_URL override), the profile's credential must NOT ride
-    // along to a different host — that would leak the token across
-    // environments. Every other credential source in this resolver is
-    // already baseUrl-scoped; these two sources were the last hole.
-    const profileBindsToResolvedBaseUrl = profile !== null &&
-        profile.baseUrl !== undefined &&
-        baseUrlsEqual(baseUrl, profile.baseUrl);
-    if (!apiKey && profile?.apiKeyEnv && profileBindsToResolvedBaseUrl) {
+    const activeProfile = typeof config.activeProfile === "string" && config.activeProfile.trim()
+        ? config.activeProfile.trim()
+        : undefined;
+    const baseUrl = envBaseUrl || profile?.baseUrl || activeBuiltin.baseUrl || DEFAULT_BASE_URL;
+    if (repositoryRemote)
+        assertRepositoryTransportOrigin(baseUrl);
+    const credentialProfile = profile?.name ?? activeBuiltin.name ?? activeProfile ?? "default";
+    const credentialBaseUrl = profile?.baseUrl ?? activeBuiltin.baseUrl ??
+        (credentialProfile === "default" ? baseUrl : DEFAULT_BASE_URL);
+    const environmentApiKey = process.env.FLYWHEEL_API_KEY?.trim() || undefined;
+    if (repositoryRemote &&
+        environmentApiKey &&
+        (!envBaseUrl || !baseUrlsEqual(baseUrl, envBaseUrl))) {
+        throw new CliHttpError("credential_store_unavailable", EXIT_TRANSPORT);
+    }
+    let apiKey = environmentApiKey;
+    if (!apiKey &&
+        profile?.apiKeyEnv &&
+        profile.baseUrl &&
+        baseUrlsEqual(baseUrl, profile.baseUrl)) {
         apiKey = resolveEnvApiKey(profile.apiKeyEnv);
     }
-    if (!apiKey && profile?.apiKeyKeychain && profileBindsToResolvedBaseUrl) {
-        const stored = await getKey('flywheel-cli', profile.name);
-        if (stored) {
-            apiKey = stored;
-        }
+    let credentialReadiness;
+    if (apiKey || !credentialLookupEnabled) {
+        credentialReadiness = "not_checked";
     }
-    // `--env=<builtin>` selects a built-in profile for this invocation.
-    // Pull its stored apiKey from `config.profileKeys[name]` so the
-    // one-shot override gets the same auth a persisted `env switch` would.
-    // Tied to the built-in's baseUrl so a manual baseUrl override (e.g.
-    // FLYWHEEL_BASE_URL) doesn't carry the per-profile token to a
-    // different origin.
-    if (!apiKey &&
-        profile !== null &&
-        isBuiltinProfileName(profile.name) &&
-        baseUrlsEqual(baseUrl, resolveBuiltinBaseUrl(profile.name))) {
-        const candidate = config.profileKeys?.[profile.name]?.apiKey;
-        if (typeof candidate === 'string' && candidate.trim()) {
-            apiKey = candidate;
-        }
+    else if (baseUrlsEqual(baseUrl, credentialBaseUrl)) {
+        const storedCredential = await readStoredCredential(credentialProfile, credentialBaseUrl, resolveCredentialFile());
+        credentialReadiness = storedCredential ? "ready" : "missing";
+        apiKey = storedCredential ?? undefined;
     }
-    // Prefer the per-profile apiKey stored by `auth:login` while a built-in
-    // profile is active — but only when the resolved baseUrl is still that
-    // built-in's origin. A `FLYWHEEL_BASE_URL` override or `--env=<legacy>`
-    // flag moves the request to a different host; attaching the stored
-    // prod/staging bearer there would leak credentials across environments.
-    // The legacy flat `config.apiKey` is intentionally left unset under
-    // active-profile logins (so the built-in baseUrl never bleeds into
-    // config.json); consult it only when no per-profile key is present.
-    if (!apiKey &&
-        activeBuiltin.apiKey &&
-        baseUrlsEqual(baseUrl, activeBuiltin.baseUrl)) {
-        apiKey = activeBuiltin.apiKey;
-    }
-    // The legacy `config.apiKey` belongs to `config.baseUrl` and only to
-    // that origin. Every path that resolves `baseUrl` to anything else
-    // (built-in profile pointer, `--env=<legacy-profile>`, or
-    // `FLYWHEEL_BASE_URL` override) must NOT have the legacy key ride
-    // along: that single stored key would otherwise leak across any target
-    // origin the user points the CLI at.
-    // Canonical equality so `FLYWHEEL_BASE_URL=<config.baseUrl>/` (and
-    // other RFC 3986 §6.2.2-equivalent variants) still binds the legacy
-    // flat key to its origin instead of being treated as an unrelated
-    // host. See `auth/baseurl.ts` for the normalisation rules.
-    if (!apiKey && baseUrlsEqual(config.baseUrl, baseUrl)) {
-        apiKey = config.apiKey ?? undefined;
+    else {
+        credentialReadiness = "not_checked";
+    }
+    if (repositoryRemote && !apiKey) {
+        throw new CliHttpError("credential_store_unavailable", EXIT_TRANSPORT);
     }
     return {
         baseUrl,
+        credentialBaseUrl: environmentApiKey
+            ? baseUrl
+            : credentialBaseUrl,
         apiKey,
+        credentialReadiness,
         defaultFormat: profile?.defaultFormat,
     };
 }
-const HELP_TOKENS = new Set(['--help', '-h']);
-const USAGE_TOKENS = new Set(['--usage', '--usage-spec']);
-const SCHEMA_TOKEN = '--schema';
-const HELP_EXTRAS_PREFIX = '--_help_extras=';
-const USAGE_EXTRAS_PREFIX = '--_usage_extras=';
-const USAGE_VERSION_PREFIX = '--_usage_version=';
+const HELP_TOKENS = new Set(["--help", "-h"]);
+const USAGE_TOKENS = new Set(["--usage", "--usage-spec"]);
+const SCHEMA_TOKEN = "--schema";
+const HELP_EXTRAS_PREFIX = "--_help_extras=";
+const USAGE_EXTRAS_PREFIX = "--_usage_extras=";
+const USAGE_VERSION_PREFIX = "--_usage_version=";
 const VALID_TOPIC_IDS = new Set([
-    'setup-admin',
-    'auth',
-    'profile',
-    'nodes-graph',
-    'artifacts-files',
-    'hooks',
-    'compute-executions',
-    'approvals-budgets',
-    'export-import',
-    'updates-resources',
-    'account-credits',
-    'integrations',
-    'api-keys',
-    'admin',
+    "setup-admin",
+    "auth",
+    "profile",
+    "nodes-graph",
+    "repo-workflow",
+    "hosted-graph",
+    "hooks",
+    "compute-executions",
+    "approvals-budgets",
+    "export-import",
+    "updates-resources",
+    "account-credits",
+    "integrations",
+    "api-keys",
+    "admin",
 ]);
 function parseHelpExtras(argv) {
     let raw;
@@ -173,79 +175,83 @@ function parseHelpExtras(argv) {
         }
     }
     if (raw === undefined)
-        return { kind: 'absent' };
+        return { kind: "absent" };
     let decoded;
     try {
         decoded = JSON.parse(raw);
     }
     catch {
-        return { kind: 'invalid' };
+        return { kind: "invalid" };
     }
     if (!Array.isArray(decoded))
-        return { kind: 'invalid' };
+        return { kind: "invalid" };
     const extras = [];
     for (const entry of decoded) {
         if (!entry ||
-            typeof entry !== 'object' ||
-            typeof entry.group !== 'string' ||
-            typeof entry.name !== 'string' ||
-            typeof entry.summary !== 'string') {
-            return { kind: 'invalid' };
+            typeof entry !== "object" ||
+            typeof entry.group !== "string" ||
+            typeof entry.name !== "string" ||
+            typeof entry.summary !== "string") {
+            return { kind: "invalid" };
         }
         const group = entry.group;
         if (!VALID_TOPIC_IDS.has(group))
-            return { kind: 'invalid' };
+            return { kind: "invalid" };
         extras.push({
             group,
             name: entry.name,
             summary: entry.summary,
         });
     }
-    return { kind: 'ok', extras };
+    return { kind: "ok", extras };
 }
 function stripHelpExtras(argv) {
     return argv.filter((t) => !t.startsWith(HELP_EXTRAS_PREFIX));
 }
 function isStringArray(value) {
-    return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
+    return (Array.isArray(value) && value.every((entry) => typeof entry === "string"));
 }
 function isCommandParamArray(value) {
     return (Array.isArray(value) &&
         value.every((entry) => {
-            if (!entry || typeof entry !== 'object')
+            if (!entry || typeof entry !== "object")
                 return false;
             const candidate = entry;
-            return (typeof candidate.name === 'string' &&
-                ['string', 'integer', 'json', 'boolean'].includes(String(candidate.type)) &&
-                typeof candidate.description === 'string' &&
-                (candidate.default === undefined || typeof candidate.default === 'string'));
+            return (typeof candidate.name === "string" &&
+                ["string", "integer", "json", "boolean"].includes(String(candidate.type)) &&
+                typeof candidate.description === "string" &&
+                (candidate.default === undefined ||
+                    typeof candidate.default === "string"));
         }));
 }
 function isCommandExampleArray(value) {
     return (Array.isArray(value) &&
         value.every((entry) => {
-            if (!entry || typeof entry !== 'object')
+            if (!entry || typeof entry !== "object")
                 return false;
             const candidate = entry;
-            return (typeof candidate.description === 'string' &&
-                typeof candidate.invocation === 'string');
+            return (typeof candidate.description === "string" &&
+                typeof candidate.invocation === "string");
         }));
 }
 function isUsageExtra(value) {
-    if (!value || typeof value !== 'object')
+    if (!value || typeof value !== "object")
         return false;
     const candidate = value;
-    return (typeof candidate.name === 'string' &&
-        typeof candidate.group === 'string' &&
+    return (typeof candidate.name === "string" &&
+        typeof candidate.group === "string" &&
         VALID_TOPIC_IDS.has(candidate.group) &&
-        typeof candidate.summary === 'string' &&
+        typeof candidate.summary === "string" &&
         (candidate.endpoints === undefined || isStringArray(candidate.endpoints)) &&
-        (candidate.required === undefined || isCommandParamArray(candidate.required)) &&
-        (candidate.optional === undefined || isCommandParamArray(candidate.optional)) &&
-        (candidate.examples === undefined || isCommandExampleArray(candidate.examples)) &&
+        (candidate.required === undefined ||
+            isCommandParamArray(candidate.required)) &&
+        (candidate.optional === undefined ||
+            isCommandParamArray(candidate.optional)) &&
+        (candidate.examples === undefined ||
+            isCommandExampleArray(candidate.examples)) &&
         (candidate.related === undefined || isStringArray(candidate.related)) &&
-        (candidate.schema === undefined || typeof candidate.schema === 'string') &&
-        (candidate.hidden === undefined || typeof candidate.hidden === 'boolean'));
+        (candidate.schema === undefined || typeof candidate.schema === "string") &&
+        (candidate.hidden === undefined || typeof candidate.hidden === "boolean"));
 }
 function parseUsageExtras(argv) {
     const rawValues = argv
@@ -255,15 +261,15 @@ function parseUsageExtras(argv) {
         .filter((token) => token.startsWith(USAGE_VERSION_PREFIX))
         .map((token) => token.slice(USAGE_VERSION_PREFIX.length));
     if (rawValues.length === 0 && rawVersionValues.length === 0) {
-        return { kind: 'ok', extras: [] };
+        return { kind: "ok", extras: [] };
     }
     if (rawValues.length > 1)
-        return { kind: 'invalid' };
+        return { kind: "invalid" };
     if (rawVersionValues.length > 1)
-        return { kind: 'invalid' };
+        return { kind: "invalid" };
     const version = rawVersionValues[0];
-    if (version !== undefined && version.trim() === '')
-        return { kind: 'invalid' };
+    if (version !== undefined && version.trim() === "")
+        return { kind: "invalid" };
     let extras = [];
     if (rawValues.length === 1) {
         let decoded;
@@ -271,45 +277,60 @@ function parseUsageExtras(argv) {
             decoded = JSON.parse(rawValues[0]);
         }
         catch {
-            return { kind: 'invalid' };
+            return { kind: "invalid" };
         }
         if (!Array.isArray(decoded) || !decoded.every(isUsageExtra)) {
-            return { kind: 'invalid' };
+            return { kind: "invalid" };
         }
         extras = decoded;
     }
-    return { kind: 'ok', extras, version };
+    return { kind: "ok", extras, version };
 }
-// Commands that do not touch the HTTP runtime and therefore must run even
-// when ~/.config/flywheel-cli/config.json is absent. These are purely local
-// state operations (profile bookkeeping, keychain reads/writes) plus the
-// bootstrap auth:login flow, so gating them on runtime config would break the
-// exact recovery paths a user needs when the config is missing.
-const RUNTIME_CONFIG_OPTIONAL_COMMANDS = new Set([
-    'profile:list',
-    'profile:show',
-    'profile:set',
-    'profile:unset',
-    'auth:login',
-    'auth:keychain:set',
-    'auth:keychain:clear',
-    'env:list',
-    'env:switch',
-]);
+const LOCAL_REPOSITORY_REMOTE_COMMANDS = [
+    "repo:clone",
+    "repo:pull",
+    "repo:push",
+    "repo:purge",
+];
+const LOCAL_REPOSITORY_OFFLINE_COMMANDS = [
+    ...repositoryLocalOperationNames.filter((command) => !LOCAL_REPOSITORY_REMOTE_COMMANDS.includes(command)),
+    ...repositoryProjectionNames,
+    ...repositoryEditNames,
+];
+// Offline repository commands do not need credential resolution. Remote
+// repository operations use the ordinary CLI HTTP client as their auth boundary.
+const CREDENTIAL_LOOKUP_SKIPPED_COMMANDS = [
+    "profile:list",
+    "profile:show",
+    "profile:set",
+    "profile:unset",
+    "auth:login",
+    "auth:credentials:set",
+    "auth:credentials:clear",
+    "env:list",
+    "env:switch",
+    ...LOCAL_REPOSITORY_OFFLINE_COMMANDS,
+];
+// Commands that can recover or inspect configuration without requiring the
+// runtime config file. auth:status still resolves the selected credential.
+const RUNTIME_CONFIG_OPTIONAL_COMMANDS = [
+    ...CREDENTIAL_LOOKUP_SKIPPED_COMMANDS,
+    "auth:status",
+];
 const API_KEY_BOUND_BROWSER_AND_INTEGRATION_COMMANDS = new Set([
-    'credits:purchase',
-    'credits:subscribe',
-    'credits:billing-portal',
-    'github:link',
-    'github:refresh-repos',
-    'github:disconnect',
-    'integrations:wandb:set',
-    'integrations:wandb:remove',
-    'integrations:huggingface:set',
-    'integrations:huggingface:remove',
+    "credits:purchase",
+    "credits:subscribe",
+    "credits:billing-portal",
+    "github:link",
+    "github:refresh-repos",
+    "github:disconnect",
+    "integrations:wandb:set",
+    "integrations:wandb:remove",
+    "integrations:huggingface:set",
+    "integrations:huggingface:remove",
 ]);
-const RAW_API_KEY_ALLOWLIST_DETAIL = 'API key authentication is not allowed on this endpoint';
-const CLI_API_KEY_BOUND_ALLOWLIST_DETAIL = 'API-key access is unavailable for this command. Update the server API-key route allowlist for this endpoint.';
+const RAW_API_KEY_ALLOWLIST_DETAIL = "API key authentication is not allowed on this endpoint";
+const CLI_API_KEY_BOUND_ALLOWLIST_DETAIL = "API-key access is unavailable for this command. Update the server API-key route allowlist for this endpoint.";
 function isHelpToken(token) {
     return HELP_TOKENS.has(token);
 }
@@ -327,7 +348,7 @@ function rewriteAlias(argv) {
     if (argv.length === 0)
         return argv;
     const head = argv[0];
-    if (head === 'help' || head === '--help' || head === '-h')
+    if (head === "help" || head === "--help" || head === "-h")
         return argv;
     if (!Object.prototype.hasOwnProperty.call(RUNTIME_ALIASES, head))
         return argv;
@@ -335,24 +356,24 @@ function rewriteAlias(argv) {
     return [canonical, ...argv.slice(1)];
 }
 function parseHelpFormat(argv) {
-    let result = { kind: 'absent' };
+    let result = { kind: "absent" };
     for (let i = 0; i < argv.length; i += 1) {
         const token = argv[i];
         let value;
-        if (token.startsWith('--format=')) {
-            value = token.slice('--format='.length);
+        if (token.startsWith("--format=")) {
+            value = token.slice("--format=".length);
         }
-        else if (token === '--format') {
+        else if (token === "--format") {
             value = argv[i + 1];
         }
         else {
             continue;
         }
-        if (value === 'json') {
-            result = { kind: 'json' };
+        if (value === "json") {
+            result = { kind: "json" };
         }
         else {
-            return { kind: 'invalid', value: value ?? '' };
+            return { kind: "invalid", value: value ?? "" };
         }
     }
     return result;
@@ -368,9 +389,9 @@ function stripFormatTokens(argv) {
     const out = [];
     for (let i = 0; i < argv.length; i += 1) {
         const token = argv[i];
-        if (token.startsWith('--format='))
+        if (token.startsWith("--format="))
             continue;
-        if (token === '--format') {
+        if (token === "--format") {
             i += 1; // skip the value
             continue;
         }
@@ -387,7 +408,7 @@ function normalizeCommandHelpArgs(argv) {
             schema = true;
             continue;
         }
-        if (token === '--aliases' || token === '-a') {
+        if (token === "--aliases" || token === "-a") {
             aliases = true;
             continue;
         }
@@ -398,7 +419,7 @@ function normalizeCommandHelpArgs(argv) {
 function renderAliasesHelp() {
     return `${Object.entries(RUNTIME_ALIASES)
         .map(([aliasCommand, canonicalCommand]) => `  ${aliasCommand} → ${canonicalCommand}`)
-        .join('\n')}\n`;
+        .join("\n")}\n`;
 }
 function emitCommandHelp(stdout, stderr, commandName, schema, asJson) {
     if (asJson) {
@@ -412,7 +433,7 @@ function emitCommandHelp(stdout, stderr, commandName, schema, asJson) {
         return 0;
     }
     const helpText = renderCommandHelp(commandName, { schema });
-    if (helpText.startsWith('unknown command:')) {
+    if (helpText.startsWith("unknown command:")) {
         writeLine(stderr, helpText.trim());
         return 1;
     }
@@ -426,91 +447,95 @@ function buildMissingParamHint(commandName, message) {
     }
     const lines = [message];
     if (command.required.length > 0) {
-        lines.push('Required:');
+        lines.push("Required:");
         for (const param of command.required) {
-            const typeHint = param.type === 'boolean' ? '' : ` <${param.type}>`;
+            const typeHint = param.type === "boolean" ? "" : ` <${param.type}>`;
             lines.push(`  --${param.name}${typeHint}  ${param.description}`);
         }
     }
     if (command.examples.length > 0) {
-        lines.push('Example:');
+        lines.push("Example:");
         lines.push(`  ${command.examples[0].invocation}`);
     }
-    return lines.join('\n');
+    return lines.join("\n");
+}
+function bindCommandPositionals(commandName, positionals, params) {
+    const command = getCommandByName(commandName);
+    const definitions = command?.positionals ?? [];
+    for (const [index, definition] of definitions.entries()) {
+        const value = positionals[index];
+        if (value === undefined) {
+            if (command?.required.some((param) => param.name === definition.name)) {
+                throw new CliUsageError(`missing positional argument: ${definition.name}`);
+            }
+            continue;
+        }
+        if (params[definition.name] !== undefined) {
+            throw new CliUsageError(`duplicate argument: ${definition.name}`);
+        }
+        params[definition.name] = value;
+    }
 }
 function validateCommandSpecificFlags(commandName, params) {
     const command = getCommandByName(commandName);
     if (!command) {
         return;
     }
-    const allowed = new Set([
-        ...command.required.map((param) => param.name),
-        ...command.optional.map((param) => param.name),
-    ]);
+    const positionals = new Set((command.positionals ?? []).map((param) => param.name));
+    const allowed = new Map([...command.required, ...command.optional]
+        .filter((param) => !positionals.has(param.name))
+        .map((param) => [param.name, param]));
     for (const flagName of Object.keys(params)) {
         if (GLOBAL_FLAG_NAMES.has(flagName)) {
             continue;
         }
-        if (!allowed.has(flagName)) {
+        const definition = allowed.get(flagName);
+        if (!definition) {
             throw new CliUsageError(`unknown flag for ${commandName}: --${flagName}`);
         }
+        if (definition.type !== "boolean" && typeof params[flagName] !== "string") {
+            throw new CliUsageError(`missing value for --${flagName}`);
+        }
     }
 }
-function buildCommitSchemaHint(commandName, message) {
-    const command = getCommandByName(commandName);
-    if (!command?.schema) {
-        return message;
-    }
-    const lines = [message];
-    lines.push(`hint: payload rejected by server. Run \`flywheel help ${commandName} --schema\` to see the required JSON shape.`);
-    lines.push('Required payload keys (see schema for full shape):');
-    const keyMatches = command.schema.match(/^\s*"([^"]+)"\s*:/gm) ?? [];
-    const topLevelKeys = Array.from(new Set(keyMatches
-        .map((line) => line.match(/"([^"]+)"/)?.[1])
-        .filter((key) => Boolean(key)))).slice(0, 6);
-    for (const key of topLevelKeys) {
-        lines.push(`  ${key}`);
-    }
-    return lines.join('\n');
-}
 function buildLocalhostTransportHint(message, baseUrl) {
-    if (!message.includes('transport error')) {
+    if (!message.includes("transport error")) {
         return message;
     }
-    const normalizedBase = baseUrl.replace(/\/+$/, '');
-    if (normalizedBase !== DEFAULT_BASE_URL.replace(/\/+$/, '')) {
+    const normalizedBase = baseUrl.replace(/\/+$/, "");
+    if (normalizedBase !== DEFAULT_BASE_URL.replace(/\/+$/, "")) {
         return message;
     }
     const lines = [message];
     lines.push(`hint: runtime is pointing at the default localhost fallback (${DEFAULT_BASE_URL}).`);
-    // Only --mode cli provisions ~/.config/flywheel-cli/config.json; --mode mcp
+    // Only --mode cli provisions ~/.config/flywheel/config.toml; --mode mcp
     // writes host MCP entries and cannot fix a stale runtime base URL, so do not
     // offer it as an alternative here.
-    lines.push('  Run `npx --yes @paradigma-inc/flywheel setup --mode cli` to configure Flywheel.');
-    return lines.join('\n');
+    lines.push("  Run `npx --yes @paradigma-inc/flywheel setup --mode cli` to configure Flywheel.");
+    return lines.join("\n");
 }
 function looksLikeNodeSlug(value) {
     return /^[a-z][a-z0-9]*-[a-z][a-z0-9]*-\d{4}$/.test(value);
 }
 function buildNodeSlugMissHint(args) {
     const { commandName, status, params, message } = args;
-    if (commandName !== 'nodes:get' || status !== 404) {
+    if (commandName !== "hosted:node:get" || status !== 404) {
         return message;
     }
     const nodeId = params.node_id;
-    if (typeof nodeId !== 'string' || !looksLikeNodeSlug(nodeId.trim())) {
+    if (typeof nodeId !== "string" || !looksLikeNodeSlug(nodeId.trim())) {
         return message;
     }
     return [
         message,
         `hint: node_id looks like a slug. Use \`flywheel nodes:resolve-slug --slug_name ${nodeId.trim()}\` to resolve it.`,
-    ].join('\n');
+    ].join("\n");
 }
 function formatConfigPathForMessage(configPath) {
     const homeDir = os.homedir();
     const withSlash = `${homeDir}/`;
     if (configPath === homeDir) {
-        return '~';
+        return "~";
     }
     if (configPath.startsWith(withSlash)) {
         return `~/${configPath.slice(withSlash.length)}`;
@@ -519,23 +544,23 @@ function formatConfigPathForMessage(configPath) {
 }
 function buildMissingRuntimeConfigMessage(configPath) {
     const displayPath = formatConfigPathForMessage(configPath);
-    // Only --mode cli writes ~/.config/flywheel-cli/config.json. Pointing at
+    // Only --mode cli writes ~/.config/flywheel/config.toml. Pointing at
     // --mode mcp as a fix would loop users back to this same error because MCP
     // setup only touches host MCP entries, not the runtime CLI config.
     return `Flywheel CLI runtime config not found at ${displayPath}. Run \`npx --yes @paradigma-inc/flywheel setup --mode cli\` to configure Flywheel.`;
 }
 function isPolicyBlockedResponseBody(body) {
-    if (!body || typeof body !== 'object') {
+    if (!body || typeof body !== "object") {
         return false;
     }
     const detail = body.detail;
-    if (!detail || typeof detail !== 'object') {
+    if (!detail || typeof detail !== "object") {
         return false;
     }
-    return detail.type === 'policy_blocked';
+    return detail.type === "policy_blocked";
 }
 function isRawApiKeyAllowlistResponseBody(body) {
-    if (!body || typeof body !== 'object') {
+    if (!body || typeof body !== "object") {
         return false;
     }
     return body.detail === RAW_API_KEY_ALLOWLIST_DETAIL;
@@ -595,18 +620,22 @@ async function defaultConfigExists(filePath) {
     }
 }
 export async function runCli(argv, dependencies = {}) {
+    const credentialMode = argv[0] === "admin:test-users:login" &&
+        argv.some((arg) => /^--(?:headless|credential-stdout)(?:=|$)/.test(arg));
     const stdout = dependencies.stdout ?? defaultStdout;
     const stderr = dependencies.stderr ?? defaultStderr;
+    const credentialOutput = credentialMode && !dependencies.stdout && processStdoutIsPipe()
+        ? "pipe" : undefined;
     if (argv.length === 0) {
-        writeLine(stderr, 'usage: flywheel <command> [options]');
+        writeLine(stderr, "usage: flywheel <command> [options]");
         return EXIT_USAGE;
     }
     argv = rewriteAlias(argv);
     const [first, ...rest] = argv;
     if (USAGE_TOKENS.has(first)) {
         const extrasParsed = parseUsageExtras(argv);
-        if (extrasParsed.kind === 'invalid') {
-            writeLine(stderr, 'invalid --_usage_extras payload');
+        if (extrasParsed.kind === "invalid") {
+            writeLine(stderr, "invalid --_usage_extras payload");
             return EXIT_USAGE;
         }
         stdout(renderUsageSpec({
@@ -619,21 +648,21 @@ export async function runCli(argv, dependencies = {}) {
         token.startsWith(USAGE_VERSION_PREFIX));
     if (usagePrivateFlag !== undefined) {
         writeLine(stderr, usagePrivateFlag.startsWith(USAGE_VERSION_PREFIX)
-            ? 'unknown flag: --_usage_version'
-            : 'unknown flag: --_usage_extras');
+            ? "unknown flag: --_usage_version"
+            : "unknown flag: --_usage_extras");
         return EXIT_USAGE;
     }
     // Help-format validation intentionally runs only inside the help branches
     // below. Non-help commands let `parseCliArgs` validate --format against the
     // full json|tsv|csv|table set; validating here would reject legitimate
-    // runtime formats like `flywheel nodes:list --format=csv`.
+    // runtime formats like `flywheel hosted:node:list --format=csv`.
     function resolveHelpFormat() {
         const fmt = parseHelpFormat(argv);
-        if (fmt.kind === 'invalid') {
+        if (fmt.kind === "invalid") {
             writeLine(stderr, `invalid --format=${fmt.value}: help supports --format=json or no --format (text)`);
             return EXIT_USAGE;
         }
-        return { json: fmt.kind === 'json' };
+        return { json: fmt.kind === "json" };
     }
     // Top-level help / `help ...` dispatcher runs BEFORE parseCliArgs because
     // `flywheel --help` and `flywheel help ...` aren't valid command tokens —
@@ -644,31 +673,31 @@ export async function runCli(argv, dependencies = {}) {
     // does not incorrectly drop into help mode on the `-h` value token.
     if (isHelpToken(first)) {
         const resolved = resolveHelpFormat();
-        if (typeof resolved === 'number')
+        if (typeof resolved === "number")
             return resolved;
         const extrasParsed = parseHelpExtras(argv);
-        if (extrasParsed.kind === 'invalid') {
-            writeLine(stderr, 'invalid --_help_extras payload');
+        if (extrasParsed.kind === "invalid") {
+            writeLine(stderr, "invalid --_help_extras payload");
             return EXIT_USAGE;
         }
-        const extras = extrasParsed.kind === 'ok' ? extrasParsed.extras : [];
+        const extras = extrasParsed.kind === "ok" ? extrasParsed.extras : [];
         stdout(resolved.json ? renderHelpAsJson(extras) : renderHelp(extras));
         return 0;
     }
-    if (first === 'help') {
+    if (first === "help") {
         const resolved = resolveHelpFormat();
-        if (typeof resolved === 'number')
+        if (typeof resolved === "number")
             return resolved;
         // Strip --format and --_help_extras tokens so the positional <command>
         // lookup isn't fooled by them occupying rest[0].
-        const { commandArgs: helpArgs, schema, aliases } = normalizeCommandHelpArgs(stripHelpExtras(stripFormatTokens(rest)));
+        const { commandArgs: helpArgs, schema, aliases, } = normalizeCommandHelpArgs(stripHelpExtras(stripFormatTokens(rest)));
         const extrasParsed = parseHelpExtras(argv);
-        if (extrasParsed.kind === 'invalid') {
-            writeLine(stderr, 'invalid --_help_extras payload');
+        if (extrasParsed.kind === "invalid") {
+            writeLine(stderr, "invalid --_help_extras payload");
             return EXIT_USAGE;
         }
         if (schema && helpArgs.length === 0) {
-            writeLine(stderr, '--schema requires a command name');
+            writeLine(stderr, "--schema requires a command name");
             return EXIT_USAGE;
         }
         if (aliases) {
@@ -676,14 +705,14 @@ export async function runCli(argv, dependencies = {}) {
             return 0;
         }
         if (helpArgs.length === 0) {
-            const extras = extrasParsed.kind === 'ok' ? extrasParsed.extras : [];
+            const extras = extrasParsed.kind === "ok" ? extrasParsed.extras : [];
             stdout(resolved.json ? renderHelpAsJson(extras) : renderHelp(extras));
             return 0;
         }
         // --_help_extras is only valid on top-level help. Surface mis-use
         // as a usage error rather than silently ignoring it.
-        if (extrasParsed.kind === 'ok') {
-            writeLine(stderr, 'unknown flag: --_help_extras');
+        if (extrasParsed.kind === "ok") {
+            writeLine(stderr, "unknown flag: --_help_extras");
             return EXIT_USAGE;
         }
         // `help <alias>` must resolve the same alias map used by the SHORTCUTS
@@ -692,16 +721,35 @@ export async function runCli(argv, dependencies = {}) {
         const commandName = Object.prototype.hasOwnProperty.call(RUNTIME_ALIASES, rawCommandName)
             ? RUNTIME_ALIASES[rawCommandName]
             : rawCommandName;
+        const retiredExitCode = emitRetiredCommandName(commandName, argv, stderr);
+        if (retiredExitCode !== undefined)
+            return retiredExitCode;
         return emitCommandHelp(stdout, stderr, commandName, schema, resolved.json);
     }
     // --_help_extras is reserved for top-level help dispatch only. Reject it
     // when seen on any other command path so it cannot leak into runtime
     // argument parsing downstream.
     if (argv.some((t) => t.startsWith(HELP_EXTRAS_PREFIX))) {
-        writeLine(stderr, 'unknown flag: --_help_extras');
+        writeLine(stderr, "unknown flag: --_help_extras");
         return EXIT_USAGE;
     }
-    const parsed = parseCliArgs(argv);
+    const retiredExitCode = emitRetiredCommandName(argv[0] ?? "", argv, stderr);
+    if (retiredExitCode !== undefined)
+        return retiredExitCode;
+    const commandDefinition = getCommandByName(argv[0] ?? "");
+    const positionalLimit = commandDefinition?.positionals?.length ?? 0;
+    const booleanFlags = [...GLOBAL_BOOLEAN_FLAG_NAMES];
+    if (commandDefinition) {
+        for (const parameter of commandDefinition.required) {
+            if (parameter.type === "boolean")
+                booleanFlags.push(parameter.name);
+        }
+        for (const parameter of commandDefinition.optional) {
+            if (parameter.type === "boolean")
+                booleanFlags.push(parameter.name);
+        }
+    }
+    const parsed = parseCliArgs(argv, positionalLimit, booleanFlags);
     if (!parsed.ok) {
         writeLine(stderr, parsed.message);
         return parsed.exitCode;
@@ -714,49 +762,85 @@ export async function runCli(argv, dependencies = {}) {
     const schemaRequested = parsed.params.schema === true;
     if (helpRequested) {
         const resolved = resolveHelpFormat();
-        if (typeof resolved === 'number')
+        if (typeof resolved === "number")
             return resolved;
         return emitCommandHelp(stdout, stderr, parsed.command, schemaRequested, resolved.json);
     }
-    if (schemaRequested) {
-        writeLine(stderr, '--schema is only valid with --help');
+    if (schemaRequested && parsed.command !== "repo:node:create") {
+        writeLine(stderr, "--schema is only valid with --help");
         return 1;
     }
     if (!getCommandByName(parsed.command)) {
         writeLine(stderr, `unknown command: ${parsed.command}`);
         return 1;
     }
+    const commandName = parsed.command;
     const handler = MVP_COMMAND_HANDLERS[parsed.command];
     if (!handler) {
         writeLine(stderr, `unknown command: ${parsed.command}`);
         return 1;
     }
-    const commandName = parsed.command;
-    const configPath = dependencies.configPath ?? resolveConfigPath();
-    const loadConfig = dependencies.loadConfig ?? loadAuthConfig;
-    const configExists = dependencies.configExists ?? defaultConfigExists;
-    const saveConfig = dependencies.saveConfig ?? saveAuthConfig;
-    const profileLoader = dependencies.loadProfile ?? loadProfile;
-    const resolveEnvApiKey = dependencies.resolveEnvApiKey ??
-        ((envVar) => process.env[envVar]?.trim() || undefined);
+    const localRepositoryCommand = repositoryLocalOperationNames.includes(commandName) ||
+        repositoryProjectionNames.includes(commandName) ||
+        repositoryEditNames.includes(commandName);
+    const localRepositoryRemoteCommand = LOCAL_REPOSITORY_REMOTE_COMMANDS.includes(commandName);
+    const humanGraphCommand = localRepositoryCommand || hostedGraphMutationNames.includes(commandName);
     const writeOutputFile = dependencies.writeOutputFile ??
         (async (path, contents) => {
             await writeFile(path, contents);
         });
     let effectiveBaseUrl = DEFAULT_BASE_URL;
     let globals = {};
+    let repositorySelection;
+    let repositoryInitPersonal = false;
+    const nodeCreateSchemaRequested = parsed.command === "repo:node:create" && parsed.params.schema === true;
+    let missingCredentialRemediation;
     try {
         validateCommandSpecificFlags(commandName, parsed.params);
+        bindCommandPositionals(commandName, parsed.positionals, parsed.params);
         const extracted = extractGlobals(parsed.params);
-        globals = { ...extracted.globals, format: parsed.format, formatExplicit: parsed.formatExplicit };
+        globals = {
+            ...extracted.globals,
+            format: extracted.globals.format ?? parsed.format,
+            formatExplicit: parsed.formatExplicit || extracted.globals.formatExplicit,
+        };
         const { handlerParams, flagNames } = extracted;
-        // `--env=<name>` accepts both legacy TOML profiles AND built-in
-        // profile names (prod / staging). Built-ins synthesise a minimal
-        // Profile so the rest of the pipeline (baseUrl resolution,
-        // per-profile keychain lookups, etc.) treats them uniformly. The
-        // built-in baseUrl is the runtime source of truth (never written to
-        // config.json); the `--env=<builtin>` invocation effectively flips
-        // the active profile for this one call without mutating disk state.
+        if (nodeCreateSchemaRequested) {
+            if (Object.keys(handlerParams).some((name) => name !== "schema")) {
+                throw new CliUsageError("--schema cannot be combined with node authoring flags");
+            }
+            const rendered = renderOutput(NODE_CREATE_SCHEMA, globals.format ?? parsed.format);
+            if (globals.outPath && globals.outPath !== "-") {
+                await writeOutputFile(globals.outPath, rendered);
+            }
+            else {
+                stdout(rendered);
+            }
+            return 0;
+        }
+        const configPath = dependencies.configPath ??
+            (dependencies.resolveConfigPath ?? resolveFlywheelConfigPath)();
+        const loadConfig = dependencies.loadConfig ??
+            (dependencies.configPath
+                ? (filePath) => loadFlywheelConfig({
+                    env: { ...process.env, FLYWHEEL_CLI_CONFIG_PATH: filePath },
+                })
+                : async () => loadFlywheelConfig());
+        const configExists = dependencies.configExists ?? defaultConfigExists;
+        const saveConfig = dependencies.saveConfig ??
+            (async (filePath, config) => saveFlywheelConfig(config, filePath));
+        const resolveEnvApiKey = dependencies.resolveEnvApiKey ??
+            ((envVar) => process.env[envVar]?.trim() || undefined);
+        const config = await loadConfig(configPath);
+        const runtimeConfigExists = dependencies.loadConfig === undefined
+            ? await configExists(configPath)
+            : true;
+        // `--env=<name>` accepts a unified TOML profile or a built-in profile name
+        // (prod / staging). Built-ins synthesise a minimal Profile so the rest of
+        // the pipeline (base URL resolution and per-profile keychain lookups) treats
+        // them uniformly. The built-in base URL is the runtime source of truth
+        // (never written to config.toml); `--env=<builtin>` selects it for one call
+        // without mutating disk state.
         let profile = null;
         if (globals.env) {
             // Built-in names (`prod` / `staging`) are reserved and must always
@@ -775,18 +859,31 @@ export async function runCli(argv, dependencies = {}) {
                 }
             }
             else {
-                const fromToml = await profileLoader(globals.env);
+                const fromToml = config.profiles && Object.hasOwn(config.profiles, globals.env)
+                    ? { name: globals.env, ...config.profiles[globals.env] }
+                    : null;
                 if (fromToml) {
                     profile = fromToml;
                 }
+                if (!profile) {
+                    const available = BUILTIN_PROFILE_NAMES.join(", ");
+                    throw new CliUsageError(`unknown profile: ${globals.env}. Built-in profiles: ${available}`);
+                }
             }
-            if (!profile) {
-                const available = BUILTIN_PROFILE_NAMES.join(', ');
-                throw new CliUsageError(`unknown profile: ${globals.env}. Built-in profiles: ${available}`);
-            }
         }
+        if (!profile &&
+            config.activeProfile &&
+            !isBuiltinProfileName(config.activeProfile)) {
+            const active = config.profiles && Object.hasOwn(config.profiles, config.activeProfile)
+                ? config.profiles[config.activeProfile]
+                : undefined;
+            if (active)
+                profile = { name: config.activeProfile, ...active };
+        }
+        let credentialFile = dependencies.credentialFile;
+        const resolveCredentialFile = () => credentialFile ??= resolveCredentialFilePath();
         if (dependencies.loadConfig === undefined &&
-            !RUNTIME_CONFIG_OPTIONAL_COMMANDS.has(commandName)) {
+            !RUNTIME_CONFIG_OPTIONAL_COMMANDS.includes(commandName)) {
             // Env-only execution (CI/containers, scripted health checks) and
             // profile-based auth resolve runtime config without the file on
             // disk. Once `FLYWHEEL_BASE_URL` is set the CLI has enough to
@@ -799,58 +896,137 @@ export async function runCli(argv, dependencies = {}) {
             // needs auth and none is available.
             const envBaseUrl = process.env.FLYWHEEL_BASE_URL?.trim();
             const hasEnvBaseUrl = Boolean(envBaseUrl);
-            if (!profile && !hasEnvBaseUrl) {
-                const runtimeConfigExists = await configExists(configPath);
-                if (!runtimeConfigExists) {
-                    writeLine(stderr, buildMissingRuntimeConfigMessage(configPath));
-                    return EXIT_USAGE;
-                }
+            if (!profile && !hasEnvBaseUrl && !runtimeConfigExists) {
+                writeLine(stderr, buildMissingRuntimeConfigMessage(configPath));
+                return EXIT_USAGE;
             }
         }
-        const config = await loadConfig(configPath);
-        const runtimeConfig = await resolveRuntimeAuthConfig(config, profile, resolveEnvApiKey);
+        const authLocalConfigReadiness = dependencies.loadConfig === undefined
+            ? runtimeConfigExists
+                ? "ready"
+                : "missing"
+            : "ready";
+        const authRemoteProbeAllowed = authLocalConfigReadiness === "ready" ||
+            profile !== null ||
+            Boolean(process.env.FLYWHEEL_BASE_URL?.trim());
+        const runtimeConfig = await resolveRuntimeAuthConfig(config, profile, resolveEnvApiKey, resolveCredentialFile, !CREDENTIAL_LOOKUP_SKIPPED_COMMANDS.includes(commandName), dependencies.readCredential ?? readCredential, localRepositoryRemoteCommand);
+        const selectedProfileName = profile?.name ??
+            (typeof config.activeProfile === "string" && config.activeProfile.trim()
+                ? config.activeProfile.trim()
+                : "default");
+        missingCredentialRemediation = runtimeConfig.apiKey
+            ? undefined
+            : selectedProfileName === "default"
+                ? "flywheel auth:login"
+                : `flywheel auth:login --env ${selectedProfileName}`;
         effectiveBaseUrl = runtimeConfig.baseUrl;
-        const commandDefaultFormat = commandName === 'api-keys:list' ? 'table' : parsed.format;
-        const effectiveFormat = parsed.formatExplicit
-            ? parsed.format
-            : commandName === 'api-keys:list'
+        const selectedFormat = globals.format ?? parsed.format;
+        const commandDefaultFormat = commandName === "api-keys:list" ||
+            localRepositoryCommand ||
+            commandDefinition?.group === "hosted-graph"
+            ? "table"
+            : selectedFormat;
+        const effectiveFormat = globals.formatExplicit
+            ? selectedFormat
+            : commandName === "api-keys:list"
                 ? commandDefaultFormat
                 : (runtimeConfig.defaultFormat ?? commandDefaultFormat);
-        const profileTimeoutS = typeof profile?.defaultTimeoutS === 'number' ? profile.defaultTimeoutS : undefined;
-        const effectiveTimeoutMs = typeof globals.timeoutS === 'number'
+        const profileTimeoutS = typeof profile?.defaultTimeoutS === "number"
+            ? profile.defaultTimeoutS
+            : undefined;
+        const effectiveTimeoutMs = typeof globals.timeoutS === "number"
             ? globals.timeoutS * 1000
-            : typeof profileTimeoutS === 'number'
+            : typeof profileTimeoutS === "number"
                 ? profileTimeoutS * 1000
                 : undefined;
-        const buildClient = dependencies.createHttpClient ?? createHttpClient;
-        const client = buildClient({
-            baseUrl: runtimeConfig.baseUrl,
-            apiKey: runtimeConfig.apiKey,
-            cliVersion: CLI_VERSION,
-            commandName,
-            flagNames,
-            invocationId: randomUUID(),
-            retryMax: globals.retryMax,
-            retryEnabled: globals.retryEnabled,
-            waitRequested: globals.wait === true,
-            waitTimeoutS: globals.waitTimeoutS,
-            debug: globals.debug,
-            timeoutMs: effectiveTimeoutMs,
-            idempotencyKey: globals.idempotencyKey,
-        });
+        const invocationId = randomUUID();
+        repositoryInitPersonal =
+            commandName === "repo:init" && handlerParams.personal === true;
+        repositorySelection = undefined;
+        if (localRepositoryCommand &&
+            !["repo:init", "repo:clone", "repo:restore"].includes(commandName)) {
+            repositorySelection = await resolveRepositorySelection({
+                params: handlerParams,
+                loadConfig: async () => config,
+            });
+        }
+        if (localRepositoryCommand) {
+            delete handlerParams.repo;
+            delete handlerParams.personal;
+        }
+        const client = !localRepositoryCommand || localRepositoryRemoteCommand
+            ? (dependencies.createHttpClient ?? createHttpClient)({
+                baseUrl: runtimeConfig.baseUrl,
+                apiKey: runtimeConfig.apiKey,
+                cliVersion: CLI_VERSION,
+                commandName,
+                flagNames,
+                invocationId,
+                retryMax: globals.retryMax,
+                retryEnabled: globals.retryEnabled,
+                waitRequested: globals.wait === true,
+                waitTimeoutS: globals.waitTimeoutS,
+                debug: globals.debug,
+                timeoutMs: effectiveTimeoutMs,
+                idempotencyKey: globals.idempotencyKey,
+            })
+            : undefined;
+        if (credentialFile === undefined &&
+            (commandName === "auth:login" ||
+                commandName === "auth:credentials:set" ||
+                commandName === "auth:credentials:clear")) {
+            resolveCredentialFile();
+        }
+        const connection = localRepositoryRemoteCommand && client
+            ? {
+                client,
+                baseUrl: runtimeConfig.baseUrl,
+                profile: profile?.name ??
+                    (typeof config.activeProfile === "string" && config.activeProfile.trim()
+                        ? config.activeProfile.trim()
+                        : "default"),
+            }
+            : undefined;
+        const localAdapter = localRepositoryCommand
+            ? new LocalRepositoryAdapter({ connection })
+            : undefined;
         const payload = await handler({
             params: handlerParams,
-            requestJson: client.requestJson,
-            requestRaw: client.requestRaw,
-            requestRawExternal: client.requestRawExternal,
+            requestJson: client?.requestJson ??
+                (async () => {
+                    throw new Error("hosted HTTP transport is unavailable for local repository commands");
+                }),
+            requestRaw: client?.requestRaw,
             saveConfig,
+            config,
             configPath,
+            authProfile: selectedProfileName,
+            authCredentialBaseUrl: runtimeConfig.credentialBaseUrl,
+            authProfileBaseUrl: profile?.baseUrl,
+            authDefaultBaseUrl: process.env.FLYWHEEL_BASE_URL?.trim() || DEFAULT_BASE_URL,
+            authApiKeyEnv: profile?.apiKeyEnv,
+            authLocalConfigReadiness,
+            authRemoteProbeAllowed,
+            authCredentialReadiness: runtimeConfig.credentialReadiness,
+            authCredentialFile: credentialFile,
             baseUrl: runtimeConfig.baseUrl,
             apiKey: runtimeConfig.apiKey,
             globals,
-            stderr,
-            stdout,
+            stderr: credentialMode && !dependencies.stderr
+                ? (chunk) => writeCredentialStream(process.stderr, chunk)
+                : stderr,
+            stdout: credentialMode && !dependencies.stdout
+                ? (chunk) => writeCredentialStream(process.stdout, chunk)
+                : stdout,
+            credentialOutput,
             writeOutputFile,
+            requestLocalJson: localAdapter?.requestJson,
+            repositoryBootstrap: localAdapter?.bootstrap.bind(localAdapter),
+            localRepositoryId: localAdapter?.repositoryId.bind(localAdapter),
+            installLocalObject: localAdapter?.installObject.bind(localAdapter),
+            stageLocalOperations: localAdapter?.stageOperations.bind(localAdapter),
+            repositoryInitPersonal,
+            repositorySelection,
         });
         if (payload === undefined || payload === null) {
             return 0;
@@ -860,7 +1036,7 @@ export async function runCli(argv, dependencies = {}) {
                 writeLine(stderr, `${commandName} returns binary output; pass --out=<path> or --out=- to write to stdout`);
                 return EXIT_USAGE;
             }
-            if (globals.outPath === '-') {
+            if (globals.outPath === "-") {
                 // Route binary bytes through the injected stdout writer so
                 // programmatic runCli callers can capture them, matching the
                 // text-output path.
@@ -871,9 +1047,16 @@ export async function runCli(argv, dependencies = {}) {
             }
             return 0;
         }
-        const rendered = renderOutput(payload, effectiveFormat);
+        const outputOptions = localRepositoryCommand
+            ? { repositoryJson: true }
+            : undefined;
+        const rendered = humanGraphCommand &&
+            !globals.formatExplicit &&
+            effectiveFormat === "table"
+            ? (renderRepositoryHumanOutput(commandName, payload, repositorySelection, repositoryInitPersonal) ?? renderOutput(payload, effectiveFormat, outputOptions))
+            : renderOutput(payload, effectiveFormat, outputOptions);
         if (globals.outPath) {
-            if (globals.outPath === '-') {
+            if (globals.outPath === "-") {
                 stdout(rendered);
             }
             else {
@@ -886,6 +1069,18 @@ export async function runCli(argv, dependencies = {}) {
         return 0;
     }
     catch (error) {
+        if (credentialMode && error instanceof CliHttpError) {
+            try {
+                const message = `${error.message}\n`;
+                await (dependencies.stderr
+                    ? stderr(message)
+                    : writeCredentialStream(process.stderr, message));
+            }
+            catch {
+                // A failed receipt/error sink must never cause credential emission.
+            }
+            return error.exitCode;
+        }
         if (error instanceof CliAuthRequirementError) {
             const envelope = {
                 error: {
@@ -905,8 +1100,39 @@ export async function runCli(argv, dependencies = {}) {
             writeLine(stderr, JSON.stringify(envelope));
             return error.exitCode;
         }
+        if (error instanceof RepositorySelectionError) {
+            writeLine(stderr, `${error.code}: ${error.message}`);
+            return EXIT_USAGE;
+        }
+        if (error instanceof FlywheelConfigError) {
+            if ((globals.format ?? parsed.format) !== "json") {
+                writeLine(stderr, error.message);
+                return EXIT_USAGE;
+            }
+            const details = {
+                code: error.code,
+                message: error.message,
+                exit_code: EXIT_USAGE,
+            };
+            if (error.configPath)
+                details.config_path = error.configPath;
+            if (error.field)
+                details.field = error.field;
+            if (error.sourcePaths)
+                details.source_paths = error.sourcePaths;
+            if (error.platform)
+                details.platform = error.platform;
+            if (error.environmentVariable)
+                details.environment_variable = error.environmentVariable;
+            if (error.override)
+                details.override = error.override;
+            if (error.schemaVersion !== undefined)
+                details.schema_version = error.schemaVersion;
+            writeLine(stderr, JSON.stringify({ error: details }));
+            return EXIT_USAGE;
+        }
         if (error instanceof CliUsageError) {
-            const augmented = error.message.startsWith('missing required parameter')
+            const augmented = error.message.startsWith("missing required parameter")
                 ? buildMissingParamHint(commandName, error.message)
                 : error.message;
             writeLine(stderr, augmented);
@@ -915,7 +1141,7 @@ export async function runCli(argv, dependencies = {}) {
         if (error instanceof CliApprovalPendingError) {
             const envelope = {
                 error: {
-                    code: 'approval_required',
+                    code: "approval_required",
                     message: error.message,
                     exit_code: error.exitCode,
                 },
@@ -942,33 +1168,20 @@ export async function runCli(argv, dependencies = {}) {
             writeLine(stderr, JSON.stringify(envelope));
             return error.exitCode;
         }
-        if (error instanceof CliFinalizeFailedError) {
-            const code = error.request?.failureKind === 'timeout' ? 'timeout' : 'finalize_failed';
-            const envelope = {
+        if (error instanceof CredentialStoreError) {
+            writeLine(stderr, JSON.stringify({
                 error: {
-                    code,
+                    code: error.code,
                     message: error.message,
-                    exit_code: error.exitCode,
-                    orphan_blob_ids: error.orphanBlobIds,
+                    exit_code: 1,
                 },
-            };
-            const inner = envelope.error;
-            if (typeof error.status === 'number') {
-                inner.server_response = {
-                    status: error.status,
-                    body: responseBodyForCliError(commandName, error.body),
-                };
-            }
-            if (error.request) {
-                inner.request = requestForCliHttpEnvelope(error.request);
-            }
-            writeLine(stderr, JSON.stringify(envelope));
-            return error.exitCode;
+            }));
+            return 1;
         }
         if (error instanceof CliWaitTimeoutError) {
             const envelope = {
                 error: {
-                    code: 'wait_timeout',
+                    code: "wait_timeout",
                     message: error.message,
                     exit_code: error.exitCode,
                     last_state: error.lastState,
@@ -979,10 +1192,6 @@ export async function runCli(argv, dependencies = {}) {
         }
         if (error instanceof CliHttpError) {
             let message = error.message;
-            if (error.status === 422 &&
-                (commandName === 'nodes:commit-new' || commandName === 'nodes:commit')) {
-                message = buildCommitSchemaHint(commandName, message);
-            }
             message = buildLocalhostTransportHint(message, effectiveBaseUrl);
             message = buildNodeSlugMissHint({
                 commandName,
@@ -990,15 +1199,65 @@ export async function runCli(argv, dependencies = {}) {
                 params: parsed.params,
                 message,
             });
-            const code = error.request?.failureKind === 'timeout'
-                ? 'timeout'
-                : error.status === 403 && isPolicyBlockedResponseBody(error.body)
-                    ? 'policy_blocked'
-                    : error.status === 401 || error.status === 403
-                        ? 'auth_error'
-                        : error.status === undefined
-                            ? 'transport_error'
-                            : 'http_error';
+            if (error.status === 401 && missingCredentialRemediation) {
+                message = `${message} Run ${missingCredentialRemediation}.`;
+            }
+            const localRuntimeError = localRuntimeErrorType(error.body);
+            const invalidRepositorySelection = localRuntimeError === "repository_runtime_state_invalid"
+                ? repositorySelection
+                : undefined;
+            const personalRepositoryInvalid = invalidRepositorySelection?.source === "personal";
+            const personalRepositoryAdoptionInvalid = localRuntimeError === "repository_adoption_invalid" &&
+                repositoryInitPersonal;
+            let repositoryRoot;
+            let repositorySource;
+            if (invalidRepositorySelection) {
+                repositoryRoot = invalidRepositorySelection.root;
+                repositorySource = invalidRepositorySelection.source;
+                if (personalRepositoryInvalid) {
+                    message =
+                        `The configured personal repository is invalid: ${repositoryRoot}. ` +
+                            `Run flywheel repo:init --personal ${shellQuote(repositoryRoot)} to repair it.`;
+                }
+                else {
+                    message =
+                        `The Flywheel repository selected from ${repositorySource} is invalid: ` +
+                            `${repositoryRoot}.`;
+                }
+            }
+            else if (personalRepositoryAdoptionInvalid) {
+                const input = typeof parsed.params.directory === "string"
+                    ? parsed.params.directory
+                    : resolve(os.homedir(), "Flywheel");
+                repositoryRoot =
+                    input === "~"
+                        ? os.homedir()
+                        : input.startsWith("~/")
+                            ? resolve(os.homedir(), input.slice(2))
+                            : resolve(input);
+                repositorySource = "personal";
+                message =
+                    `Unable to adopt the personal Flywheel repository at ${repositoryRoot}. ` +
+                        `Fix the repository, then retry: flywheel repo:init --personal ${shellQuote(repositoryRoot)}.`;
+            }
+            const code = personalRepositoryInvalid
+                ? "personal_repository_invalid"
+                : invalidRepositorySelection !== undefined ||
+                    personalRepositoryAdoptionInvalid
+                    ? localRuntimeError
+                    : localRuntimeError === "repository_locked"
+                        ? localRuntimeError
+                        : error.request?.failureKind === "timeout"
+                            ? "timeout"
+                            : error.request?.failureKind === "response_body"
+                                ? "response_error"
+                                : error.status === 403 && isPolicyBlockedResponseBody(error.body)
+                                    ? "policy_blocked"
+                                    : error.status === 401 || error.status === 403
+                                        ? "auth_error"
+                                        : error.status === undefined
+                                            ? "transport_error"
+                                            : "http_error";
             const envelope = {
                 error: {
                     code,
@@ -1007,7 +1266,11 @@ export async function runCli(argv, dependencies = {}) {
                 },
             };
             const inner = envelope.error;
-            if (typeof error.status === 'number') {
+            if (repositoryRoot)
+                inner.repository_root = repositoryRoot;
+            if (repositorySource)
+                inner.repository_source = repositorySource;
+            if (typeof error.status === "number") {
                 inner.server_response = {
                     status: error.status,
                     body: responseBodyForCliError(commandName, error.body),
@@ -1023,13 +1286,25 @@ export async function runCli(argv, dependencies = {}) {
             writeLine(stderr, error.message);
             return EXIT_TRANSPORT;
         }
-        writeLine(stderr, 'runtime error');
+        writeLine(stderr, "runtime error");
         return EXIT_TRANSPORT;
     }
     finally {
         void globals;
     }
 }
+function localRuntimeErrorType(body) {
+    if (typeof body !== "object" ||
+        body === null ||
+        !("detail" in body) ||
+        typeof body.detail !== "object" ||
+        body.detail === null ||
+        !("type" in body.detail) ||
+        typeof body.detail.type !== "string") {
+        return undefined;
+    }
+    return body.detail.type;
+}
 async function main() {
     const exitCode = await runCli(process.argv.slice(2), {});
     process.exitCode = exitCode;