@profullstack/agenticjobs 0.10.0 → 0.12.0

package/README.md

@@ -63,7 +63,9 @@ curl https://agenticjobs.work/.well-known/agenticjobs
 curl "https://agenticjobs.work/api/v1/jobs?q=rust&workplace=remote&agentPolicy=welcome"
 
 # the application form, as data
-curl https://agenticjobs.work/api/v1/jobs/SLUG/apply-schema
+# First fetch after idle can exceed 15s; retry once rather than skipping.
+curl --retry 1 --retry-all-errors --max-time 30 \
+  https://agenticjobs.work/api/v1/jobs/SLUG/apply-schema
 
 # send it
 curl -X POST https://agenticjobs.work/api/v1/jobs/SLUG/apply \
@@ -269,6 +271,72 @@ author, and the same text twice is refused. 600 characters and one link, rendere
 text and marked `nofollow`, because a board with an open posting form is a link farm
 the moment it passes PageRank on.
 
+## Inbox, and invoices
+
+There is no public comment box anywhere on the board. A board with one gets used as
+the place to hand in invoices, because an invoice has to go somewhere and a comment
+under a listing was the only somewhere. So reaching somebody here is private: a
+conversation between you and a candidate, or you and an employer, and nobody else.
+Writing to an employer reaches every member of it.
+
+```bash
+agenticjobs message acme "Is the Go role open to contractors?" --job senior-go-engineer
+agenticjobs message jane-doe --candidate "Saw your resume. Free for a call this week?"
+agenticjobs inbox                          # your conversations
+agenticjobs inbox read <id>                # one, with its invoices
+agenticjobs reply <id> "Thursday works."
+```
+
+The button is on every candidate's and every employer's page, and on a listing. Twenty
+new conversations a day per account; replies are not counted. The other side is
+emailed that there is a message, never the message itself: the conversation is private
+to the people in it and somebody else's mail server is not.
+
+An invoice is a message with money attached. The payee sends it from the conversation,
+in US dollars, choosing a chain they hold a wallet for; the other side presses Pay and
+settles it on [CoinPay](https://coinpayportal.com), straight to that wallet. The board
+never holds the money.
+
+```bash
+agenticjobs billing                        # is a CoinPay account connected?
+agenticjobs invoice <thread-id> 1200 --currency USDC_POL --for "Sprint 3, as agreed"
+agenticjobs invoices                       # sent and received
+agenticjobs pay <invoice-id>               # a quote, and the page to pay on
+```
+
+Connecting a CoinPay account is a browser step (`/me`, Billing, Connect CoinPay): it is
+CoinPay's consent screen, asking for `wallet:read` and nothing else. The board reads
+which wallets you can be paid to and uses the token for nothing else; it cannot move
+funds or create anything on your account.
+
+### Turning billing on
+
+Billing is off until the operator gives the board its own CoinPay credentials. Two
+sets, because two jobs: an OAuth client so *people* can connect their accounts, and a
+business key so the *board* can mint the payment a payer settles. All four or none;
+a partial set is logged at boot and leaves billing off rather than half on.
+
+```bash
+COINPAY_CLIENT_ID=cp_...          # coinpay oauth create --name your-board \
+COINPAY_CLIENT_SECRET=cps_...     #   --redirect-uri https://your-board/api/v1/coinpay/callback \
+                                  #   --scope openid,profile,email,wallet:read
+COINPAY_API_KEY=cp_live_...       # coinpay business create --name your-board \
+COINPAY_BUSINESS_ID=...           #   --category marketplace \
+COINPAY_WEBHOOK_SECRET=whsec_...  #   --webhook-url https://your-board/api/v1/coinpay/webhook
+COINPAY_URL=https://coinpayportal.com   # optional
+```
+
+The redirect URI has to be registered on the OAuth client byte for byte, and the
+client has to be registered for `wallet:read`: CoinPay narrows a grant to the client's
+registered scopes without an error, and a board that trusts its own request shows
+"Connected" beside an account it cannot read a wallet from. The board checks the scope
+on the token it got back, and says "Reconnect required" when it is missing.
+
+Payment is confirmed by CoinPay's webhook, and by asking CoinPay whenever the
+conversation is opened, so a lost webhook delays the answer rather than losing it.
+Without `COINPAY_WEBHOOK_SECRET` every webhook is refused and polling is the only
+source, which works and is slower.
+
 ## Posting from myna
 
 A job opening goes out with the rest of a launch:

package/dist/cli/args.js

@@ -5,6 +5,32 @@
  * Repeated flags collect into an array, because `--answer a=1 --answer b=2` is
  * how the apply command takes fields.
  */
+// Boolean options must not consume the next command or search word. Keep
+// explicit boolean values working for callers that pass `--remote false`.
+const BOOLEAN_FLAGS = new Set([
+    'version',
+    'v',
+    'help',
+    'h',
+    'yes',
+    'y',
+    'json',
+    'remote',
+    'agents',
+    'all',
+    'network',
+    'unsupervised',
+    'draft',
+    'salary-unpaid',
+    'publish',
+    'following',
+    'candidate',
+]);
+function takesValue(name, next) {
+    return (next !== undefined &&
+        !next.startsWith('-') &&
+        (!BOOLEAN_FLAGS.has(name) || /^(true|false|1|0|yes|no)$/i.test(next)));
+}
 export function parseArgs(argv) {
     const positional = [];
     const flags = {};
@@ -27,7 +53,7 @@ export function parseArgs(argv) {
                 continue;
             }
             const next = argv[index + 1];
-            if (next !== undefined && !next.startsWith('-')) {
+            if (takesValue(body, next)) {
                 set(flags, body, next);
                 index += 1;
                 continue;
@@ -38,7 +64,7 @@ export function parseArgs(argv) {
         if (token.startsWith('-') && token.length > 1) {
             const body = token.slice(1);
             const next = argv[index + 1];
-            if (next !== undefined && !next.startsWith('-')) {
+            if (takesValue(body, next)) {
                 set(flags, body, next);
                 index += 1;
                 continue;
@@ -74,7 +100,9 @@ export function flagString(args, ...names) {
 }
 export function flagBool(args, ...names) {
     for (const name of names) {
-        const value = args.flags[name];
+        const raw = args.flags[name];
+        // Repeated options use their last value, just like flagString.
+        const value = Array.isArray(raw) ? raw[raw.length - 1] : raw;
         if (value === true)
             return true;
         if (typeof value === 'string')

package/dist/cli/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAgD,EAAE,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,GAAG,CACV,KAAkD,EAClD,GAAW,EACX,KAAuB;IAEvB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,OAAO;IACT,CAAC;IACD,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,GAAG,KAAe;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,GAAG,KAAe;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,GAAG,KAAe;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,GAAG,KAAe;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS;IACT,GAAG;IACH,MAAM;IACN,GAAG;IACH,KAAK;IACL,GAAG;IACH,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,SAAS;IACT,cAAc;IACd,OAAO;IACP,eAAe;IACf,SAAS;IACT,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,IAAY,EAAE,IAAwB;IACxD,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAgD,EAAE,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,GAAG,CACV,KAAkD,EAClD,GAAW,EACX,KAAuB;IAEvB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,OAAO;IACT,CAAC;IACD,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,GAAG,KAAe;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,GAAG,KAAe;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,+DAA+D;QAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,GAAG,KAAe;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,GAAG,KAAe;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC"}

package/dist/cli/index.js

@@ -20,6 +20,10 @@ import { ApiError, BoardClient, configuredBoards, currentBoard, DEFAULT_SERVER,
 import { VERSION } from "../config.js";
 import { ago, formatSalary } from "../schema/text.js";
 import { APPLICATION_DECISIONS, isApplicationDecision } from "../schema/job.js";
+// The vocabulary, not the storage: core/resumes.ts is pure apart from a type
+// import of pg, so the CLI can name the same three values the server does
+// rather than keeping a second copy of them in step by hand.
+import { VISIBILITIES } from "../core/resumes.js";
 const USAGE = `agenticjobs ${VERSION} - an agent-friendly job board you can self-host
 
   Account
@@ -51,8 +55,12 @@ const USAGE = `agenticjobs ${VERSION} - an agent-friendly job board you can self
   Resumes
     resume list
     resume show <slug>
-    resume save <file> [--slug s] [--title t]
+    resume save <file> [--slug s] [--title t] [--visibility v]
     resume import <file>      pdf, docx, txt or md, converted to Markdown
+    resume publish <slug>     list it at /candidates
+    resume unpublish <slug>   make it private again
+    resume visibility <slug> <private|link|public>
+    resume delete <slug> --yes
 
   Updates
     news                      the updates on this board
@@ -63,7 +71,26 @@ const USAGE = `agenticjobs ${VERSION} - an agent-friendly job board you can self
     follow <slug>             follow an employer; --candidate for a person
     unfollow <slug>           stop
 
+  Inbox
+    inbox                     your conversations
+    inbox read <id>           one conversation, and its invoices
+    message <slug> <text>     write to an employer; --candidate for a person
+      --job <slug>              about a listing
+      --as <employer-slug>      write as an employer you belong to
+      --subject <text>
+    reply <id> <text>         reply in a conversation
+    invoice <id> <amount>     bill the other side, in USD; --currency <chain>
+      --for <text>              what it is for
+    invoices                  every invoice you sent or can pay
+    pay <invoice-id>          get a quote and the CoinPay page to pay on
+    billing                   whether your CoinPay account is connected
+
   Hiring
+    employer list             the employers you can post under
+    employer show <slug>
+    employer create <name>    [--website u] [--description d] [--logo u]
+    employer update <slug>    [--name n] [--website u] [--description d]
+    employer delete <slug> --yes
     post <file.md>            post a job; stays a draft until you publish
     new <url>                 import a job from a URL, as a draft
     update <url>              re-read that URL into the listing it created
@@ -152,6 +179,50 @@ async function run(args) {
             await closePool();
             return 0;
         }
+        /**
+         * Ask listed candidates to state their agent capacity.
+         *
+         * Prints the recipients and stops. `--send` is what actually mails them,
+         * and it is a separate word on purpose: this is the only command in the
+         * CLI that writes to other people, and the operator should have to say so
+         * after reading the list.
+         */
+        case 'ask-capacity': {
+            const { closePool, getPool } = await import("../db/pool.js");
+            const { loadConfig: serverConfig } = await import("../config.js");
+            const { createMailer } = await import("../core/mail.js");
+            const { runCapacityAlerts } = await import("../core/capacity-alert.js");
+            const config = serverConfig();
+            const send = flagBool(args, 'send');
+            const mailer = send ? createMailer(config) : null;
+            if (send && mailer === null) {
+                process.stderr.write('No RESEND_API_KEY, so nothing can be sent.\n');
+                await closePool();
+                return 1;
+            }
+            const results = await runCapacityAlerts({
+                pool: getPool(config.databaseUrl),
+                mailer,
+                boardName: config.boardName,
+                publicUrl: config.publicUrl,
+                send,
+            });
+            if (results.length === 0) {
+                process.stdout.write('Every listed candidate states their capacity.\n');
+                await closePool();
+                return 0;
+            }
+            for (const result of results) {
+                const status = result.sent === null ? 'would ask' : result.sent ? 'asked' : 'FAILED';
+                process.stdout.write(`${status}: ${result.target.name} <${result.target.email}>\n`);
+            }
+            const failed = results.filter((result) => result.sent === false).length;
+            process.stdout.write(send
+                ? `\n${results.length - failed} sent, ${failed} failed.\n`
+                : `\n${results.length} candidate(s) would be asked. Re-run with --send to mail them.\n`);
+            await closePool();
+            return failed === 0 ? 0 : 1;
+        }
         case 'tui': {
             const { startTui } = await import("../tui/index.js");
             await startTui(clientFor(args));
@@ -200,6 +271,9 @@ async function run(args) {
             return commandSubmit(args);
         case 'resume':
             return commandResume(args);
+        case 'employer':
+        case 'employers':
+            return commandEmployer(args);
         case 'post':
             return commandPost(args);
         case 'new':
@@ -218,6 +292,20 @@ async function run(args) {
         case 'follow':
         case 'unfollow':
             return commandFollow(args);
+        case 'inbox':
+            return commandInbox(args);
+        case 'message':
+            return commandMessage(args);
+        case 'reply':
+            return commandReply(args);
+        case 'invoice':
+            return commandInvoice(args);
+        case 'invoices':
+            return commandInvoices(args);
+        case 'pay':
+            return commandPay(args);
+        case 'billing':
+            return commandBilling(args);
         case 'announce':
             return commandAnnounce(args);
         case 'instances':
@@ -612,11 +700,17 @@ async function commandResume(args) {
         }
         const slug = flagString(args, 'slug');
         const title = flagString(args, 'title');
+        const visibility = visibilityFrom(args);
+        if (visibility instanceof Error) {
+            process.stderr.write(`${visibility.message}\n`);
+            return 1;
+        }
         const saved = await client.saveResume(await readFile(path, 'utf8'), {
             ...(slug === undefined ? {} : { slug }),
             ...(title === undefined ? {} : { title }),
+            ...(visibility === undefined ? {} : { visibility }),
         });
-        return out(args, 'Saved.', saved);
+        return out(args, savedMessage(client.server, saved), saved);
     }
     if (action === 'import') {
         const path = args.positional[1];
@@ -627,17 +721,195 @@ async function commandResume(args) {
         const { importDocument } = await import("../core/import.js");
         const imported = await importDocument(path, await readFile(path));
         const title = flagString(args, 'title');
+        const visibility = visibilityFrom(args);
+        if (visibility instanceof Error) {
+            process.stderr.write(`${visibility.message}\n`);
+            return 1;
+        }
         // Converted on this machine, so the original file never leaves it.
         const saved = await client.saveResume(imported.markdown, {
             ...(title === undefined ? {} : { title }),
+            ...(visibility === undefined ? {} : { visibility }),
         });
         for (const warning of imported.warnings)
             process.stderr.write(`note: ${warning}\n`);
-        return out(args, `Converted from ${imported.via} and saved.`, saved);
+        return out(args, `Converted from ${imported.via}. ${savedMessage(client.server, saved)}`, saved);
+    }
+    /**
+     * Publishing is its own word because it is its own decision.
+     *
+     * Saving a resume and letting the board list it are different acts, and the
+     * flag on `save` is there for the person who means both at once. This is
+     * for the far more common case of changing your mind about a document that
+     * is already written.
+     */
+    if (action === 'publish' || action === 'unpublish' || action === 'visibility') {
+        const slug = args.positional[1];
+        if (slug === undefined) {
+            process.stderr.write(`Which one? agenticjobs resume ${action} <slug>\n`);
+            return 1;
+        }
+        let wanted;
+        if (action === 'publish')
+            wanted = 'public';
+        else if (action === 'unpublish')
+            wanted = 'private';
+        else {
+            const given = args.positional[2];
+            if (given === undefined || !VISIBILITIES.includes(given)) {
+                process.stderr.write(`Which visibility? agenticjobs resume visibility <slug> <${VISIBILITIES.join('|')}>\n`);
+                return 1;
+            }
+            wanted = given;
+        }
+        const result = await client.setResumeVisibility(slug, wanted);
+        return out(args, savedMessage(client.server, result), result);
+    }
+    if (action === 'delete') {
+        const slug = args.positional[1];
+        if (slug === undefined) {
+            process.stderr.write('Which one? agenticjobs resume delete <slug>\n');
+            return 1;
+        }
+        if (!flagBool(args, 'yes', 'y')) {
+            process.stderr.write(`This deletes ${slug} and cannot be undone. Add --yes if you mean it.\n`);
+            return 1;
+        }
+        const removed = await client.deleteResume(slug);
+        return out(args, `Deleted ${slug}.`, removed);
     }
     process.stderr.write(`No resume command called "${action}".\n`);
     return 1;
 }
+// --- employers ------------------------------------------------------------
+/**
+ * The employer you post under, from the terminal.
+ *
+ * Posting a job needed an employer and there was no way to make one without a
+ * browser, so the documented path for a board whose whole pitch is that an
+ * agent can use it was "open the website first". This is the missing half.
+ */
+async function commandEmployer(args) {
+    const action = args.positional[0] ?? 'list';
+    const client = clientFor(args);
+    if (action === 'list') {
+        const orgs = await client.myOrgs();
+        if (orgs.length === 0) {
+            return out(args, `No employers yet. ${dim('agenticjobs employer create "Example Works"')}`, { items: orgs });
+        }
+        return out(args, orgs.map(employerLine).join('\n'), { items: orgs });
+    }
+    if (action === 'show') {
+        const slug = args.positional[1];
+        if (slug === undefined) {
+            process.stderr.write('Which one? agenticjobs employer show <slug>\n');
+            return 1;
+        }
+        const result = await client.request('GET', `/api/v1/orgs/${encodeURIComponent(slug)}`);
+        return out(args, [
+            employerLine(result.org),
+            result.org.description === null ? '' : `  ${result.org.description}`,
+            `  ${dim(`${result.jobs.total} published`)}`,
+        ]
+            .filter((line) => line !== '')
+            .join('\n'), result);
+    }
+    if (action === 'create') {
+        const name = args.positional.slice(1).join(' ').trim() || (flagString(args, 'name') ?? '');
+        if (name === '') {
+            process.stderr.write('What is it called? agenticjobs employer create "Example Works"\n');
+            return 1;
+        }
+        const created = await client.createOrg({ name, ...employerFields(args) });
+        return out(args, `Created ${created.org.slug}.\n${dim(`  post to it: agenticjobs post job.md --org ${created.org.slug}`)}`, created);
+    }
+    if (action === 'update') {
+        const slug = args.positional[1];
+        if (slug === undefined) {
+            process.stderr.write('Which one? agenticjobs employer update <slug> --name "New Name"\n');
+            return 1;
+        }
+        const name = flagString(args, 'name');
+        const fields = { ...(name === undefined ? {} : { name }), ...employerFields(args) };
+        if (Object.keys(fields).length === 0) {
+            process.stderr.write('Nothing to change. Pass --name, --website, --description or --logo.\n');
+            return 1;
+        }
+        const updated = await client.updateOrg(slug, fields);
+        // The slug is deliberately not derived again from a new name, so say so:
+        // somebody who renames an employer will otherwise go looking for a URL
+        // that never changed.
+        return out(args, `Updated ${updated.org.name}. ${dim(`Still ${updated.org.slug}, so every link to it still works.`)}`, updated);
+    }
+    if (action === 'delete') {
+        const slug = args.positional[1];
+        if (slug === undefined) {
+            process.stderr.write('Which one? agenticjobs employer delete <slug> --yes\n');
+            return 1;
+        }
+        if (!flagBool(args, 'yes', 'y')) {
+            process.stderr.write(`This deletes ${slug} and cannot be undone. Add --yes if you mean it.\n`);
+            return 1;
+        }
+        const removed = await client.deleteOrg(slug);
+        return out(args, `Deleted ${slug}.`, removed);
+    }
+    process.stderr.write(`No employer command called "${action}".\n`);
+    return 1;
+}
+/**
+ * The optional details, only when they were given.
+ *
+ * An absent flag has to stay absent all the way to the request: the API
+ * leaves out what it is not sent, and sending `undefined` as `null` here
+ * would turn "I did not mention the website" into "clear the website".
+ */
+function employerFields(args) {
+    const website = flagString(args, 'website');
+    const description = flagString(args, 'description');
+    const logo = flagString(args, 'logo', 'logo-url');
+    return {
+        ...(website === undefined ? {} : { website }),
+        ...(description === undefined ? {} : { description }),
+        ...(logo === undefined ? {} : { logoUrl: logo }),
+    };
+}
+function employerLine(org) {
+    const bits = [org.slug, org.website].filter((bit) => typeof bit === 'string' && bit !== '');
+    return `${org.name}  ${dim(bits.join('  '))}`;
+}
+/** `--visibility public`, checked here so a typo is not silently ignored. */
+function visibilityFrom(args) {
+    const given = flagString(args, 'visibility');
+    if (given === undefined)
+        return undefined;
+    if (!VISIBILITIES.includes(given)) {
+        return new Error(`Not a visibility: ${given}. Use ${VISIBILITIES.join(', ')}.`);
+    }
+    return given;
+}
+/**
+ * What happened, said in terms of who can now see it.
+ *
+ * "Saved." was true and useless: the whole question a candidate has after
+ * saving is whether anybody can read it yet, and the address is the answer.
+ */
+function savedMessage(server, result) {
+    const resume = result
+        ?.resume;
+    const visibility = resume?.visibility;
+    const publicSlug = resume?.publicSlug ?? null;
+    if (visibility === 'public' && publicSlug !== null) {
+        return `Saved and listed: ${server}/candidates/${publicSlug}`;
+    }
+    if (visibility === 'link' && publicSlug !== null) {
+        return `Saved. Anyone with the link: ${server}/candidates/${publicSlug}`;
+    }
+    if (visibility === 'private') {
+        return `Saved, and private. ${dim('agenticjobs resume publish <slug> lists it.')}`;
+    }
+    return 'Saved.';
+}
 // --- hiring ---------------------------------------------------------------
 /**
  * `new <url>` and `update <url>` are the same call.
@@ -857,6 +1129,127 @@ async function commandFollow(args) {
     const result = await clientFor(args).setFollow(candidate ? { candidate: slug } : { org: slug }, following);
     return out(args, `${following ? 'Following' : 'Not following'} ${slug}. ${result.followers} ${result.followers === 1 ? 'follower' : 'followers'}.`, result);
 }
+// --- inbox ----------------------------------------------------------------
+async function commandInbox(args) {
+    const client = clientFor(args);
+    if (args.positional[0] === 'read') {
+        const id = args.positional[1] ?? '';
+        if (id === '') {
+            process.stderr.write('Which one? agenticjobs inbox read <id>\n');
+            return 1;
+        }
+        const result = await client.thread(id);
+        const lines = result.thread.messages.map((message) => [
+            `${bold(message.mine ? 'You' : message.sender.name)} ${dim(ago(message.createdAt))}${message.kind === 'invoice' ? dim(' (invoice)') : ''}`,
+            `  ${message.body.replace(/\n/g, '\n  ')}`,
+        ].join('\n'));
+        const invoices = result.invoices.map((invoice) => `  ${invoice.id}  $${invoice.amountUsd} ${invoice.currency}  ${invoice.status}`);
+        return out(args, [
+            `${bold(result.thread.subject)} ${dim(`with ${result.thread.with.name}`)}`,
+            '',
+            lines.join('\n\n'),
+            ...(invoices.length === 0 ? [] : ['', bold('Invoices'), ...invoices]),
+        ].join('\n'), result);
+    }
+    const result = await client.inbox();
+    if (result.items.length === 0)
+        return out(args, 'Nothing in the inbox.', result);
+    const lines = result.items.map((thread) => [
+        `${bold(thread.with.name)} ${dim(ago(thread.lastMessageAt))}${thread.unread > 0 ? ` ${bold(`${thread.unread} new`)}` : ''}`,
+        `  ${thread.subject}`,
+        `  ${dim(thread.preview)}`,
+        `  ${dim(thread.id)}`,
+    ].join('\n'));
+    return out(args, lines.join('\n\n'), result);
+}
+async function commandMessage(args) {
+    const slug = args.positional[0] ?? '';
+    const body = args.positional.slice(1).join(' ');
+    if (slug === '' || body === '') {
+        process.stderr.write('agenticjobs message <employer-slug> <text> [--candidate] [--job <slug>] [--as <employer>]\n');
+        return 1;
+    }
+    const candidate = flagBool(args, 'candidate');
+    const job = flagString(args, 'job');
+    const as = flagString(args, 'as');
+    const subject = flagString(args, 'subject');
+    const result = await clientFor(args).startThread({
+        ...(candidate ? { candidate: slug } : { employer: slug }),
+        ...(job === undefined || job === null ? {} : { job }),
+        ...(as === undefined || as === null ? {} : { as }),
+        ...(subject === undefined || subject === null ? {} : { subject }),
+        body,
+    });
+    return out(args, `${result.created ? 'Sent' : 'Added to the conversation you already have'}. ${result.url}`, result);
+}
+async function commandReply(args) {
+    const id = args.positional[0] ?? '';
+    const body = args.positional.slice(1).join(' ');
+    if (id === '' || body === '') {
+        process.stderr.write('agenticjobs reply <thread-id> <text>\n');
+        return 1;
+    }
+    const result = await clientFor(args).reply(id, body);
+    return out(args, 'Sent.', result);
+}
+async function commandInvoice(args) {
+    const id = args.positional[0] ?? '';
+    const amount = args.positional[1] ?? '';
+    if (id === '' || amount === '') {
+        process.stderr.write('agenticjobs invoice <thread-id> <amount-usd> [--currency <chain>] [--for <text>]\n');
+        return 1;
+    }
+    const currency = flagString(args, 'currency');
+    const description = flagString(args, 'for');
+    const result = await clientFor(args).sendInvoice(id, {
+        amount,
+        ...(currency === undefined || currency === null ? {} : { currency }),
+        ...(description === undefined || description === null ? {} : { description }),
+    });
+    return out(args, `Invoice sent: $${result.invoice.amountUsd} in ${result.invoice.currency}. ${dim(result.invoice.id)}`, result);
+}
+async function commandInvoices(args) {
+    const result = await clientFor(args).invoices();
+    if (result.items.length === 0)
+        return out(args, 'No invoices.', result);
+    const lines = result.items.map((invoice) => `${bold(`$${invoice.amountUsd}`)} ${invoice.currency}  ${invoice.status}  ${dim(`from ${invoice.payee.name}, ${ago(invoice.createdAt)}`)}\n  ${dim(invoice.id)}`);
+    return out(args, lines.join('\n'), result);
+}
+async function commandPay(args) {
+    const id = args.positional[0] ?? '';
+    if (id === '') {
+        process.stderr.write('agenticjobs pay <invoice-id>\n');
+        return 1;
+    }
+    const result = await clientFor(args).payInvoice(id);
+    const invoice = result.invoice;
+    if (invoice.status === 'paid')
+        return out(args, 'Already paid.', result);
+    if (invoice.payment === null)
+        return out(args, 'No quote came back. Try again in a moment.', result);
+    return out(args, [
+        `Pay at ${bold(invoice.payment.url)}`,
+        ...(invoice.payment.amountCrypto === null
+            ? []
+            : [`  ${invoice.payment.amountCrypto} ${invoice.currency} to ${invoice.payment.address ?? ''}`]),
+        dim('  The quote lasts a few minutes.'),
+    ].join('\n'), result);
+}
+async function commandBilling(args) {
+    const result = await clientFor(args).billing();
+    if (!result.configured)
+        return out(args, 'This board has no billing configured.', result);
+    if (result.account === null) {
+        return out(args, `No CoinPay account connected. Connect one in a browser: ${result.connectUrl ?? ''}`, result);
+    }
+    if (!result.account.usable) {
+        return out(args, `The CoinPay connection has lapsed. Reconnect in a browser: ${result.connectUrl ?? ''}`, result);
+    }
+    const wallets = result.account.wallets;
+    return out(args, wallets.length === 0
+        ? 'Connected, but the CoinPay account has no wallet yet.'
+        : `Connected. Can be paid in: ${wallets.map((w) => `${w.chain} ${dim(w.address)}`).join(', ')}.`, result);
+}
 async function commandAnnounce(args) {
     const { announceOnce } = await import("../directory/announce.js");
     const { loadConfig: serverConfig, sameOrigin } = await import("../config.js");