@rine-network/cli 0.1.0

package/dist/main.js

@@ -0,0 +1,1346 @@
+import { createRequire } from "node:module";
+import { Command } from "commander";
+import * as fs from "node:fs";
+import { join } from "node:path";
+import readline from "node:readline";
+import { createEventSource } from "eventsource-client";
+//#region src/errors.ts
+var RineApiError = class extends Error {
+	constructor(status, detail, raw) {
+		super(`${status}: ${detail}`);
+		this.status = status;
+		this.detail = detail;
+		this.raw = raw;
+		this.name = "RineApiError";
+	}
+};
+function formatError(err) {
+	if (err instanceof RineApiError) return err.detail;
+	if (err instanceof Error) return err.message;
+	return String(err);
+}
+//#endregion
+//#region src/config.ts
+function getConfigDir() {
+	return process.env.RINE_CONFIG_DIR ?? join(process.cwd(), ".rine");
+}
+function getApiUrl() {
+	return (process.env.RINE_API_URL ?? "https://rine.network").replace(/\/$/, "");
+}
+function ensureDir(dir) {
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+}
+function writeAtomic(path, content) {
+	const tmpPath = `${path}.tmp`;
+	fs.writeFileSync(tmpPath, content, "utf-8");
+	fs.renameSync(tmpPath, path);
+	fs.chmodSync(path, 384);
+}
+function loadCredentials() {
+	const path = join(getConfigDir(), "credentials.json");
+	try {
+		const raw = fs.readFileSync(path, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+function saveCredentials(creds) {
+	const dir = getConfigDir();
+	ensureDir(dir);
+	writeAtomic(join(dir, "credentials.json"), JSON.stringify(creds, null, 2));
+}
+function loadTokenCache() {
+	const path = join(getConfigDir(), "token_cache.json");
+	try {
+		const raw = fs.readFileSync(path, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+function saveTokenCache(cache) {
+	const dir = getConfigDir();
+	ensureDir(dir);
+	writeAtomic(join(dir, "token_cache.json"), JSON.stringify(cache, null, 2));
+}
+/**
+* Resolves credentials for a profile. Priority:
+* 1. RINE_CLIENT_ID + RINE_CLIENT_SECRET env vars (both required)
+* 2. credentials.json for the given profile
+* Returns undefined if no credentials found.
+*/
+function getCredentialEntry(profile = "default") {
+	const envId = process.env.RINE_CLIENT_ID;
+	const envSecret = process.env.RINE_CLIENT_SECRET;
+	if (envId && envSecret) return {
+		client_id: envId,
+		client_secret: envSecret
+	};
+	return loadCredentials()[profile];
+}
+//#endregion
+//#region src/http.ts
+async function parseErrorDetail(res) {
+	try {
+		const body = await res.json();
+		if (typeof body.detail === "string") return body.detail;
+		if (Array.isArray(body.detail)) return body.detail.map((e) => e.msg).join("; ");
+	} catch {}
+	return res.statusText;
+}
+var HttpClient = class {
+	baseUrl;
+	tokenFn;
+	canRefresh;
+	constructor(opts) {
+		this.baseUrl = (opts.apiUrl ?? getApiUrl()).replace(/\/$/, "");
+		this.tokenFn = opts.tokenFn;
+		this.canRefresh = opts.canRefresh ?? true;
+	}
+	async request(method, path, body, params, extraHeaders) {
+		let url = this.baseUrl + path;
+		if (params) {
+			const qs = new URLSearchParams(Object.entries(params).filter(([, v]) => v !== void 0 && v !== null).map(([k, v]) => [k, String(v)])).toString();
+			if (qs) url += `?${qs}`;
+		}
+		const doFetch = async (force) => {
+			const headers = {
+				Authorization: `Bearer ${await this.tokenFn(force)}`,
+				...extraHeaders
+			};
+			if (body !== void 0) headers["Content-Type"] = "application/json";
+			const init = {
+				method,
+				headers
+			};
+			if (body !== void 0) init.body = JSON.stringify(body);
+			return fetch(url, init);
+		};
+		let res = await doFetch();
+		if (res.status === 401 && this.canRefresh) res = await doFetch(true);
+		if (!res.ok) {
+			const detail = await parseErrorDetail(res);
+			throw new RineApiError(res.status, detail, res);
+		}
+		if (res.status === 204) return void 0;
+		return res.json();
+	}
+	get(path, params) {
+		return this.request("GET", path, void 0, params);
+	}
+	post(path, body, extraHeaders) {
+		return this.request("POST", path, body, void 0, extraHeaders);
+	}
+	put(path, body) {
+		return this.request("PUT", path, body);
+	}
+	patch(path, body) {
+		return this.request("PATCH", path, body);
+	}
+	delete(path) {
+		return this.request("DELETE", path);
+	}
+};
+/**
+* Resolves a valid access token. Priority:
+* 1. RINE_TOKEN env var — used directly, no cache/refresh
+* 2. Token cache — returned if not expired (60s margin)
+* 3. POST /oauth/token — fetches fresh token and caches it
+*/
+async function getOrRefreshToken(entry, profileName, force = false) {
+	const envToken = process.env.RINE_TOKEN;
+	if (envToken) return envToken;
+	const now = Date.now() / 1e3;
+	if (!force) {
+		const cached = loadTokenCache()[profileName];
+		if (cached !== void 0 && cached.expires_at - now > 60) return cached.access_token;
+	}
+	if (!entry) throw new RineApiError(0, "No credentials found. Run `rine login` first.");
+	const apiUrl = getApiUrl();
+	const res = await fetch(`${apiUrl}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "client_credentials",
+			client_id: entry.client_id,
+			client_secret: entry.client_secret
+		}).toString()
+	});
+	if (!res.ok) throw new RineApiError(res.status, "Token refresh failed");
+	const data = await res.json();
+	const freshNow = Date.now() / 1e3;
+	const cache = loadTokenCache();
+	cache[profileName] = {
+		access_token: data.access_token,
+		expires_at: freshNow + data.expires_in
+	};
+	saveTokenCache(cache);
+	return data.access_token;
+}
+async function createClient(profileFlag) {
+	const profileName = profileFlag ?? "default";
+	const entry = getCredentialEntry(profileName);
+	const canRefresh = !process.env.RINE_TOKEN && entry !== void 0;
+	const tokenFn = (force = false) => getOrRefreshToken(entry, profileName, force);
+	return {
+		client: new HttpClient({
+			tokenFn,
+			canRefresh
+		}),
+		profileName,
+		entry
+	};
+}
+//#endregion
+//#region src/output.ts
+function printSuccess(msg) {
+	console.log(`✓ ${msg}`);
+}
+/** Print mutation result: `{"ok":true}` when JSON mode, else human `✓ message`. */
+function printMutationOk(msg, json) {
+	if (json) printJson({ ok: true });
+	else printSuccess(msg);
+}
+function printJson(data) {
+	console.log(JSON.stringify(data, null, 2));
+}
+function printTable(rows, keys) {
+	if (rows.length === 0) {
+		console.log("(no results)");
+		return;
+	}
+	const firstRow = rows[0];
+	const headers = keys ?? Object.keys(firstRow ?? {});
+	const allRows = [headers, ...rows.map((row) => headers.map((k) => String(row[k] ?? "")))];
+	const widths = headers.map((_, i) => Math.max(...allRows.map((r) => (r[i] ?? "").length)));
+	const sep = `+${widths.map((w) => "-".repeat(w + 2)).join("+")}+`;
+	const fmtRow = (row) => `| ${row.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join(" | ")} |`;
+	const lines = [
+		sep,
+		fmtRow(headers),
+		sep
+	];
+	for (const row of allRows.slice(1)) lines.push(fmtRow(row));
+	lines.push(sep);
+	console.log(lines.join("\n"));
+}
+function printText(msg) {
+	console.log(msg);
+}
+function printError(msg) {
+	console.error(msg);
+}
+function printResult(data, opts) {
+	if (opts.json) {
+		printJson(data);
+		return;
+	}
+	if (opts.table && Array.isArray(data)) {
+		printTable(data);
+		return;
+	}
+	if (Array.isArray(data)) for (const item of data) {
+		printObject(item);
+		console.log("---");
+	}
+	else printObject(data);
+}
+function printObject(data) {
+	if (data === null || data === void 0) return;
+	if (typeof data !== "object") {
+		console.log(String(data));
+		return;
+	}
+	for (const [k, v] of Object.entries(data)) {
+		const val = typeof v === "object" ? JSON.stringify(v) : String(v ?? "");
+		console.log(`${k}: ${val}`);
+	}
+}
+//#endregion
+//#region src/commands/agent-profile.ts
+const READ_ONLY_KEYS = [
+	"id",
+	"agent_id",
+	"created_at",
+	"updated_at",
+	"signatures"
+];
+const VALID_PRICING = [
+	"free",
+	"per_request",
+	"subscription",
+	"negotiated"
+];
+function stripReadOnly(card) {
+	const result = { ...card };
+	for (const key of READ_ONLY_KEYS) delete result[key];
+	return result;
+}
+function setRineField(card, key, value) {
+	const rine = { ...card.rine };
+	rine[key] = value;
+	return {
+		...card,
+		rine
+	};
+}
+function toRow(card) {
+	const rine = card.rine ?? {};
+	const skillCount = Array.isArray(card.skills) ? card.skills.length : 0;
+	const join = (v) => Array.isArray(v) ? v.join(", ") : "—";
+	return {
+		ID: String(card.id ?? "—"),
+		"Agent ID": String(card.agent_id ?? "—"),
+		Name: String(card.name ?? "—"),
+		Description: card.description ? String(card.description).slice(0, 60) : "—",
+		Version: String(card.version ?? "—"),
+		Public: String(card.is_public ?? "—"),
+		Skills: String(skillCount),
+		Categories: join(rine.categories) || "—",
+		Languages: join(rine.languages) || "—",
+		Pricing: String(rine.pricing_model ?? "—"),
+		"Accept Types": join(rine.message_types_accepted) || "—",
+		Updated: String(card.updated_at ?? "—")
+	};
+}
+function getAgentCmd(program) {
+	const cmd = program.commands.find((c) => c.name() === "agent");
+	if (!cmd) throw new Error("registerAgent must be called before registerAgentProfile");
+	return cmd;
+}
+function registerAgentProfile(program) {
+	const agent = getAgentCmd(program);
+	agent.command("profile").description("Get agent card").argument("<agent-id>", "Agent ID").action(async (agentId) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			if (gOpts.json) printJson(card);
+			else printTable([toRow(card)]);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("describe").description("Update agent description").argument("<agent-id>", "Agent ID").requiredOption("--description <desc>", "Agent description").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			card.description = opts.description;
+			await client.put(`/agents/${agentId}/card`, stripReadOnly(card));
+			printMutationOk("Description updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("add-skill").description("Add a skill to the agent card").argument("<agent-id>", "Agent ID").requiredOption("--skill-id <id>", "Skill ID").requiredOption("--skill-name <name>", "Skill name").option("--skill-description <desc>", "Skill description").option("--tags <tags>", "Comma-separated tags").option("--examples <examples>", "Comma-separated examples").option("--input-modes <modes>", "Comma-separated input modes").option("--output-modes <modes>", "Comma-separated output modes").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			const skill = {
+				id: opts.skillId,
+				name: opts.skillName
+			};
+			if (opts.skillDescription) skill.description = opts.skillDescription;
+			if (opts.tags) skill.tags = opts.tags.split(",").map((t) => t.trim());
+			if (opts.examples) skill.examples = opts.examples.split(",").map((e) => e.trim());
+			if (opts.inputModes) skill.inputModes = opts.inputModes.split(",").map((m) => m.trim());
+			if (opts.outputModes) skill.outputModes = opts.outputModes.split(",").map((m) => m.trim());
+			card.skills = [...Array.isArray(card.skills) ? card.skills : [], skill];
+			await client.put(`/agents/${agentId}/card`, stripReadOnly(card));
+			printMutationOk("Skill added", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("set-categories").description("Set agent categories").argument("<agent-id>", "Agent ID").requiredOption("--categories <cats>", "Comma-separated category names").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			const cats = opts.categories.split(",").map((c) => c.trim());
+			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "categories", cats)));
+			printMutationOk("Categories updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("set-languages").description("Set agent supported languages").argument("<agent-id>", "Agent ID").requiredOption("--languages <langs>", "Comma-separated language codes").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			const langs = opts.languages.split(",").map((l) => l.trim());
+			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "languages", langs)));
+			printMutationOk("Languages updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("set-pricing").description("Set agent pricing model").argument("<agent-id>", "Agent ID").requiredOption("--model <model>", `Pricing model (${VALID_PRICING.join("|")})`).action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			if (!VALID_PRICING.includes(opts.model)) {
+				printError(`Invalid pricing model '${opts.model}'. Valid: ${VALID_PRICING.join(", ")}`);
+				process.exitCode = 2;
+				return;
+			}
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "pricing_model", opts.model)));
+			printMutationOk("Pricing updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("accept-types").description("Set accepted message types").argument("<agent-id>", "Agent ID").requiredOption("--types <types>", "Comma-separated message types").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const card = await client.get(`/agents/${agentId}/card`);
+			const types = opts.types.split(",").map((t) => t.trim());
+			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "message_types_accepted", types)));
+			printMutationOk("Accept types updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/prompt.ts
+/** Prompt for a plain-text value on stdout/stdin. */
+async function promptText(question) {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	return new Promise((resolve) => {
+		rl.question(question, (answer) => {
+			rl.close();
+			resolve(answer.trim());
+		});
+	});
+}
+/** Prompt for a secret value with hidden input (raw mode). */
+async function promptPassword(question) {
+	return new Promise((resolve) => {
+		process.stdout.write(question);
+		const isTTY = process.stdin.isTTY === true;
+		if (isTTY) process.stdin.setRawMode(true);
+		process.stdin.resume();
+		process.stdin.setEncoding("utf8");
+		let password = "";
+		const handler = (data) => {
+			if (data === "\r" || data === "\n" || data === "") {
+				if (isTTY) process.stdin.setRawMode(false);
+				process.stdin.pause();
+				process.stdin.removeListener("data", handler);
+				process.stdout.write("\n");
+				resolve(password);
+			} else if (data === "" || data === "\b") password = password.slice(0, -1);
+			else if (data === "") {
+				process.exitCode = 130;
+				process.exit();
+			} else password += data;
+		};
+		process.stdin.on("data", handler);
+	});
+}
+/** Prompt for yes/no confirmation (defaults to No). Returns true if user types y/Y. */
+async function promptConfirm(question) {
+	return (await promptText(`${question} [y/N] `)).toLowerCase() === "y";
+}
+//#endregion
+//#region src/commands/agent.ts
+function toAgentRow(a, opts = {}) {
+	const row = {
+		ID: String(a.id ?? ""),
+		Name: String(a.name ?? ""),
+		Handle: String(a.handle ?? ""),
+		"Human Oversight": String(a.human_oversight ?? ""),
+		Created: String(a.created_at ?? "")
+	};
+	if (opts.includeVerificationWords && a.verification_words) row["Verification Words"] = String(a.verification_words);
+	if (opts.includeCard) row.Card = a.unlisted ? "unlisted" : "public";
+	if (opts.includeRevoked) row.Revoked = a.revoked_at ? String(a.revoked_at) : "—";
+	return row;
+}
+function registerAgent(program) {
+	const agent = program.command("agent").description("Agent management");
+	agent.command("create").description("Create a new agent").option("--name <name>", "Agent name").option("--human-oversight <bool>", "Require human oversight (true/false)").option("--unlisted", "Mark agent as unlisted (not in public directory)").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			let name = opts.name;
+			if (!name) {
+				name = await promptText("Agent name: ");
+				if (!name) {
+					printError("Agent name is required");
+					process.exitCode = 2;
+					return;
+				}
+			}
+			const body = { name };
+			if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight === "true";
+			if (opts.unlisted) body.unlisted = true;
+			const { client } = await createClient(gOpts.profile);
+			const data = await client.post("/agents", body);
+			if (gOpts.json) printJson(data);
+			else {
+				printTable([toAgentRow(data, {
+					includeCard: true,
+					includeVerificationWords: true
+				})]);
+				const handle = String(data.handle ?? "");
+				const name = String(data.name ?? "");
+				console.log(`
+Agent '${name}' created — reachable at ${handle}`);
+				if (data.verification_words) console.log(`Verification words: ${data.verification_words}`);
+			}
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("list").description("List all agents").option("--include-revoked", "Include revoked agents").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const params = opts.includeRevoked ? { include_revoked: true } : void 0;
+			const data = await client.get("/agents", params);
+			if (gOpts.json) printJson(data);
+			else printTable(data.items.map((a) => toAgentRow(a, { includeRevoked: opts.includeRevoked })));
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("get").description("Get agent details").argument("<agent-id>", "Agent ID").action(async (agentId) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const data = await client.get(`/agents/${agentId}`);
+			if (gOpts.json) printJson(data);
+			else printTable([toAgentRow(data, { includeRevoked: true })]);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("update").description("Update agent details").argument("<agent-id>", "Agent ID").option("--name <name>", "Agent name").option("--human-oversight <bool>", "Require human oversight (true/false)").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const body = {};
+			if (opts.name) body.name = opts.name;
+			if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight === "true";
+			if (Object.keys(body).length === 0) {
+				printError("At least one of --name, --human-oversight is required");
+				process.exitCode = 2;
+				return;
+			}
+			const { client } = await createClient(gOpts.profile);
+			await client.patch(`/agents/${agentId}`, body);
+			printMutationOk("Agent updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	agent.command("revoke").description("Revoke an agent").argument("<agent-id>", "Agent ID").option("--yes", "Skip confirmation prompt").action(async (agentId, opts) => {
+		try {
+			const gOpts = program.opts();
+			if (!opts.yes && !gOpts.json) {
+				if (!await promptConfirm(`Revoke agent ${agentId}?`)) return;
+			}
+			const { client } = await createClient(gOpts.profile);
+			await client.delete(`/agents/${agentId}`);
+			printMutationOk("Agent revoked", gOpts.json);
+		} catch (err) {
+			if (err instanceof RineApiError && err.status === 409) printError("Agent already revoked");
+			else printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/commands/auth.ts
+function registerAuth(program) {
+	program.command("login").description("Log in with OAuth2 client credentials").option("--client-id <id>", "Client ID").option("--client-secret <secret>", "Client secret").action(async (opts) => {
+		try {
+			const profile = program.opts().profile ?? "default";
+			const clientId = opts.clientId ?? await promptText("Client ID: ");
+			const clientSecret = opts.clientSecret ?? await promptPassword("Client secret: ");
+			const apiUrl = getApiUrl();
+			const res = await fetch(`${apiUrl}/oauth/token`, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					grant_type: "client_credentials",
+					client_id: clientId,
+					client_secret: clientSecret
+				}).toString()
+			});
+			if (!res.ok) {
+				printError(`Login failed: ${(await res.json().catch(() => ({}))).detail ?? res.statusText}`);
+				process.exitCode = 1;
+				return;
+			}
+			const tokenData = await res.json();
+			const creds = loadCredentials();
+			creds[profile] = {
+				client_id: clientId,
+				client_secret: clientSecret
+			};
+			saveCredentials(creds);
+			const cache = loadTokenCache();
+			cache[profile] = {
+				access_token: tokenData.access_token,
+				expires_at: Date.now() / 1e3 + tokenData.expires_in
+			};
+			saveTokenCache(cache);
+			printSuccess(`Logged in as ${clientId}`);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	program.command("logout").description("Clear token cache for the current profile").action(() => {
+		try {
+			const profile = program.opts().profile ?? "default";
+			const cache = loadTokenCache();
+			delete cache[profile];
+			saveTokenCache(cache);
+			printSuccess("Logged out (credentials preserved — use 'rine auth token' to re-authenticate)");
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	program.command("status").description("Show org status").action(async () => {
+		await showOrgStatus(program);
+	});
+	const authGroup = program.command("auth").description("Auth commands");
+	authGroup.command("token").description("Get or refresh access token").option("--force", "Force token refresh (bypass cache)").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const profile = gOpts.profile ?? "default";
+			const force = opts.force === true;
+			const now = Date.now() / 1e3;
+			const envToken = process.env.RINE_TOKEN;
+			const cached = loadTokenCache()[profile];
+			const source = envToken !== void 0 || !force && cached !== void 0 && cached.expires_at - now > 60 ? "cache" : "server";
+			const token = await getOrRefreshToken(getCredentialEntry(profile), profile, force);
+			if (gOpts.json) printResult({
+				access_token: token,
+				source
+			}, gOpts);
+			else console.log(token);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	authGroup.command("status").description("Show org status").action(async () => {
+		await showOrgStatus(program);
+	});
+}
+async function showOrgStatus(program) {
+	try {
+		const gOpts = program.opts();
+		const { client } = await createClient(gOpts.profile);
+		const data = await client.get("/org");
+		if (gOpts.json) {
+			printResult(data, gOpts);
+			return;
+		}
+		printTable([
+			{
+				Field: "Name",
+				Value: String(data.name ?? "")
+			},
+			{
+				Field: "Slug",
+				Value: String(data.slug ?? "")
+			},
+			{
+				Field: "Trust Tier",
+				Value: String(data.trust_tier ?? "")
+			},
+			{
+				Field: "Agent Count",
+				Value: String(data.agent_count ?? "")
+			}
+		]);
+	} catch (err) {
+		printError(formatError(err));
+		process.exitCode = 1;
+	}
+}
+//#endregion
+//#region src/commands/discover.ts
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function directoryFetch(path, params) {
+	const base = getApiUrl();
+	const qs = params?.toString();
+	const url = qs ? `${base}${path}?${qs}` : `${base}${path}`;
+	const res = await fetch(url, { headers: { Accept: "application/json" } });
+	if (!res.ok) {
+		const body = await res.text().catch(() => res.statusText);
+		throw new RineApiError(res.status, body, res);
+	}
+	return res.json();
+}
+function trunc(s, len) {
+	const str = String(s ?? "");
+	return str.length > len ? `${str.slice(0, len - 1)}\u2026` : str;
+}
+function fmtList(v) {
+	return Array.isArray(v) ? v.join(", ") : String(v ?? "");
+}
+async function doAgentSearch(opts, gOpts) {
+	const params = new URLSearchParams();
+	if (opts.query) params.append("q", opts.query);
+	for (const c of opts.category) params.append("category", c);
+	for (const t of opts.tag) params.append("tag", t);
+	if (opts.jurisdiction) params.append("jurisdiction", opts.jurisdiction);
+	for (const l of opts.language) params.append("language", l);
+	if (opts.verified !== void 0) params.append("verified", String(opts.verified));
+	if (opts.pricingModel) params.append("pricing_model", opts.pricingModel);
+	if (opts.limit) params.append("limit", opts.limit);
+	if (opts.cursor) params.append("cursor", opts.cursor);
+	if (opts.sort) params.append("sort", opts.sort);
+	const data = await directoryFetch("/directory/agents", params);
+	if (gOpts.json) {
+		printJson(data);
+		return;
+	}
+	const result = data;
+	printTable((result.items ?? []).map((a) => ({
+		Name: trunc(a.name, 40),
+		Categories: trunc(fmtList(a.rine?.categories ?? a.categories), 40),
+		Tags: trunc(fmtList(a.rine?.tags ?? a.tags), 40),
+		Pricing: trunc(a.rine?.pricing_model ?? a.pricing_model, 40),
+		Handle: trunc(a.handle, 40)
+	})));
+	if (result.next_cursor) printText(`Next cursor: ${result.next_cursor}`);
+}
+const collect = (v, prev) => [...prev, v];
+function addSearchOptions(cmd, requireQuery) {
+	if (requireQuery) cmd.requiredOption("-q, --query <query>", "Search query");
+	else cmd.option("-q, --query <query>", "Search query");
+	return cmd.option("--category <cat>", "Category filter (repeatable)", collect, []).option("--tag <tag>", "Tag filter (repeatable)", collect, []).option("--jurisdiction <j>", "Jurisdiction filter").option("--language <lang>", "Language filter (repeatable)", collect, []).option("--verified", "Only verified agents").option("--pricing-model <model>", "Pricing model filter").option("--limit <n>", "Max results").option("--cursor <cursor>", "Pagination cursor").option("--sort <sort>", "Sort order (relevance|name|created_at)");
+}
+function registerDiscover(program) {
+	const discover = program.command("discover").description("Discover agents in the directory");
+	addSearchOptions(discover.command("agents").description("List agents in the directory"), false).action(async (opts) => {
+		const gOpts = program.opts();
+		try {
+			await doAgentSearch(opts, gOpts);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	addSearchOptions(discover.command("search").description("Search agents (--query required)"), true).action(async (opts) => {
+		const gOpts = program.opts();
+		try {
+			await doAgentSearch(opts, gOpts);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	discover.command("categories").description("List directory categories with counts").action(async () => {
+		const gOpts = program.opts();
+		try {
+			const data = await directoryFetch("/directory/categories");
+			if (gOpts.json) {
+				printJson(data);
+				return;
+			}
+			printTable((data.items ?? []).sort((a, b) => a.name.localeCompare(b.name)).map((c) => ({
+				Category: c.name,
+				Count: c.count
+			})));
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	discover.command("inspect").description("Inspect a specific agent in the directory").argument("<agent-id>", "Agent UUID or handle").action(async (agentId) => {
+		const gOpts = program.opts();
+		if (agentId.includes("@")) {
+			const match = ((await directoryFetch("/directory/agents", new URLSearchParams({
+				q: agentId,
+				limit: "5"
+			}))).items ?? []).find((i) => i.handle === agentId);
+			if (!match?.id) {
+				printError(`No agent found with handle: ${agentId}`);
+				process.exitCode = 1;
+				return;
+			}
+			agentId = match.id;
+		}
+		if (!UUID_RE.test(agentId)) {
+			printError("agent-id must be a valid UUID");
+			process.exitCode = 2;
+			return;
+		}
+		try {
+			const data = await directoryFetch(`/directory/agents/${agentId}`);
+			if (gOpts.json) {
+				printJson(data);
+				return;
+			}
+			const result = data;
+			const card = result.card ?? data;
+			const meta = result.directory_metadata ?? {};
+			printTable([{
+				Name: String(card.name ?? ""),
+				Description: trunc(card.description, 120),
+				Categories: fmtList(card.rine?.categories ?? card.categories),
+				Tags: fmtList(card.rine?.tags ?? card.tags),
+				Pricing: String(card.rine?.pricing_model ?? card.pricing_model ?? ""),
+				"Registered At": String(meta.registered_at ?? ""),
+				"Messages (30d)": String(meta.messages_processed_30d ?? ""),
+				"Avg Response (ms)": String(meta.avg_response_time_ms ?? "")
+			}]);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/commands/resolve.ts
+/**
+* Resolve the first active agent for the authenticated org.
+* Used by inbox and stream commands when no explicit --agent is given.
+*/
+async function resolveFirstAgent(client) {
+	const agents = ((await client.get("/agents")).items ?? []).filter((a) => !a.revoked_at);
+	if (agents.length === 0) throw new Error("No active agents found. Create one with `rine agent create`.");
+	const first = agents[0];
+	if (agents.length > 1) process.stderr.write(`Warning: multiple agents found, using first: ${first.id}\n`);
+	return first.id;
+}
+//#endregion
+//#region src/commands/messages.ts
+function msgFrom(m) {
+	return String(m.sender_handle ?? m.from_agent_id ?? "");
+}
+function msgTo(m) {
+	return String(m.recipient_handle ?? m.to_agent_id ?? "");
+}
+function sendRow(m) {
+	return {
+		ID: m.id,
+		"Conversation ID": m.conversation_id,
+		From: msgFrom(m),
+		To: msgTo(m),
+		Type: m.type,
+		Created: m.created_at
+	};
+}
+function readRow(m) {
+	return {
+		ID: m.id,
+		"Conversation ID": m.conversation_id,
+		From: msgFrom(m),
+		To: msgTo(m),
+		Type: m.type,
+		Preview: m.payload_preview ? String(m.payload_preview).slice(0, 60) : "",
+		Payload: JSON.stringify(m.payload ?? {}),
+		Created: m.created_at
+	};
+}
+function inboxRow(m) {
+	return {
+		ID: m.id,
+		From: msgFrom(m),
+		Type: m.type,
+		Preview: m.payload_preview ? String(m.payload_preview).slice(0, 60) : "",
+		Created: m.created_at
+	};
+}
+function addMessageCommands(parent, program) {
+	parent.command("send").description("Send a message").requiredOption("--to <address>", "Recipient address (agent ID or handle with @)").requiredOption("--type <type>", "Message type (e.g. rine.v1.task_request)").requiredOption("--payload <json>", "Message payload as JSON string").option("--from <address>", "Sender address (agent ID or handle with @)").option("--idempotency-key <key>", "Idempotency key header").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			let parsedPayload;
+			try {
+				parsedPayload = JSON.parse(opts.payload);
+			} catch {
+				printError("--payload must be valid JSON");
+				process.exitCode = 2;
+				return;
+			}
+			const body = {
+				type: opts.type,
+				payload: parsedPayload
+			};
+			if (opts.to.includes("@")) body.to_handle = opts.to;
+			else body.to_agent_id = opts.to;
+			if (opts.from !== void 0) if (opts.from.includes("@")) body.from_handle = opts.from;
+			else body.from_agent_id = opts.from;
+			const extraHeaders = {};
+			if (opts.idempotencyKey) extraHeaders["Idempotency-Key"] = opts.idempotencyKey;
+			const data = await client.post("/messages", body, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
+			if (gOpts.json) printJson(data);
+			else printTable([sendRow(data)]);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	parent.command("read").description("Read a message by ID").argument("<message-id>", "Message ID").action(async (messageId) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			const data = await client.get(`/messages/${messageId}`);
+			if (gOpts.json) printJson(data);
+			else printTable([readRow(data)]);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	parent.command("inbox").description("List inbox messages").option("--agent <id>", "Agent ID (auto-resolved if omitted)").option("--limit <n>", "Maximum number of messages to return").option("--cursor <cursor>", "Pagination cursor").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			let agentId = opts.agent;
+			if (!agentId) agentId = await resolveFirstAgent(client);
+			const params = {};
+			if (opts.limit) params.limit = opts.limit;
+			if (opts.cursor) params.cursor = opts.cursor;
+			const data = await client.get(`/agents/${agentId}/messages`, params);
+			if (gOpts.json) printJson(data);
+			else {
+				printTable(data.items.map(inboxRow));
+				if (data.next_cursor) printText(`Next cursor: ${data.next_cursor}`);
+			}
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	parent.command("reply").description("Reply to a message").argument("<message-id>", "Message ID to reply to").requiredOption("--type <type>", "Message type").requiredOption("--payload <json>", "Reply payload as JSON string").action(async (messageId, opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			let parsedPayload;
+			try {
+				parsedPayload = JSON.parse(opts.payload);
+			} catch {
+				printError("--payload must be valid JSON");
+				process.exitCode = 2;
+				return;
+			}
+			const data = await client.post(`/messages/${messageId}/reply`, {
+				type: opts.type,
+				payload: parsedPayload
+			});
+			if (gOpts.json) printJson(data);
+			else printTable([sendRow(data)]);
+		} catch (err) {
+			if (err instanceof RineApiError && err.status === 409) printError("Conversation is closed");
+			else printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+function registerMessages(program) {
+	addMessageCommands(program, program);
+	addMessageCommands(program.command("message").description("Message operations (aliases: send/read/inbox/reply)"), program);
+}
+//#endregion
+//#region src/commands/org.ts
+function renderOrg(data, opts) {
+	if (opts.json) {
+		printJson(data);
+		return;
+	}
+	printTable([{
+		ID: String(data.id ?? ""),
+		Name: String(data.name ?? ""),
+		"Contact Email": String(data.contact_email ?? ""),
+		Country: String(data.country_code ?? ""),
+		Created: String(data.created_at ?? "")
+	}]);
+}
+function registerOrg(program) {
+	const org = program.command("org").description("Organization management");
+	org.command("get").description("Get organization details").action(async () => {
+		try {
+			const gOpts = program.opts();
+			const { client } = await createClient(gOpts.profile);
+			renderOrg(await client.get("/org"), gOpts);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	org.command("update").description("Update organization details").option("--name <name>", "Organization name").option("--contact-email <email>", "Contact email address").option("--country-code <cc>", "ISO country code (e.g. DE)").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const body = {};
+			if (opts.name) body.name = opts.name;
+			if (opts.contactEmail) body.contact_email = opts.contactEmail;
+			if (opts.countryCode) body.country_code = opts.countryCode;
+			if (Object.keys(body).length === 0) {
+				printError("At least one of --name, --contact-email, --country-code is required");
+				process.exitCode = 2;
+				return;
+			}
+			const { client } = await createClient(gOpts.profile);
+			await client.patch("/org", body);
+			printMutationOk("Org updated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/timelock.ts
+async function solveTimeLockWithProgress(baseHex, modulusHex, T, onProgress) {
+	const N = BigInt(`0x${modulusHex}`);
+	let x = BigInt(`0x${baseHex}`) % N;
+	const step = Math.max(1, Math.floor(T / 100));
+	for (let i = 0; i < T; i++) {
+		x = x * x % N;
+		if (i % step === 0) {
+			onProgress?.(Math.floor(i / T * 100));
+			await new Promise((resolve) => setImmediate(resolve));
+		}
+	}
+	return x.toString(16);
+}
+//#endregion
+//#region src/commands/register.ts
+function registerRegister(program) {
+	program.command("register").description("Register a new organization (two-step PoW flow)").requiredOption("--email <email>", "Email address").requiredOption("--name <name>", "Organization name").requiredOption("--slug <slug>", "Organization slug").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const profile = gOpts.profile ?? "default";
+			const apiUrl = getApiUrl();
+			const challengeRes = await fetch(`${apiUrl}/auth/register`, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					email: opts.email,
+					org_slug: opts.slug
+				})
+			});
+			if (challengeRes.status === 409) {
+				printError("Email or slug already registered");
+				process.exitCode = 1;
+				return;
+			}
+			if (challengeRes.status === 429) {
+				printError("Rate limited — please wait before retrying");
+				process.exitCode = 1;
+				return;
+			}
+			if (!challengeRes.ok) {
+				printError(`Registration failed: ${(await challengeRes.json().catch(() => ({}))).detail ?? challengeRes.statusText}`);
+				process.exitCode = 1;
+				return;
+			}
+			const challenge = await challengeRes.json();
+			if (challenge.algorithm !== "rsa-timelock-v1") {
+				printError(`Unsupported algorithm: ${challenge.algorithm}. Please upgrade rine-cli.`);
+				process.exitCode = 1;
+				return;
+			}
+			process.stderr.write("By registering, you accept the rine terms of service and privacy policy:\n  https://rine.network/terms.html\n  https://rine.network/privacy.html\n");
+			const nonce = await solveTimeLockWithProgress(challenge.prefix, challenge.modulus, challenge.difficulty, (pct) => {
+				process.stdout.write(`\rSolving PoW challenge: ${pct}%`);
+			});
+			process.stdout.write("\rSolving PoW challenge: 100%\n");
+			const solveRes = await fetch(`${apiUrl}/auth/register/solve`, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					challenge_id: challenge.challenge_id,
+					nonce,
+					org_name: opts.name,
+					org_slug: opts.slug,
+					consent: true
+				})
+			});
+			if (solveRes.status === 409) {
+				printError("Conflict: email or slug already registered");
+				process.exitCode = 1;
+				return;
+			}
+			if (solveRes.status === 410) {
+				printError("Challenge expired — please register again");
+				process.exitCode = 1;
+				return;
+			}
+			if (!solveRes.ok) {
+				printError(`Solve failed: ${(await solveRes.json().catch(() => ({}))).detail ?? solveRes.statusText}`);
+				process.exitCode = 1;
+				return;
+			}
+			const data = await solveRes.json();
+			const creds = loadCredentials();
+			creds[profile] = {
+				client_id: data.client_id,
+				client_secret: data.client_secret
+			};
+			saveCredentials(creds);
+			try {
+				const tokenRes = await fetch(`${apiUrl}/oauth/token`, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						grant_type: "client_credentials",
+						client_id: data.client_id,
+						client_secret: data.client_secret
+					}).toString()
+				});
+				if (tokenRes.ok) {
+					const tokenData = await tokenRes.json();
+					const cache = loadTokenCache();
+					cache[profile] = {
+						access_token: tokenData.access_token,
+						expires_at: Date.now() / 1e3 + tokenData.expires_in
+					};
+					saveTokenCache(cache);
+				}
+			} catch {
+				process.stderr.write("Warning: initial token cache failed\n");
+			}
+			if (gOpts.json) printJson(data);
+			else {
+				printSuccess(`Registered '${opts.name}' (${opts.slug})`);
+				console.log("Credentials saved to .rine/credentials.json");
+				console.log("Next: create an agent with 'rine agent create --name <agent-name>'");
+			}
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/commands/stream.ts
+function formatMessageLine(dataStr) {
+	try {
+		const data = JSON.parse(dataStr);
+		return `[${(data.created_at ?? "").slice(0, 19) || "?"}] ${data.sender_handle ?? String(data.from_agent_id ?? "?")} \u2192 ${data.type ?? "?"}: ${data.payload ? JSON.stringify(data.payload).slice(0, 60) : ""}`;
+	} catch {
+		return `[message] ${dataStr.slice(0, 80)}`;
+	}
+}
+function registerStream(program) {
+	program.command("stream").description("Stream incoming messages via SSE").option("--agent <id>", "Agent ID (auto-resolved if omitted)").option("--verbose", "Show heartbeats and reconnect details").action(async (opts) => {
+		try {
+			const gOpts = program.opts();
+			const { client, profileName, entry } = await createClient(gOpts.profile);
+			let agentId = opts.agent;
+			if (!agentId) agentId = await resolveFirstAgent(client);
+			const url = `${getApiUrl()}/agents/${agentId}/stream`;
+			let lastEventId;
+			let backoff = 1;
+			let stopped = false;
+			process.on("SIGINT", () => {
+				stopped = true;
+				process.exitCode = 0;
+			});
+			while (!stopped) try {
+				const headers = {
+					Authorization: `Bearer ${await getOrRefreshToken(entry, profileName, false)}`,
+					Accept: "text/event-stream"
+				};
+				if (lastEventId) headers["Last-Event-ID"] = lastEventId;
+				await new Promise((resolve, reject) => {
+					if (stopped) {
+						resolve();
+						return;
+					}
+					const es = createEventSource({
+						url,
+						headers,
+						onMessage: ({ event, data, id }) => {
+							if (id) lastEventId = id;
+							if (gOpts.json) console.log(JSON.stringify({
+								event,
+								id,
+								data
+							}));
+							else if (event === "message") console.log(formatMessageLine(data));
+							else if (event === "heartbeat" && opts.verbose) process.stderr.write(`[heartbeat] ${data}\n`);
+						},
+						onDisconnect: () => resolve(),
+						onScheduleReconnect: () => {
+							es.close();
+							resolve();
+						}
+					});
+					const onStop = () => {
+						es.close();
+						resolve();
+					};
+					if (stopped) {
+						onStop();
+						return;
+					}
+					process.once("SIGINT", onStop);
+				});
+				backoff = 1;
+			} catch (err) {
+				if (stopped) break;
+				if (opts.verbose) process.stderr.write(`Reconnecting in ${backoff}s...\n`);
+				else process.stderr.write("Reconnecting...\n");
+				await new Promise((r) => setTimeout(r, backoff * 1e3));
+				backoff = Math.min(backoff * 2, 30);
+			}
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/commands/webhook.ts
+function registerWebhook(program) {
+	const webhook = program.command("webhook").description("Manage webhooks");
+	webhook.command("create").description("Create a new webhook").requiredOption("--agent <id>", "Agent ID to attach webhook to").requiredOption("--url <url>", "Webhook target URL (must be https://)").action(async (opts) => {
+		const gOpts = program.opts();
+		if (!opts.url.startsWith("https://")) {
+			printError("Webhook URL must start with https://");
+			process.exitCode = 2;
+			return;
+		}
+		try {
+			const { client } = await createClient(gOpts.profile);
+			const data = await client.post("/webhooks", {
+				agent_id: opts.agent,
+				url: opts.url
+			});
+			if (gOpts.json) printJson(data);
+			else printTable([{
+				ID: data.id,
+				"Agent ID": data.agent_id,
+				URL: data.url,
+				Secret: data.secret,
+				Active: data.active,
+				Created: data.created_at
+			}]);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	webhook.command("list").description("List webhooks").option("--agent <id>", "Filter by agent ID").option("--include-inactive", "Include inactive webhooks").action(async (opts) => {
+		const gOpts = program.opts();
+		try {
+			const { client } = await createClient(gOpts.profile);
+			const params = {};
+			if (opts.agent) params.agent_id = opts.agent;
+			if (opts.includeInactive) params.include_inactive = true;
+			const data = await client.get("/webhooks", params);
+			if (gOpts.json) printJson(data);
+			else printTable((data.items ?? []).map((w) => ({
+				ID: w.id,
+				"Agent ID": w.agent_id,
+				URL: w.url,
+				Active: w.active,
+				Created: w.created_at
+			})));
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	webhook.command("delete").description("Delete a webhook").argument("<webhook-id>", "Webhook ID").option("--yes", "Skip confirmation prompt").action(async (webhookId, opts) => {
+		const gOpts = program.opts();
+		try {
+			if (!opts.yes && !gOpts.json) {
+				if (!await promptConfirm(`Delete webhook ${webhookId}?`)) return;
+			}
+			const { client } = await createClient(gOpts.profile);
+			await client.delete(`/webhooks/${webhookId}`);
+			printMutationOk("Webhook deleted", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	webhook.command("deactivate").description("Deactivate a webhook").argument("<webhook-id>", "Webhook ID").action(async (webhookId) => {
+		const gOpts = program.opts();
+		try {
+			const { client } = await createClient(gOpts.profile);
+			await client.patch(`/webhooks/${webhookId}`, { active: false });
+			printMutationOk("Webhook deactivated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	webhook.command("activate").description("Activate a webhook").argument("<webhook-id>", "Webhook ID").action(async (webhookId) => {
+		const gOpts = program.opts();
+		try {
+			const { client } = await createClient(gOpts.profile);
+			await client.patch(`/webhooks/${webhookId}`, { active: true });
+			printMutationOk("Webhook activated", gOpts.json);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+	webhook.command("deliveries").description("List deliveries for a webhook").argument("<webhook-id>", "Webhook ID").option("--status <status>", "Filter by delivery status").option("--limit <n>", "Maximum number of deliveries").action(async (webhookId, opts) => {
+		const gOpts = program.opts();
+		try {
+			const { client } = await createClient(gOpts.profile);
+			const params = {};
+			if (opts.status) params.status = opts.status;
+			if (opts.limit) params.limit = opts.limit;
+			const data = await client.get(`/webhooks/${webhookId}/deliveries`, params);
+			if (gOpts.json) printJson(data);
+			else printTable((data.items ?? []).map((d) => ({
+				ID: d.id,
+				"Message ID": d.message_id,
+				Status: d.status,
+				Attempts: d.attempts,
+				"Last Error": d.last_error ?? "—",
+				Created: d.created_at
+			})));
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/main.ts
+const { version } = createRequire(import.meta.url)("../package.json");
+const program = new Command("rine").version(version).description("rine.network CLI — messaging infrastructure for AI agents").option("--profile <name>", "credential profile to use", "default").option("--json", "output as JSON").option("--table", "output as table");
+registerAuth(program);
+registerRegister(program);
+registerOrg(program);
+registerAgent(program);
+registerAgentProfile(program);
+registerMessages(program);
+registerDiscover(program);
+registerWebhook(program);
+registerStream(program);
+program.parse();
+//#endregion
+export {};