@semiont/cli 0.4.1 → 0.4.3

package/dist/cli.mjs

@@ -4206,20 +4206,26 @@ var init_zod = __esm({
 });
 
 // src/core/base-options-schema.ts
-function withBaseArgs(commandArgs = {}, commandAliases = {}, positional) {
+function withOpsArgs(commandArgs = {}, commandAliases = {}, positional) {
   return {
-    args: { ...BASE_ARGS, ...commandArgs },
-    aliases: { ...BASE_ALIASES, ...commandAliases },
+    args: { ...BASE_ARGS, ...OPS_ARGS, ...commandArgs },
+    aliases: { ...BASE_ALIASES, ...OPS_ALIASES, ...commandAliases },
     ...positional && { positional }
   };
 }
-var BaseOptionsSchema, CommonExtensions, BASE_ARGS, BASE_ALIASES;
+function withApiArgs(commandArgs = {}, commandAliases = {}, positional) {
+  return {
+    args: { ...BASE_ARGS, ...API_ARGS, ...commandArgs },
+    aliases: { ...BASE_ALIASES, ...API_ALIASES, ...commandAliases },
+    ...positional && { positional }
+  };
+}
+var BaseOptionsSchema, OpsOptionsSchema, ApiOptionsSchema, CommonExtensions, BASE_ARGS, OPS_ARGS, API_ARGS, BASE_ALIASES, OPS_ALIASES, API_ALIASES;
 var init_base_options_schema = __esm({
   "src/core/base-options-schema.ts"() {
     "use strict";
     init_zod();
     BaseOptionsSchema = external_exports.object({
-      environment: external_exports.string().optional(),
       verbose: external_exports.boolean().optional().default(false),
       dryRun: external_exports.boolean().optional().default(false),
       quiet: external_exports.boolean().optional().default(false),
@@ -4227,6 +4233,12 @@ var init_base_options_schema = __esm({
       forceDiscovery: external_exports.boolean().optional().default(false),
       preflight: external_exports.boolean().optional().default(false)
     });
+    OpsOptionsSchema = BaseOptionsSchema.extend({
+      environment: external_exports.string().optional()
+    });
+    ApiOptionsSchema = BaseOptionsSchema.extend({
+      bus: external_exports.string().optional()
+    });
     CommonExtensions = {
       service: external_exports.string().optional(),
       all: external_exports.boolean().optional().default(false),
@@ -4236,11 +4248,6 @@ var init_base_options_schema = __esm({
       registry: external_exports.string().optional()
     };
     BASE_ARGS = {
-      "--environment": {
-        type: "string",
-        description: "Target environment",
-        required: false
-      },
       "--verbose": {
         type: "boolean",
         description: "Verbose output",
@@ -4273,12 +4280,30 @@ var init_base_options_schema = __esm({
         default: false
       }
     };
+    OPS_ARGS = {
+      "--environment": {
+        type: "string",
+        description: "Target environment",
+        required: false
+      }
+    };
+    API_ARGS = {
+      "--bus": {
+        type: "string",
+        description: "Backend URL (e.g. http://localhost:4000). Fallback: $SEMIONT_BUS. Use `semiont login` to authenticate."
+      }
+    };
     BASE_ALIASES = {
-      "-e": "--environment",
       "-v": "--verbose",
       "-q": "--quiet",
       "-o": "--output"
     };
+    OPS_ALIASES = {
+      "-e": "--environment"
+    };
+    API_ALIASES = {
+      "-b": "--bus"
+    };
   }
 });
 
@@ -4410,20 +4435,20 @@ function findPortOwner(port) {
   return null;
 }
 async function checkPortFree(port) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve10) => {
     const server = net.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
         const owner = findPortOwner(port);
         const hint = owner ? ` (${owner})` : "";
-        resolve12({ name: `port-${port}`, pass: false, message: `Port ${port} is in use${hint}` });
+        resolve10({ name: `port-${port}`, pass: false, message: `Port ${port} is in use${hint}` });
       } else {
-        resolve12({ name: `port-${port}`, pass: false, message: `Cannot check port ${port}: ${err.message}` });
+        resolve10({ name: `port-${port}`, pass: false, message: `Cannot check port ${port}: ${err.message}` });
       }
     });
     server.once("listening", () => {
       server.close(() => {
-        resolve12({ name: `port-${port}`, pass: true, message: `Port ${port} is available` });
+        resolve10({ name: `port-${port}`, pass: true, message: `Port ${port} is available` });
       });
     });
     server.listen(port, "127.0.0.1");
@@ -6439,18 +6464,18 @@ var init_state_manager = __esm({
 // src/core/io/network-utils.ts
 import * as net2 from "net";
 async function isPortInUse(port) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve10) => {
     const server = net2.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        resolve12(true);
+        resolve10(true);
       } else {
-        resolve12(false);
+        resolve10(false);
       }
     });
     server.once("listening", () => {
       server.close();
-      resolve12(false);
+      resolve10(false);
     });
     server.listen(port);
   });
@@ -7468,7 +7493,7 @@ var init_database_start = __esm({
             // Use path for data directory
           }
         };
-        await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 2e3));
         return {
           success: true,
           endpoint,
@@ -7690,7 +7715,7 @@ async function startJanusGraph(context) {
   let ready = false;
   const maxAttempts = 30;
   for (let i = 0; i < maxAttempts; i++) {
-    await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+    await new Promise((resolve10) => setTimeout(resolve10, 2e3));
     try {
       const { execFileSync: execFileSync43 } = await import("child_process");
       execFileSync43(gremlinShellScript, ["-e", "g.V().count()"], {
@@ -7957,7 +7982,7 @@ var init_backend_start = __esm({
         appLogStream.end();
         errorLogStream.end();
         proc.unref();
-        await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 2e3));
         try {
           process.kill(proc.pid, 0);
         } catch {
@@ -8193,7 +8218,7 @@ var init_frontend_start = __esm({
         appLogStream.end();
         errorLogStream.end();
         proc.unref();
-        await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 2e3));
         try {
           process.kill(proc.pid, 0);
         } catch {
@@ -8367,7 +8392,7 @@ var init_proxy_start = __esm({
             _ENVOY_PID: pidFile
           }
         });
-        await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 2e3));
         if (!fs18.existsSync(pidFile)) {
           return {
             success: false,
@@ -8478,7 +8503,7 @@ var init_mcp_provision = __esm({
       if (!service.quiet) {
         printInfo("\u{1F510} Setting up MCP authentication...");
       }
-      return new Promise((resolve12, _reject) => {
+      return new Promise((resolve10, _reject) => {
         let timeoutId;
         const connections = /* @__PURE__ */ new Set();
         const server = http.createServer((req, res) => {
@@ -8525,7 +8550,7 @@ var init_mcp_provision = __esm({
                     }
                   }, null, 2));
                 }
-                resolve12({
+                resolve10({
                   success: true,
                   metadata: {
                     serviceType: "mcp",
@@ -8535,7 +8560,7 @@ var init_mcp_provision = __esm({
                   }
                 });
               } else {
-                resolve12({
+                resolve10({
                   success: false,
                   error: "No token received from authentication",
                   metadata: {
@@ -8577,7 +8602,7 @@ var init_mcp_provision = __esm({
         timeoutId = setTimeout(() => {
           connections.forEach((conn) => conn.destroy());
           server.close();
-          resolve12({
+          resolve10({
             success: false,
             error: "Authentication timeout - please try again",
             metadata: {
@@ -9064,18 +9089,18 @@ import * as path20 from "path";
 import { fileURLToPath } from "url";
 function getTemplatesDir(importMetaUrl) {
   const filename = fileURLToPath(importMetaUrl);
-  const dirname15 = path20.dirname(filename);
-  if (dirname15.includes(path20.sep + "src" + path20.sep)) {
-    let dir = dirname15;
+  const dirname16 = path20.dirname(filename);
+  if (dirname16.includes(path20.sep + "src" + path20.sep)) {
+    let dir = dirname16;
     while (dir !== path20.dirname(dir)) {
       if (path20.basename(dir) === "src") {
         return path20.join(path20.dirname(dir), "templates");
       }
       dir = path20.dirname(dir);
     }
-    throw new Error(`Cannot locate templates directory from source path: ${dirname15}`);
+    throw new Error(`Cannot locate templates directory from source path: ${dirname16}`);
   }
-  return path20.join(dirname15, "templates");
+  return path20.join(dirname16, "templates");
 }
 var init_cli_paths = __esm({
   "src/core/io/cli-paths.ts"() {
@@ -9257,7 +9282,7 @@ async function stopJanusGraph(context) {
       const startTime = Date.now();
       let processRunning = true;
       while (processRunning && Date.now() - startTime < timeout) {
-        await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 1e3));
         try {
           process.kill(pid, 0);
         } catch {
@@ -9360,14 +9385,14 @@ async function killProcessGroupAndRelated(pid, serviceType, verbose = false) {
     }
     process.kill(-pid, "SIGTERM");
     killed = true;
-    await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+    await new Promise((resolve10) => setTimeout(resolve10, 2e3));
     try {
       process.kill(pid, 0);
       if (verbose) {
         printWarning(`Process group didn't terminate gracefully, force killing...`);
       }
       process.kill(-pid, "SIGKILL");
-      await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+      await new Promise((resolve10) => setTimeout(resolve10, 1e3));
     } catch {
     }
   } catch (error) {
@@ -9376,7 +9401,7 @@ async function killProcessGroupAndRelated(pid, serviceType, verbose = false) {
     }
     try {
       process.kill(pid, "SIGTERM");
-      await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+      await new Promise((resolve10) => setTimeout(resolve10, 2e3));
       try {
         process.kill(pid, 0);
         process.kill(pid, "SIGKILL");
@@ -10043,7 +10068,7 @@ var init_inference_start = __esm({
       const maxAttempts = 15;
       let ready = false;
       for (let i = 0; i < maxAttempts; i++) {
-        await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 1e3));
         if (await isOllamaRunning(port)) {
           ready = true;
           break;
@@ -10159,7 +10184,7 @@ var init_inference_stop = __esm({
       const startTime = Date.now();
       let processRunning = true;
       while (processRunning && Date.now() - startTime < timeout) {
-        await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 1e3));
         try {
           process.kill(pid, 0);
         } catch {
@@ -11226,7 +11251,7 @@ async function waitForContainer(runtime, containerName) {
       }
     } catch {
     }
-    await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+    await new Promise((resolve10) => setTimeout(resolve10, 1e3));
     attempts++;
   }
   throw new Error(`Container ${containerName} failed to start within ${maxAttempts} seconds`);
@@ -11336,7 +11361,7 @@ import { execFileSync as execFileSync19 } from "child_process";
 async function waitForDatabase(runtime, containerName, image, quiet, dbUser, verbose) {
   const maxAttempts = 15;
   let attempts = 0;
-  await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+  await new Promise((resolve10) => setTimeout(resolve10, 2e3));
   const skipHealthCheck = process.env.SKIP_DB_HEALTH_CHECK === "true";
   if (skipHealthCheck) {
     try {
@@ -11346,7 +11371,7 @@ async function waitForDatabase(runtime, containerName, image, quiet, dbUser, ver
         { encoding: "utf-8", timeout: 5e3 }
       ).trim();
       if (status === "running") {
-        await new Promise((resolve12) => setTimeout(resolve12, 3e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 3e3));
         return;
       }
     } catch {
@@ -11379,7 +11404,7 @@ async function waitForDatabase(runtime, containerName, image, quiet, dbUser, ver
               stdio: verbose ? "inherit" : "ignore",
               timeout: 5e3
             });
-            await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+            await new Promise((resolve10) => setTimeout(resolve10, 1e3));
             if (verbose) {
               printInfo(`PostgreSQL is ready`);
             }
@@ -11408,7 +11433,7 @@ async function waitForDatabase(runtime, containerName, image, quiet, dbUser, ver
           } catch {
           }
         } else {
-          await new Promise((resolve12) => setTimeout(resolve12, 3e3));
+          await new Promise((resolve10) => setTimeout(resolve10, 3e3));
           return;
         }
       }
@@ -11417,7 +11442,7 @@ async function waitForDatabase(runtime, containerName, image, quiet, dbUser, ver
         printInfo(`Waiting for database to be ready... (${attempts + 1}/${maxAttempts})`);
       }
     }
-    await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+    await new Promise((resolve10) => setTimeout(resolve10, 1e3));
     attempts++;
   }
   printWarning(`Database container ${containerName} is taking longer than expected to start`);
@@ -11598,14 +11623,14 @@ async function startJanusGraph2(context) {
             { encoding: "utf-8", stdio: "pipe" }
           );
           if (logs.includes("Channel started") || logs.includes("Started") || i >= 5) {
-            await new Promise((resolve12) => setTimeout(resolve12, 3e3));
+            await new Promise((resolve10) => setTimeout(resolve10, 3e3));
             ready = true;
             break;
           }
         }
       } catch {
       }
-      await new Promise((resolve12) => setTimeout(resolve12, 3e3));
+      await new Promise((resolve10) => setTimeout(resolve10, 3e3));
       if (!service.quiet && i > 0 && i % 5 === 0) {
         printInfo(`Still waiting... (${i * 3}s elapsed)`);
       }
@@ -11817,7 +11842,7 @@ var init_database_provision = __esm({
                 break;
               }
             } catch {
-              await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+              await new Promise((resolve10) => setTimeout(resolve10, 1e3));
               attempts++;
             }
           }
@@ -14967,7 +14992,7 @@ var init_database_stop = __esm({
             if (currentStatus === "exited" || currentStatus === "stopped") {
               stopped = true;
             } else {
-              await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+              await new Promise((resolve10) => setTimeout(resolve10, 1e3));
               attempts++;
             }
           } catch {
@@ -15341,7 +15366,7 @@ var init_proxy_start2 = __esm({
         if (!service.quiet) {
           printInfo("Waiting for proxy to become healthy...");
         }
-        await new Promise((resolve12) => setTimeout(resolve12, 2e3));
+        await new Promise((resolve10) => setTimeout(resolve10, 2e3));
         const isRunning = execFileSync26(runtime, ["ps", "-q", "-f", `id=${containerId}`], { encoding: "utf-8" }).trim();
         if (!isRunning) {
           const logs = execFileSync26(runtime, ["logs", containerId], { encoding: "utf-8" });
@@ -15942,7 +15967,7 @@ var init_inference_start2 = __esm({
         let ready = false;
         const maxAttempts = 15;
         for (let i = 0; i < maxAttempts; i++) {
-          await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+          await new Promise((resolve10) => setTimeout(resolve10, 1e3));
           try {
             const status = execFileSync30(
               runtime,
@@ -18310,7 +18335,7 @@ Waiting for ${otherActiveDeployments.length} old deployment(s) to complete drain
       if (taskDetails.new.running > 0) {
         consecutiveFailures = 0;
       }
-      await new Promise((resolve12) => setTimeout(resolve12, checkInterval));
+      await new Promise((resolve10) => setTimeout(resolve10, checkInterval));
     } catch (error) {
       if (error instanceof Error && error.message.includes("Deployment")) {
         if (!verbose) {
@@ -19056,20 +19081,20 @@ var init_database_check3 = __esm({
         const host = serviceConfig.host;
         const port = serviceConfig.port;
         try {
-          const isReachable = await new Promise((resolve12) => {
+          const isReachable = await new Promise((resolve10) => {
             const socket = new net3.Socket();
             socket.setTimeout(5e3);
             socket.once("connect", () => {
               socket.destroy();
-              resolve12(true);
+              resolve10(true);
             });
             socket.once("error", () => {
               socket.destroy();
-              resolve12(false);
+              resolve10(false);
             });
             socket.once("timeout", () => {
               socket.destroy();
-              resolve12(false);
+              resolve10(false);
             });
             socket.connect(port, host);
           });
@@ -19139,20 +19164,20 @@ var init_database_check3 = __esm({
         const host = serviceConfig.host;
         const port = serviceConfig.port;
         try {
-          const isReachable = await new Promise((resolve12) => {
+          const isReachable = await new Promise((resolve10) => {
             const socket = new net3.Socket();
             socket.setTimeout(5e3);
             socket.once("connect", () => {
               socket.destroy();
-              resolve12(true);
+              resolve10(true);
             });
             socket.once("error", () => {
               socket.destroy();
-              resolve12(false);
+              resolve10(false);
             });
             socket.once("timeout", () => {
               socket.destroy();
-              resolve12(false);
+              resolve10(false);
             });
             socket.connect(port, host);
           });
@@ -19626,7 +19651,7 @@ var init_values = __esm({
 var sleep;
 var init_sleep = __esm({
   "node_modules/@anthropic-ai/sdk/internal/utils/sleep.mjs"() {
-    sleep = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
+    sleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
   }
 });
 
@@ -20380,8 +20405,8 @@ var init_api_promise = __esm({
     init_parse();
     APIPromise = class _APIPromise extends Promise {
       constructor(client, responsePromise, parseResponse = defaultParseResponse) {
-        super((resolve12) => {
-          resolve12(null);
+        super((resolve10) => {
+          resolve10(null);
         });
         this.responsePromise = responsePromise;
         this.parseResponse = parseResponse;
@@ -21577,12 +21602,12 @@ var init_BetaMessageStream = __esm({
           }
           return this._emit("error", new AnthropicError(String(error)));
         });
-        __classPrivateFieldSet(this, _BetaMessageStream_connectedPromise, new Promise((resolve12, reject) => {
-          __classPrivateFieldSet(this, _BetaMessageStream_resolveConnectedPromise, resolve12, "f");
+        __classPrivateFieldSet(this, _BetaMessageStream_connectedPromise, new Promise((resolve10, reject) => {
+          __classPrivateFieldSet(this, _BetaMessageStream_resolveConnectedPromise, resolve10, "f");
           __classPrivateFieldSet(this, _BetaMessageStream_rejectConnectedPromise, reject, "f");
         }), "f");
-        __classPrivateFieldSet(this, _BetaMessageStream_endPromise, new Promise((resolve12, reject) => {
-          __classPrivateFieldSet(this, _BetaMessageStream_resolveEndPromise, resolve12, "f");
+        __classPrivateFieldSet(this, _BetaMessageStream_endPromise, new Promise((resolve10, reject) => {
+          __classPrivateFieldSet(this, _BetaMessageStream_resolveEndPromise, resolve10, "f");
           __classPrivateFieldSet(this, _BetaMessageStream_rejectEndPromise, reject, "f");
         }), "f");
         __classPrivateFieldGet(this, _BetaMessageStream_connectedPromise, "f").catch(() => {
@@ -21748,11 +21773,11 @@ var init_BetaMessageStream = __esm({
        *   const message = await stream.emitted('message') // rejects if the stream errors
        */
       emitted(event) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve10, reject) => {
           __classPrivateFieldSet(this, _BetaMessageStream_catchingPromiseCreated, true, "f");
           if (event !== "error")
             this.once("error", reject);
-          this.once(event, resolve12);
+          this.once(event, resolve10);
         });
       }
       async done() {
@@ -22075,7 +22100,7 @@ var init_BetaMessageStream = __esm({
               if (done) {
                 return { value: void 0, done: true };
               }
-              return new Promise((resolve12, reject) => readQueue.push({ resolve: resolve12, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+              return new Promise((resolve10, reject) => readQueue.push({ resolve: resolve10, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
             }
             const chunk = pushQueue.shift();
             return { value: chunk, done: false };
@@ -22113,13 +22138,13 @@ var init_constants = __esm({
 
 // node_modules/@anthropic-ai/sdk/lib/tools/BetaToolRunner.mjs
 function promiseWithResolvers() {
-  let resolve12;
+  let resolve10;
   let reject;
   const promise = new Promise((res, rej) => {
-    resolve12 = res;
+    resolve10 = res;
     reject = rej;
   });
-  return { promise, resolve: resolve12, reject };
+  return { promise, resolve: resolve10, reject };
 }
 async function generateToolResponse(params, lastMessage = params.messages.at(-1)) {
   if (!lastMessage || lastMessage.role !== "assistant" || !lastMessage.content || typeof lastMessage.content === "string") {
@@ -22573,12 +22598,12 @@ var init_MessageStream = __esm({
           }
           return this._emit("error", new AnthropicError(String(error)));
         });
-        __classPrivateFieldSet(this, _MessageStream_connectedPromise, new Promise((resolve12, reject) => {
-          __classPrivateFieldSet(this, _MessageStream_resolveConnectedPromise, resolve12, "f");
+        __classPrivateFieldSet(this, _MessageStream_connectedPromise, new Promise((resolve10, reject) => {
+          __classPrivateFieldSet(this, _MessageStream_resolveConnectedPromise, resolve10, "f");
           __classPrivateFieldSet(this, _MessageStream_rejectConnectedPromise, reject, "f");
         }), "f");
-        __classPrivateFieldSet(this, _MessageStream_endPromise, new Promise((resolve12, reject) => {
-          __classPrivateFieldSet(this, _MessageStream_resolveEndPromise, resolve12, "f");
+        __classPrivateFieldSet(this, _MessageStream_endPromise, new Promise((resolve10, reject) => {
+          __classPrivateFieldSet(this, _MessageStream_resolveEndPromise, resolve10, "f");
           __classPrivateFieldSet(this, _MessageStream_rejectEndPromise, reject, "f");
         }), "f");
         __classPrivateFieldGet(this, _MessageStream_connectedPromise, "f").catch(() => {
@@ -22744,11 +22769,11 @@ var init_MessageStream = __esm({
        *   const message = await stream.emitted('message') // rejects if the stream errors
        */
       emitted(event) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve10, reject) => {
           __classPrivateFieldSet(this, _MessageStream_catchingPromiseCreated, true, "f");
           if (event !== "error")
             this.once("error", reject);
-          this.once(event, resolve12);
+          this.once(event, resolve10);
         });
       }
       async done() {
@@ -23065,7 +23090,7 @@ var init_MessageStream = __esm({
               if (done) {
                 return { value: void 0, done: true };
               }
-              return new Promise((resolve12, reject) => readQueue.push({ resolve: resolve12, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+              return new Promise((resolve10, reject) => readQueue.push({ resolve: resolve10, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
             }
             const chunk = pushQueue.shift();
             return { value: chunk, done: false };
@@ -24272,7 +24297,7 @@ var init_default_start = __esm({
         printInfo(`[MOCK] Starting service: ${service.name}`);
       }
       const startupDelay = mockData?.startupDelay || 100;
-      await new Promise((resolve12) => setTimeout(resolve12, startupDelay));
+      await new Promise((resolve10) => setTimeout(resolve10, startupDelay));
       if (mockData?.simulateFailure) {
         return {
           success: false,
@@ -25815,7 +25840,7 @@ var init_check = __esm({
     init_multi_service_executor();
     init_command_definition();
     init_base_options_schema();
-    CheckOptionsSchema = BaseOptionsSchema.extend({
+    CheckOptionsSchema = OpsOptionsSchema.extend({
       service: external_exports.string().optional(),
       all: external_exports.boolean().default(false),
       deep: external_exports.boolean().default(true),
@@ -26225,7 +26250,7 @@ var init_dashboard_data = __esm({
         }
       }
       fetchBackendHealth(port) {
-        return new Promise((resolve12, reject) => {
+        return new Promise((resolve10, reject) => {
           const req = http2.get(`http://localhost:${port}/api/health`, { timeout: 2e3 }, (res) => {
             let body = "";
             res.on("data", (chunk) => {
@@ -26233,7 +26258,7 @@ var init_dashboard_data = __esm({
             });
             res.on("end", () => {
               try {
-                resolve12(JSON.parse(body));
+                resolve10(JSON.parse(body));
               } catch {
                 reject(new Error("Invalid JSON"));
               }
@@ -26678,7 +26703,7 @@ var init_web_dashboard_server = __esm({
         this.actorsInterval = null;
       }
       async start() {
-        return new Promise((resolve12) => {
+        return new Promise((resolve10) => {
           this.server.listen(this.port, () => {
             console.log(`
 \u{1F310} Web dashboard running at http://localhost:${this.port}`);
@@ -26687,7 +26712,7 @@ var init_web_dashboard_server = __esm({
             console.log(`
 Press Ctrl+C to stop
 `);
-            resolve12();
+            resolve10();
           });
         });
       }
@@ -27020,7 +27045,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@semiont/cli",
-      version: "0.4.1",
+      version: "0.4.3",
       description: "Semiont CLI - Unified environment management tool",
       _comment: "AWS SDK dependencies (@aws-sdk/*) are only used by platforms/aws",
       type: "module",
@@ -27084,13 +27109,12 @@ var require_package = __commonJS({
         "@aws-sdk/client-secrets-manager": "^3.600.0",
         "@aws-sdk/client-sts": "^3.859.0",
         "@aws-sdk/client-wafv2": "^3.859.0",
-        "@semiont/api-client": "^0.4.1",
-        "@semiont/content": "^0.4.1",
-        "@semiont/core": "^0.4.1",
-        "@semiont/event-sourcing": "^0.4.1",
-        "@semiont/graph": "^0.4.1",
-        "@semiont/make-meaning": "^0.4.1",
-        "@vitest/ui": "4.0.18",
+        "@semiont/api-client": "^0.4.3",
+        "@semiont/content": "^0.4.3",
+        "@semiont/core": "^0.4.3",
+        "@semiont/event-sourcing": "^0.4.3",
+        "@semiont/graph": "^0.4.3",
+        "@semiont/make-meaning": "^0.4.3",
         arg: "^5.0.2",
         argon2: "^0.44.0",
         express: "^5.2.1",
@@ -27109,8 +27133,7 @@ var require_package = __commonJS({
         "@types/react": "^19.2.14",
         "@vitest/coverage-v8": "^4.1.0",
         chalk: "^5.3.0",
-        typescript: "^5.9.2",
-        vitest: "^4.0.18"
+        typescript: "^5.9.2"
       },
       overrides: {
         esbuild: "0.27.2"
@@ -27144,17 +27167,15 @@ var InitOptionsSchema = BaseOptionsSchema.extend({
   environments: external_exports.array(external_exports.string()).default(["local", "test", "staging", "production"])
 }).transform((data) => ({
   ...data,
-  environment: data.environment || "_init_",
-  // Dummy value - init doesn't use environment
   output: data.output === "table" ? "summary" : data.output
   // Init doesn't support table output
 }));
 function prompt(question) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve10) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(question, (answer) => {
       rl.close();
-      resolve12(answer.trim());
+      resolve10(answer.trim());
     });
   });
 }
@@ -27329,7 +27350,7 @@ async function init(options) {
         console.log(`${colors.yellow}\u2139 --no-git: git init will be skipped${colors.reset}`);
         console.log(`${colors.yellow}\u2139 --no-git: git.sync will be set to false in .semiont/config${colors.reset}`);
         console.log(`${colors.yellow}\u2139 --no-git: .semiont/config will NOT be staged (git add skipped)${colors.reset}`);
-        console.log(`${colors.yellow}\u2139 --no-git: semiont yield/mv/archive will not stage files in the git index${colors.reset}`);
+        console.log(`${colors.yellow}\u2139 --no-git: semiont yield/mv will not stage files in the git index${colors.reset}`);
       }
       const dotSemiontConfigPath = path2.join(dotSemiontDir, "config");
       if (!fs2.existsSync(dotSemiontDir) || options.force) {
@@ -27386,7 +27407,7 @@ Next steps:`);
   results.duration = Date.now() - startTime;
   return results;
 }
-var initCommand = new CommandBuilder().name("init").description("Initialize a new Semiont project").schema(InitOptionsSchema).args(withBaseArgs({
+var initCommand = new CommandBuilder().name("init").description("Initialize a new Semiont project").schema(InitOptionsSchema).args(withOpsArgs({
   "--name": {
     type: "string",
     description: "Project name"
@@ -27427,7 +27448,7 @@ init_command_descriptor();
 init_multi_service_executor();
 init_command_definition();
 init_base_options_schema();
-var StartOptionsSchema = BaseOptionsSchema.extend({
+var StartOptionsSchema = OpsOptionsSchema.extend({
   service: external_exports.string().optional()
 });
 var startDescriptor = createCommandDescriptor({
@@ -27498,7 +27519,7 @@ init_command_descriptor();
 init_multi_service_executor();
 init_command_definition();
 init_base_options_schema();
-var StopOptionsSchema = BaseOptionsSchema.extend({
+var StopOptionsSchema = OpsOptionsSchema.extend({
   service: external_exports.string().optional(),
   force: external_exports.boolean().default(false).describe("Force stop without graceful shutdown"),
   timeout: external_exports.number().default(30).describe("Timeout for graceful shutdown in seconds")
@@ -27588,7 +27609,7 @@ init_command_descriptor();
 init_multi_service_executor();
 init_command_definition();
 init_base_options_schema();
-var ProvisionOptionsSchema = BaseOptionsSchema.extend({
+var ProvisionOptionsSchema = OpsOptionsSchema.extend({
   service: external_exports.string().optional(),
   all: external_exports.boolean().default(false),
   stack: external_exports.enum(["data", "app", "all"]).optional(),
@@ -27722,7 +27743,7 @@ init_command_descriptor();
 init_multi_service_executor();
 init_command_definition();
 init_base_options_schema();
-var PublishOptionsSchema = BaseOptionsSchema.extend({
+var PublishOptionsSchema = OpsOptionsSchema.extend({
   service: external_exports.string().optional(),
   all: external_exports.boolean().default(false),
   tag: external_exports.string().optional(),
@@ -27822,7 +27843,7 @@ init_command_descriptor();
 init_multi_service_executor();
 init_command_definition();
 init_base_options_schema();
-var UpdateOptionsSchema = BaseOptionsSchema.extend({
+var UpdateOptionsSchema = OpsOptionsSchema.extend({
   service: external_exports.string().optional(),
   force: external_exports.boolean().default(false),
   wait: external_exports.boolean().default(false),
@@ -27948,7 +27969,7 @@ init_platform3();
 init_platform2();
 init_cli_colors();
 init_dashboard_data();
-var WatchOptionsSchema = BaseOptionsSchema.extend({
+var WatchOptionsSchema = OpsOptionsSchema.extend({
   target: external_exports.enum(["all", "logs", "metrics", "services"]).default("all"),
   noFollow: external_exports.boolean().default(false),
   interval: external_exports.number().int().positive().default(30),
@@ -27957,9 +27978,9 @@ var WatchOptionsSchema = BaseOptionsSchema.extend({
 });
 async function launchDashboard(environment, serviceDeployments, envConfig, interval, port) {
   const startTime = Date.now();
-  return new Promise(async (resolve12) => {
+  return new Promise(async (resolve10) => {
     if (process.env.VITEST) {
-      setTimeout(() => resolve12({ duration: 100, exitReason: "user-quit" }), 100);
+      setTimeout(() => resolve10({ duration: 100, exitReason: "user-quit" }), 100);
       return;
     }
     try {
@@ -27977,13 +27998,13 @@ async function launchDashboard(environment, serviceDeployments, envConfig, inter
       await server.start();
       const stop2 = () => {
         server.stop();
-        resolve12({ duration: Date.now() - startTime, exitReason: "user-quit" });
+        resolve10({ duration: Date.now() - startTime, exitReason: "user-quit" });
       };
       process.on("SIGINT", stop2);
       process.on("SIGTERM", stop2);
     } catch (error) {
       console.error("Dashboard error:", error);
-      resolve12({ duration: Date.now() - startTime, exitReason: "error" });
+      resolve10({ duration: Date.now() - startTime, exitReason: "error" });
     }
   });
 }
@@ -28098,7 +28119,7 @@ ${colors.bright}To fix this issue:${colors.reset}`);
     executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun }
   };
 }
-var watchCommand = new CommandBuilder().name("watch").description("Monitor services using new architecture").schema(WatchOptionsSchema).requiresEnvironment(true).requiresServices(true).args(withBaseArgs({
+var watchCommand = new CommandBuilder().name("watch").description("Monitor services using new architecture").schema(WatchOptionsSchema).requiresEnvironment(true).requiresServices(true).args(withOpsArgs({
   "--service": { type: "string", description: 'Service name or "all" for all services' },
   "--target": { type: "string", description: "What to watch (all, logs, metrics, services)" },
   "--no-follow": { type: "boolean", description: "Do not follow new logs" },
@@ -28146,7 +28167,7 @@ function loadPrismaClient(projectRoot) {
     );
   }
 }
-var UseraddOptionsSchema = BaseOptionsSchema.extend({
+var UseraddOptionsSchema = OpsOptionsSchema.extend({
   email: external_exports.string().email().min(1, "Email is required"),
   name: external_exports.string().optional(),
   password: external_exports.string().optional(),
@@ -28154,7 +28175,8 @@ var UseraddOptionsSchema = BaseOptionsSchema.extend({
   admin: external_exports.boolean().default(false),
   moderator: external_exports.boolean().default(false),
   inactive: external_exports.boolean().default(false),
-  update: external_exports.boolean().default(false)
+  update: external_exports.boolean().default(false),
+  upsert: external_exports.boolean().default(false)
 });
 function validateEmail(email) {
   const emailRegex2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -28225,8 +28247,23 @@ async function useradd(options) {
     }
     let user;
     if (existingUser) {
+      if (options.upsert) {
+        if (!options.quiet) {
+          printSuccess(`User already exists: ${options.email}`);
+        }
+        await prisma.$disconnect();
+        return {
+          command: "useradd",
+          environment: options.environment,
+          timestamp: /* @__PURE__ */ new Date(),
+          summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+          executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+          results: [{ entity: options.email, platform: "posix", success: true, metadata: { userId: existingUser.id, email: existingUser.email, isAdmin: existingUser.isAdmin, isModerator: existingUser.isModerator, isActive: existingUser.isActive }, duration: Date.now() - startTime }],
+          duration: Date.now() - startTime
+        };
+      }
       if (!options.update) {
-        throw new Error(`User ${options.email} already exists. Use --update to modify.`);
+        throw new Error(`User ${options.email} already exists. Use --update to modify or --upsert to skip silently.`);
       }
       if (!options.quiet) {
         printInfo(`Updating user: ${options.email}`);
@@ -28355,6 +28392,11 @@ var useraddCommand = new CommandBuilder().name("useradd").description("Create or
       type: "boolean",
       description: "Update existing user",
       default: false
+    },
+    "--upsert": {
+      type: "boolean",
+      description: "Create user if absent, skip silently if already exists",
+      default: false
     }
   },
   aliases: {
@@ -28386,7 +28428,7 @@ function createCliLogger(verbose) {
     child: () => createCliLogger(verbose)
   };
 }
-var BackupOptionsSchema = BaseOptionsSchema.extend({
+var BackupOptionsSchema = OpsOptionsSchema.extend({
   out: external_exports.string().min(1, "Output path is required")
 });
 async function runBackup(options) {
@@ -28513,7 +28555,7 @@ function createNoopGraphDatabase() {
     clearDatabase: noop2
   };
 }
-var RestoreOptionsSchema = BaseOptionsSchema.extend({
+var RestoreOptionsSchema = OpsOptionsSchema.extend({
   file: external_exports.string().min(1, "Input file path is required")
 });
 async function runRestore(options) {
@@ -28592,11 +28634,11 @@ import { isBackupManifest, validateManifestVersion, BACKUP_FORMAT } from "@semio
 import { createGunzip } from "node:zlib";
 var BLOCK_SIZE = 512;
 async function readTarGzEntries(input) {
-  const decompressed = await new Promise((resolve12, reject) => {
+  const decompressed = await new Promise((resolve10, reject) => {
     const gunzip = createGunzip();
     const chunks = [];
     gunzip.on("data", (chunk) => chunks.push(chunk));
-    gunzip.on("end", () => resolve12(Buffer.concat(chunks)));
+    gunzip.on("end", () => resolve10(Buffer.concat(chunks)));
     gunzip.on("error", reject);
     input.on("error", reject);
     input.pipe(gunzip);
@@ -28619,7 +28661,7 @@ async function readTarGzEntries(input) {
   }
   return entries;
 }
-var VerifyOptionsSchema = BaseOptionsSchema.extend({
+var VerifyOptionsSchema = OpsOptionsSchema.extend({
   file: external_exports.string().min(1, "File path is required")
 });
 async function runVerify(options) {
@@ -28778,7 +28820,7 @@ function createCliLogger3(verbose) {
     child: () => createCliLogger3(verbose)
   };
 }
-var ExportOptionsSchema = BaseOptionsSchema.extend({
+var ExportOptionsSchema = OpsOptionsSchema.extend({
   out: external_exports.string().min(1, "Output path is required"),
   includeArchived: external_exports.boolean().optional().default(false)
 });
@@ -28921,7 +28963,7 @@ function createNoopGraphDatabase2() {
     clearDatabase: noop2
   };
 }
-var ImportOptionsSchema = BaseOptionsSchema.extend({
+var ImportOptionsSchema = OpsOptionsSchema.extend({
   file: external_exports.string().min(1, "Input file path is required"),
   userId: external_exports.string().optional()
 });
@@ -29006,7 +29048,7 @@ import * as fs49 from "fs";
 import * as path42 from "path";
 import * as readline2 from "readline";
 import { execFileSync as execFileSync41 } from "child_process";
-var LocalOptionsSchema = BaseOptionsSchema.extend({
+var LocalOptionsSchema = OpsOptionsSchema.extend({
   directory: external_exports.string().optional(),
   yes: external_exports.boolean().default(false)
 }).transform((data) => ({
@@ -29014,11 +29056,11 @@ var LocalOptionsSchema = BaseOptionsSchema.extend({
   environment: data.environment || "_local_"
 }));
 function prompt2(question) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve10) => {
     const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(question, (answer) => {
       rl.close();
-      resolve12(answer.trim());
+      resolve10(answer.trim());
     });
   });
 }
@@ -29121,6 +29163,7 @@ Press Enter to create one in ${colors.bright}${defaultPath}${colors.reset}, or t
       semiotRoot = answer || defaultPath;
       fs49.mkdirSync(semiotRoot, { recursive: true });
       process.env.SEMIONT_ROOT = semiotRoot;
+      envVarsToAdvise.push(`export SEMIONT_ROOT=${semiotRoot}`);
       console.log(`${colors.green}\u2713${colors.reset} Using ${semiotRoot}
 `);
       if (semiotRoot !== process.cwd()) {
@@ -29144,6 +29187,7 @@ Press Enter to create one in ${colors.bright}${defaultPath}${colors.reset}, or t
 `);
     }
     const env = { ...process.env };
+    await ensureGlobalConfig(false);
     const isInitialized = fs49.existsSync(path42.join(semiotRoot, ".semiont"));
     if (isInitialized) {
       console.log(`${colors.green}\u2713${colors.reset} Project already initialized
@@ -29154,8 +29198,10 @@ Press Enter to create one in ${colors.bright}${defaultPath}${colors.reset}, or t
         runSemiont(["init"], env);
         console.log(`${colors.green}\u2713${colors.reset} Project initialized
 `);
-      } catch {
+      } catch (err) {
+        const initMsg = err instanceof Error ? err.message : String(err);
         console.error(`${colors.red}\u2717 semiont init failed \u2014 cannot continue${colors.reset}`);
+        console.error(`  ${initMsg}`);
         results.summary.failed = 1;
         results.duration = Date.now() - startTime;
         return results;
@@ -29227,11 +29273,11 @@ Press Enter to create one in ${colors.bright}${defaultPath}${colors.reset}, or t
     const adminPassword = "password";
     console.log(`${colors.cyan}\u25B6 Creating admin user...${colors.reset}`);
     const useraddResult = runSemiontSafe(
-      ["useradd", "--email", adminEmail, "--password", adminPassword, "--admin"],
+      ["useradd", "--email", adminEmail, "--password", adminPassword, "--admin", "--upsert"],
       env
     );
     if (useraddResult.success) {
-      console.log(`${colors.green}\u2713${colors.reset} Admin user created
+      console.log(`${colors.green}\u2713${colors.reset} Admin user ready
 `);
     } else {
       console.log(`${colors.yellow}\u26A0 useradd failed: ${useraddResult.error}${colors.reset}`);
@@ -29273,7 +29319,7 @@ ${colors.red}\u2717 Setup failed: ${msg}${colors.reset}`);
   results.duration = Date.now() - startTime;
   return results;
 }
-var localCommand = new CommandBuilder().name("local").description("Set up and start Semiont locally (init + provision + start + useradd)").schema(LocalOptionsSchema).args(withBaseArgs({
+var localCommand = new CommandBuilder().name("local").description("Set up and start Semiont locally (init + provision + start + useradd)").schema(LocalOptionsSchema).args(withOpsArgs({
   "--directory": {
     type: "string",
     description: "Project directory (default: cwd)"
@@ -29284,7 +29330,7 @@ var localCommand = new CommandBuilder().name("local").description("Set up and st
     default: false
   }
 }, {
-  "--yes": "-y"
+  "-y": "--yes"
 })).requiresEnvironment(false).requiresServices(false).examples(
   "semiont local",
   "semiont local --yes",
@@ -29300,7 +29346,7 @@ import * as fs50 from "fs";
 import * as readline3 from "readline";
 import { execFileSync as execFileSync42 } from "child_process";
 import { SemiontProject as SemiontProject20 } from "@semiont/core/node";
-var CleanOptionsSchema = BaseOptionsSchema.extend({
+var CleanOptionsSchema = OpsOptionsSchema.extend({
   force: external_exports.boolean().default(false),
   logs: external_exports.boolean().default(false),
   pids: external_exports.boolean().default(false),
@@ -29312,11 +29358,11 @@ var CleanOptionsSchema = BaseOptionsSchema.extend({
   output: data.output === "table" ? "summary" : data.output
 }));
 function confirm(question) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve10) => {
     const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve12(answer.trim().toLowerCase() === "y");
+      resolve10(answer.trim().toLowerCase() === "y");
     });
   });
 }
@@ -29546,7 +29592,7 @@ ${colors.bright}Semiont clean \u2014 project: ${project.name}${colors.reset}
   results.duration = Date.now() - startTime;
   return results;
 }
-var cleanCommand = new CommandBuilder().name("clean").description("Remove ephemeral files (logs, PID files, generated config, Docker volumes)").schema(CleanOptionsSchema).args(withBaseArgs({
+var cleanCommand = new CommandBuilder().name("clean").description("Remove ephemeral files (logs, PID files, generated config, Docker volumes)").schema(CleanOptionsSchema).args(withOpsArgs({
   "--force": {
     type: "boolean",
     description: "Skip confirmation prompts",
@@ -29646,7 +29692,7 @@ function createNoopGraphDatabase3() {
     clearDatabase: noop2
   };
 }
-var MvOptionsSchema = BaseOptionsSchema.extend({
+var MvOptionsSchema = OpsOptionsSchema.extend({
   from: external_exports.string().min(1, "Source path is required"),
   to: external_exports.string().min(1, "Destination path is required"),
   noGit: external_exports.boolean().default(false)
@@ -29676,10 +29722,10 @@ async function runMv(options) {
   const stower = new Stower3(kb, eventBus, logger.child({ component: "stower" }));
   await stower.initialize();
   try {
-    const movedPromise = new Promise((resolve12, reject) => {
+    const movedPromise = new Promise((resolve10, reject) => {
       const sub = eventBus.get("yield:moved").subscribe(() => {
         sub.unsubscribe();
-        resolve12();
+        resolve10();
       });
       eventBus.get("yield:move-failed").subscribe((e) => {
         reject(new Error(e.error?.message ?? "Move failed"));
@@ -29739,74 +29785,83 @@ init_command_definition();
 init_base_options_schema();
 init_cli_logger();
 init_config_loader();
-init_preflight_utils();
-import * as path43 from "path";
+import * as path44 from "path";
 import { promises as nodeFs } from "fs";
-import { createHash } from "crypto";
-import { SemiontProject as SemiontProject22 } from "@semiont/core/node";
-import { EventBus as EventBus4, resourceId as toResourceId } from "@semiont/core";
-import { createEventStore as createEventStore6 } from "@semiont/event-sourcing";
-import { resolveStorageUri, ResourceNotFoundError } from "@semiont/event-sourcing";
-import { Stower as Stower4, createKnowledgeBase as createKnowledgeBase4 } from "@semiont/make-meaning";
-function createCliLogger6(verbose) {
-  return {
-    debug: (msg, meta) => {
-      if (verbose) console.log(`[debug] ${msg}`, meta ?? "");
-    },
-    info: (msg, meta) => console.log(`[info] ${msg}`, meta ?? ""),
-    warn: (msg, meta) => console.warn(`[warn] ${msg}`, meta ?? ""),
-    error: (msg, meta) => console.error(`[error] ${msg}`, meta ?? ""),
-    child: () => createCliLogger6(verbose)
-  };
+import { resourceId as toResourceId, annotationId as toAnnotationId, EventBus as EventBus4 } from "@semiont/core";
+
+// src/core/api-client-factory.ts
+import * as fs51 from "fs";
+import * as path43 from "path";
+import * as os5 from "os";
+import { SemiontApiClient as SemiontApiClient3 } from "@semiont/api-client";
+import {
+  email as toEmail,
+  accessToken as toAccessToken,
+  baseUrl as toBaseUrl
+} from "@semiont/core";
+var TOKEN_CACHE_TTL_MS = 864e5;
+function authStoreDir() {
+  const xdgState = process.env.XDG_STATE_HOME ?? path43.join(os5.homedir(), ".local", "state");
+  return path43.join(xdgState, "semiont", "auth");
+}
+function busSlug(rawUrl) {
+  return rawUrl.replace(/^https?:\/\//, "").replace(/\/+$/, "").replace(/[:/]/g, "-").toLowerCase();
+}
+function tokenCachePath(rawBusUrl) {
+  return path43.join(authStoreDir(), `${busSlug(rawBusUrl)}.json`);
+}
+function readTokenCache(cachePath) {
+  try {
+    const raw = fs51.readFileSync(cachePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
 }
-function createNoopGraphDatabase4() {
-  const noop2 = async () => {
-    throw new Error("Graph not available during yield");
-  };
-  return {
-    connect: async () => {
-    },
-    disconnect: async () => {
-    },
-    isConnected: () => false,
-    createResource: noop2,
-    getResource: noop2,
-    updateResource: noop2,
-    deleteResource: noop2,
-    listResources: noop2,
-    searchResources: noop2,
-    createAnnotation: noop2,
-    getAnnotation: noop2,
-    updateAnnotation: noop2,
-    deleteAnnotation: noop2,
-    listAnnotations: noop2,
-    getHighlights: noop2,
-    resolveReference: noop2,
-    getReferences: noop2,
-    getEntityReferences: noop2,
-    getResourceAnnotations: noop2,
-    getResourceReferencedBy: noop2,
-    getResourceConnections: noop2,
-    findPath: noop2,
-    getEntityTypeStats: noop2,
-    getStats: noop2,
-    batchCreateResources: noop2,
-    createAnnotations: noop2,
-    resolveReferences: noop2,
-    detectAnnotations: noop2,
-    getEntityTypes: noop2,
-    addEntityType: noop2,
-    addEntityTypes: noop2,
-    generateId: () => "noop",
-    clearDatabase: noop2
+function writeTokenCache(cachePath, cache) {
+  fs51.mkdirSync(path43.dirname(cachePath), { recursive: true, mode: 448 });
+  fs51.writeFileSync(cachePath, JSON.stringify(cache, null, 2), { mode: 384 });
+}
+function isTokenValid(cache) {
+  const cachedAt = new Date(cache.cachedAt).getTime();
+  return Date.now() < cachedAt + TOKEN_CACHE_TTL_MS;
+}
+async function acquireToken(rawBusUrl, emailStr, passwordStr) {
+  const client = new SemiontApiClient3({ baseUrl: toBaseUrl(rawBusUrl) });
+  const authResult = await client.authenticatePassword(toEmail(emailStr), passwordStr);
+  const cache = {
+    bus: rawBusUrl,
+    email: emailStr,
+    token: authResult.token,
+    cachedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
+  writeTokenCache(tokenCachePath(rawBusUrl), cache);
+}
+function loadCachedClient(rawBusUrl) {
+  const cachePath = tokenCachePath(rawBusUrl);
+  const cached = readTokenCache(cachePath);
+  if (!cached || !isTokenValid(cached)) {
+    throw new Error(
+      `Not logged in to ${rawBusUrl}.
+Run: semiont login --bus ${rawBusUrl}`
+    );
+  }
+  const client = new SemiontApiClient3({ baseUrl: toBaseUrl(rawBusUrl) });
+  return { client, token: toAccessToken(cached.token) };
 }
-async function checksumFile(absPath) {
-  const buf = await nodeFs.readFile(absPath);
-  return createHash("sha256").update(buf).digest("hex");
+function resolveBusUrl(busFlag) {
+  const url = busFlag ?? process.env.SEMIONT_BUS;
+  if (!url) {
+    throw new Error(
+      "Backend URL not configured. Use --bus <url> or set $SEMIONT_BUS.\nRun `semiont login --bus <url>` to authenticate."
+    );
+  }
+  return url;
 }
+
+// src/core/commands/yield.ts
 function guessFormat(filePath) {
-  const ext = path43.extname(filePath).toLowerCase();
+  const ext = path44.extname(filePath).toLowerCase();
   const map2 = {
     ".md": "text/markdown",
     ".markdown": "text/markdown",
@@ -29821,428 +29876,1332 @@ function guessFormat(filePath) {
   };
   return map2[ext] ?? "application/octet-stream";
 }
-var YieldOptionsSchema = BaseOptionsSchema.extend({
-  files: external_exports.array(external_exports.string()).min(1, "At least one file path is required"),
+var YieldOptionsSchema = ApiOptionsSchema.extend({
+  // Mode flags
+  upload: external_exports.array(external_exports.string()).default([]),
+  delegate: external_exports.boolean().default(false),
+  // Upload mode options
   name: external_exports.string().optional(),
-  noGit: external_exports.boolean().default(false)
+  // Delegate mode required
+  resource: external_exports.string().optional(),
+  annotation: external_exports.string().optional(),
+  storageUri: external_exports.string().optional(),
+  // Delegate mode optional
+  title: external_exports.string().optional(),
+  prompt: external_exports.string().optional(),
+  language: external_exports.string().optional(),
+  temperature: external_exports.coerce.number().min(0).max(1).optional(),
+  maxTokens: external_exports.coerce.number().int().min(100).max(4e3).optional(),
+  contextWindow: external_exports.coerce.number().int().min(100).max(5e3).default(1e3)
+}).superRefine((val, ctx) => {
+  const hasUpload = val.upload.length > 0;
+  const hasDelegate = val.delegate;
+  if (!hasUpload && !hasDelegate) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "One of --upload <file> or --delegate is required" });
+  }
+  if (hasUpload && hasDelegate) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--upload and --delegate are mutually exclusive" });
+  }
+  if (hasUpload && val.name && val.upload.length > 1) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--name can only be used when uploading a single file" });
+  }
+  if (hasDelegate) {
+    if (!val.resource) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--resource <resourceId> is required with --delegate" });
+    if (!val.annotation) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--annotation <annotationId> is required with --delegate" });
+    if (!val.storageUri) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--storage-uri is required with --delegate" });
+  }
 });
+function waitForYieldFinished(eventBus) {
+  return new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("yield:finished").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      resolve10({ resourceId: event.resourceId, resourceName: event.resourceName });
+    });
+    const failSub = eventBus.get("yield:failed").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(event.error ?? new Error("Generation failed"));
+    });
+  });
+}
+function waitForGatherAnnotationFinished(eventBus, annotationId) {
+  return new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("gather:annotation-finished").subscribe((event) => {
+      if (event.annotationId !== annotationId) return;
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      const context = event.response.context;
+      if (!context) {
+        reject(new Error("No context returned from gatherAnnotation \u2014 cannot generate"));
+      } else {
+        resolve10(context);
+      }
+    });
+    const failSub = eventBus.get("gather:failed").subscribe((event) => {
+      if (event.annotationId !== annotationId) return;
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(event.error ?? new Error("Gather annotation failed"));
+    });
+  });
+}
+async function runDelegate(client, token, options) {
+  const rawResourceId = options.resource;
+  const rawAnnotationId = options.annotation;
+  const resourceId = toResourceId(rawResourceId);
+  const annotationId = toAnnotationId(rawAnnotationId);
+  const gatherEventBus = new EventBus4();
+  const gatherPromise = waitForGatherAnnotationFinished(gatherEventBus, rawAnnotationId);
+  client.sse.gatherAnnotation(
+    resourceId,
+    annotationId,
+    { contextWindow: options.contextWindow },
+    { auth: token, eventBus: gatherEventBus }
+  );
+  const context = await gatherPromise;
+  if (!options.quiet) process.stderr.write(`Generating from annotation ${rawAnnotationId}...
+`);
+  const eventBus = new EventBus4();
+  const donePromise = waitForYieldFinished(eventBus);
+  client.sse.yieldResource(
+    resourceId,
+    annotationId,
+    {
+      context,
+      storageUri: options.storageUri,
+      ...options.title && { title: options.title },
+      ...options.prompt && { prompt: options.prompt },
+      ...options.language && { language: options.language },
+      ...options.temperature !== void 0 && { temperature: options.temperature },
+      ...options.maxTokens !== void 0 && { maxTokens: options.maxTokens }
+    },
+    { auth: token, eventBus }
+  );
+  return await donePromise;
+}
 async function runYield(options) {
   const startTime = Date.now();
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
   const projectRoot = findProjectRoot();
-  const environment = options.environment;
-  const logger = createCliLogger6(options.verbose ?? false);
-  const userId = `did:web:localhost:users:${process.env.USER ?? "cli"}`;
-  if (options.name && options.files.length > 1) {
-    throw new Error("--name can only be used when yielding a single file");
-  }
-  const project = new SemiontProject22(projectRoot);
-  if (project.gitSync && !options.noGit) {
-    const gitCheck = checkGitAvailable();
-    if (!gitCheck.pass) throw new Error(gitCheck.message);
+  if (options.delegate) {
+    const { resourceId, resourceName } = await runDelegate(client, token, options);
+    const label = resourceName ?? resourceId ?? options.storageUri;
+    if (!options.quiet) printSuccess(`Yielded: ${options.storageUri} \u2192 ${resourceId ?? "(pending)"}`);
+    process.stdout.write(JSON.stringify({ resourceId, resourceName, storageUri: options.storageUri }));
+    if (!options.quiet) process.stdout.write("\n");
+    return {
+      command: "yield",
+      environment: rawBusUrl,
+      timestamp: /* @__PURE__ */ new Date(),
+      duration: Date.now() - startTime,
+      summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+      executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+      results: [{ entity: label, platform: "posix", success: true, metadata: { resourceId, storageUri: options.storageUri }, duration: Date.now() - startTime }]
+    };
   }
-  const eventBus = new EventBus4();
-  const eventStore = createEventStore6(project, eventBus, logger);
-  const kb = createKnowledgeBase4(eventStore, project, createNoopGraphDatabase4(), logger);
-  const stower = new Stower4(kb, eventBus, logger.child({ component: "stower" }));
-  await stower.initialize();
   let succeeded = 0;
   let failed = 0;
   const results = [];
-  try {
-    for (const filePath of options.files) {
-      const absPath = path43.isAbsolute(filePath) ? filePath : path43.resolve(projectRoot, filePath);
-      try {
-        await nodeFs.access(absPath);
-      } catch {
-        if (!options.quiet) printWarning(`File not found: ${filePath}`);
-        results.push({ entity: filePath, platform: "posix", success: false, metadata: { error: "File not found" }, duration: 0 });
-        failed++;
-        continue;
-      }
-      const relPath = path43.relative(projectRoot, absPath).replace(/\\/g, "/");
-      const storageUri = `file://${relPath}`;
-      let isTracked = false;
-      let existingResourceId;
-      try {
-        existingResourceId = await resolveStorageUri(kb.projectionsDir, storageUri);
-        isTracked = true;
-      } catch (e) {
-        if (!(e instanceof ResourceNotFoundError)) throw e;
-      }
-      const format = guessFormat(filePath);
-      const contentChecksum = await checksumFile(absPath);
-      const fileStart = Date.now();
-      if (!isTracked) {
-        const name = options.name ?? path43.basename(filePath, path43.extname(filePath));
-        const created = await new Promise((resolve12, reject) => {
-          const sub = eventBus.get("yield:created").subscribe((e) => {
-            sub.unsubscribe();
-            resolve12(e.resourceId);
-          });
-          eventBus.get("yield:create-failed").subscribe((e) => reject(e.error));
-          eventBus.get("yield:create").next({ name, storageUri, contentChecksum, format, userId, noGit: options.noGit });
-        });
-        if (!options.quiet) printSuccess(`Yielded: ${filePath} \u2192 ${created}`);
-        results.push({ entity: filePath, platform: "posix", success: true, metadata: { resourceId: created, storageUri }, duration: Date.now() - fileStart });
-        succeeded++;
-      } else {
-        const updated = await new Promise((resolve12, reject) => {
-          const sub = eventBus.get("yield:updated").subscribe(() => {
-            sub.unsubscribe();
-            resolve12();
-          });
-          eventBus.get("yield:update-failed").subscribe((e) => reject(e.error));
-          eventBus.get("yield:update").next({
-            resourceId: toResourceId(existingResourceId),
-            storageUri,
-            contentChecksum,
-            userId,
-            noGit: options.noGit
-          });
-        });
-        void updated;
-        if (!options.quiet) printSuccess(`Updated: ${filePath} (${existingResourceId})`);
-        results.push({ entity: filePath, platform: "posix", success: true, metadata: { resourceId: existingResourceId, storageUri }, duration: Date.now() - fileStart });
-        succeeded++;
-      }
+  for (const filePath of options.upload) {
+    const absPath = path44.isAbsolute(filePath) ? filePath : path44.resolve(projectRoot, filePath);
+    const fileStart = Date.now();
+    let content;
+    try {
+      content = await nodeFs.readFile(absPath);
+    } catch {
+      if (!options.quiet) printWarning(`File not found: ${filePath}`);
+      results.push({ entity: filePath, platform: "posix", success: false, metadata: { error: "File not found" }, duration: 0 });
+      failed++;
+      continue;
     }
-  } finally {
-    await stower.stop();
-    eventBus.destroy();
+    const relPath = path44.relative(projectRoot, absPath).replace(/\\/g, "/");
+    const storageUri = `file://${relPath}`;
+    const name = options.name ?? path44.basename(filePath, path44.extname(filePath));
+    const format = guessFormat(filePath);
+    const { resourceId } = await client.yieldResource(
+      { name, file: content, format, storageUri },
+      { auth: token }
+    );
+    if (!options.quiet) printSuccess(`Yielded: ${filePath} \u2192 ${resourceId}`);
+    results.push({ entity: filePath, platform: "posix", success: true, metadata: { resourceId, storageUri }, duration: Date.now() - fileStart });
+    succeeded++;
   }
-  const duration = Date.now() - startTime;
   return {
     command: "yield",
-    environment,
+    environment: rawBusUrl,
     timestamp: /* @__PURE__ */ new Date(),
-    duration,
-    summary: { succeeded, failed, total: options.files.length, warnings: 0 },
+    duration: Date.now() - startTime,
+    summary: { succeeded, failed, total: options.upload.length, warnings: 0 },
     executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
     results
   };
 }
-var yieldCmd = new CommandBuilder().name("yield").description("Register existing files as semiont resources, or record content updates for tracked files").requiresEnvironment(true).requiresServices(false).examples(
-  "semiont yield docs/overview.md",
-  'semiont yield docs/new.md --name "Overview Document"'
+var yieldCmd = new CommandBuilder().name("yield").description(
+  "Upload a local file as a resource (--upload), or generate a new resource from an annotation's gathered context (--delegate). Delegate mode outputs JSON { resourceId, resourceName, storageUri } to stdout."
+).requiresEnvironment(true).requiresServices(true).examples(
+  "semiont yield --upload docs/overview.md",
+  'semiont yield --upload docs/overview.md --name "Overview Document"',
+  "semiont yield --upload docs/a.md --upload docs/b.md --upload docs/c.md",
+  "semiont yield --delegate --resource <resourceId> --annotation <annotationId> --storage-uri file://generated/paris.md",
+  'semiont yield --delegate --resource <resourceId> --annotation <annotationId> --storage-uri file://generated/paris.md --title "Paris" --language en',
+  'semiont yield --delegate --resource <resourceId> --annotation <annotationId> --storage-uri file://generated/paris.md --prompt "Write a brief encyclopedia entry" --temperature 0.3',
+  `NEW_ID=$(semiont yield --delegate --resource <resourceId> --annotation <annotationId> --storage-uri file://generated/loc.md --quiet | jq -r '.resourceId') && semiont bind <resourceId> <annotationId> "$NEW_ID"`
 ).args({
-  args: {
-    "--name": {
-      type: "string",
-      description: "Resource name (only valid for a single new file)"
+  ...withApiArgs({
+    "--upload": {
+      type: "array",
+      description: "Upload mode: one or more local file paths to register as resources (repeatable)"
     },
-    "--no-git": {
+    "--delegate": {
       type: "boolean",
-      description: "Skip git add even when gitSync is configured",
+      description: "Delegate mode: generate a new resource from an annotation's gathered context",
       default: false
+    },
+    "--name": {
+      type: "string",
+      description: "Upload mode: resource name (single file only)"
+    },
+    "--resource": {
+      type: "string",
+      description: "Delegate mode: source resourceId"
+    },
+    "--annotation": {
+      type: "string",
+      description: "Delegate mode: source annotationId"
+    },
+    "--storage-uri": {
+      type: "string",
+      description: "Delegate mode: file://-relative URI where the generated resource will be saved"
+    },
+    "--title": {
+      type: "string",
+      description: "Delegate mode: custom title for the generated resource"
+    },
+    "--prompt": {
+      type: "string",
+      description: "Delegate mode: custom prompt to guide content generation"
+    },
+    "--language": {
+      type: "string",
+      description: "Delegate mode: BCP 47 language tag for generated content (e.g. en, fr, ja)"
+    },
+    "--temperature": {
+      type: "string",
+      description: "Delegate mode: inference temperature 0.0\u20131.0 (0 = focused, 1 = creative)"
+    },
+    "--max-tokens": {
+      type: "string",
+      description: "Delegate mode: maximum tokens to generate (100\u20134000)"
+    },
+    "--context-window": {
+      type: "string",
+      description: "Delegate mode: characters of annotation context to gather (100\u20135000, default: 1000)"
     }
-  },
-  aliases: {
+  }, {
     "-n": "--name"
-  },
-  restAs: "files"
+  }),
+  aliases: {}
 }).schema(YieldOptionsSchema).handler(runYield).build();
 
-// src/core/commands/archive.ts
+// src/core/commands/mark.ts
 init_zod();
 init_command_definition();
 init_base_options_schema();
 init_cli_logger();
-init_config_loader();
-init_preflight_utils();
-import * as path44 from "path";
-import { SemiontProject as SemiontProject23 } from "@semiont/core/node";
-import { EventBus as EventBus5 } from "@semiont/core";
-import { createEventStore as createEventStore7 } from "@semiont/event-sourcing";
-import { resolveStorageUri as resolveStorageUri2, ResourceNotFoundError as ResourceNotFoundError2 } from "@semiont/event-sourcing";
-import { Stower as Stower5, createKnowledgeBase as createKnowledgeBase5 } from "@semiont/make-meaning";
-function createCliLogger7(verbose) {
-  return {
-    debug: (msg, meta) => {
-      if (verbose) console.log(`[debug] ${msg}`, meta ?? "");
-    },
-    info: (msg, meta) => console.log(`[info] ${msg}`, meta ?? ""),
-    warn: (msg, meta) => console.warn(`[warn] ${msg}`, meta ?? ""),
-    error: (msg, meta) => console.error(`[error] ${msg}`, meta ?? ""),
-    child: () => createCliLogger7(verbose)
-  };
+import { resourceId as toResourceId2, EventBus as EventBus5 } from "@semiont/core";
+var MOTIVATIONS = ["highlighting", "commenting", "tagging", "assessing", "linking"];
+var CONTEXT_WINDOW = 32;
+var MarkOptionsSchema = ApiOptionsSchema.extend({
+  resourceIdArr: external_exports.array(external_exports.string()).min(1, "resourceId is required").max(1, "Only one resourceId allowed"),
+  motivation: external_exports.enum(MOTIVATIONS),
+  // ── Mode switch ──────────────────────────────────────────────────────
+  delegate: external_exports.boolean().default(false),
+  // ── Manual mode ──────────────────────────────────────────────────────
+  // TextQuoteSelector
+  quote: external_exports.string().optional(),
+  prefix: external_exports.string().optional(),
+  suffix: external_exports.string().optional(),
+  // TextPositionSelector
+  start: external_exports.coerce.number().int().nonnegative().optional(),
+  end: external_exports.coerce.number().int().nonnegative().optional(),
+  // SvgSelector
+  svg: external_exports.string().optional(),
+  // FragmentSelector
+  fragment: external_exports.string().optional(),
+  fragmentConformsTo: external_exports.string().optional(),
+  // Content fetching
+  fetchContent: external_exports.boolean().default(false),
+  // Body
+  bodyText: external_exports.string().optional(),
+  bodyFormat: external_exports.string().optional(),
+  bodyLanguage: external_exports.string().optional(),
+  bodyPurpose: external_exports.string().optional(),
+  link: external_exports.array(external_exports.string()).optional(),
+  // ── Delegate mode: shared ──────────────────────────────────────────────
+  instructions: external_exports.string().optional(),
+  density: external_exports.coerce.number().int().optional(),
+  tone: external_exports.string().optional(),
+  // ── Delegate mode: linking ─────────────────────────────────────────────
+  entityType: external_exports.array(external_exports.string()).default([]),
+  includeDescriptive: external_exports.boolean().default(false),
+  // ── Delegate mode: tagging ─────────────────────────────────────────────
+  schemaId: external_exports.string().optional(),
+  category: external_exports.array(external_exports.string()).default([])
+}).superRefine((val, ctx) => {
+  if (val.delegate) {
+    const manualFlags = ["quote", "start", "end", "svg", "fragment", "fetchContent", "bodyText", "link"];
+    for (const f of manualFlags) {
+      const v = val[f];
+      if (v !== void 0 && v !== false && !(Array.isArray(v) && v.length === 0)) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `--${f.replace(/([A-Z])/g, "-$1").toLowerCase()} cannot be used with --delegate` });
+      }
+    }
+    if (val.motivation === "linking" && val.entityType.length === 0) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--entity-type is required for --delegate --motivation linking" });
+    }
+    if (val.motivation === "tagging") {
+      if (!val.schemaId) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--schema-id is required for --delegate --motivation tagging" });
+      if (val.category.length === 0) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "--category is required for --delegate --motivation tagging" });
+    }
+  }
+});
+async function fetchResourceText(client, resourceId, token) {
+  const { data } = await client.getResourceRepresentation(resourceId, { accept: "text/plain", auth: token });
+  return new TextDecoder().decode(data);
+}
+function buildTextSelector(options, content) {
+  let exact = options.quote;
+  let start2 = options.start;
+  let end = options.end;
+  if (content !== void 0) {
+    if (exact !== void 0 && (start2 === void 0 || end === void 0)) {
+      const idx = content.indexOf(exact);
+      if (idx === -1) throw new Error(`--quote text not found in resource content: "${exact}"`);
+      start2 = idx;
+      end = idx + exact.length;
+    } else if (start2 !== void 0 && end !== void 0 && exact === void 0) {
+      exact = content.slice(start2, end);
+      if (!exact) throw new Error(`--start/--end range [${start2}, ${end}) is empty or out of bounds`);
+    }
+  }
+  const selectors = [];
+  if (start2 !== void 0 && end !== void 0) {
+    selectors.push({ type: "TextPositionSelector", start: start2, end });
+  }
+  if (exact !== void 0) {
+    const q = { type: "TextQuoteSelector", exact };
+    if (options.prefix !== void 0) {
+      q.prefix = options.prefix;
+    } else if (content !== void 0 && start2 !== void 0) {
+      q.prefix = content.slice(Math.max(0, start2 - CONTEXT_WINDOW), start2);
+    }
+    if (options.suffix !== void 0) {
+      q.suffix = options.suffix;
+    } else if (content !== void 0 && end !== void 0) {
+      q.suffix = content.slice(end, end + CONTEXT_WINDOW);
+    }
+    selectors.push(q);
+  }
+  return selectors;
+}
+async function buildSelector(options, client, resourceId, token) {
+  const hasText = options.quote !== void 0 || options.start !== void 0 && options.end !== void 0;
+  const hasSvg = options.svg !== void 0;
+  const hasFragment = options.fragment !== void 0;
+  const selectorTypes = [hasText, hasSvg, hasFragment].filter(Boolean).length;
+  if (selectorTypes > 1) {
+    throw new Error("Selector flags are mutually exclusive: use text (--quote/--start/--end), --svg, or --fragment, not a combination.");
+  }
+  if (hasSvg) {
+    return { type: "SvgSelector", value: options.svg };
+  }
+  if (hasFragment) {
+    const f = { type: "FragmentSelector", value: options.fragment };
+    if (options.fragmentConformsTo) f.conformsTo = options.fragmentConformsTo;
+    return f;
+  }
+  if (!hasText) return void 0;
+  const content = options.fetchContent ? await fetchResourceText(client, resourceId, token) : void 0;
+  const selectors = buildTextSelector(options, content);
+  if (selectors.length === 0) return void 0;
+  if (selectors.length === 1) return selectors[0];
+  return selectors;
+}
+function buildBody(options) {
+  const items = [];
+  if (options.bodyText !== void 0) {
+    const b = { type: "TextualBody", value: options.bodyText };
+    if (options.bodyFormat) b.format = options.bodyFormat;
+    if (options.bodyLanguage) b.language = options.bodyLanguage;
+    b.purpose = options.bodyPurpose ?? options.motivation;
+    items.push(b);
+  }
+  for (const source of options.link ?? []) {
+    items.push({ type: "SpecificResource", source, purpose: "linking" });
+  }
+  if (items.length === 0) return [];
+  if (items.length === 1) return items[0];
+  return items;
+}
+function waitForAssistFinished(eventBus) {
+  return new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("mark:assist-finished").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      resolve10({
+        motivation: event.motivation,
+        resourceId: event.resourceId,
+        createdCount: event.progress?.createdCount
+      });
+    });
+    const failSub = eventBus.get("mark:assist-failed").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(new Error(event.payload?.message ?? "Annotation failed"));
+    });
+  });
 }
-function createNoopGraphDatabase5() {
-  const noop2 = async () => {
-    throw new Error("Graph not available during archive");
+async function runDelegate2(client, token, options) {
+  const rawResourceId = options.resourceIdArr[0];
+  const resourceId = toResourceId2(rawResourceId);
+  const { motivation, instructions, density, tone, entityType, includeDescriptive, schemaId, category } = options;
+  if (!options.quiet) process.stderr.write(`Annotating ${motivation} on ${rawResourceId}...
+`);
+  const eventBus = new EventBus5();
+  const donePromise = waitForAssistFinished(eventBus);
+  const auth = token;
+  switch (motivation) {
+    case "highlighting":
+      client.sse.markHighlights(resourceId, { instructions, density }, { auth, eventBus });
+      break;
+    case "assessing":
+      client.sse.markAssessments(resourceId, { instructions, tone, density }, { auth, eventBus });
+      break;
+    case "commenting":
+      client.sse.markComments(resourceId, { instructions, tone, density }, { auth, eventBus });
+      break;
+    case "linking":
+      client.sse.markReferences(resourceId, { entityTypes: entityType, includeDescriptiveReferences: includeDescriptive }, { auth, eventBus });
+      break;
+    case "tagging":
+      client.sse.markTags(resourceId, { schemaId, categories: category }, { auth, eventBus });
+      break;
+  }
+  const result = await donePromise;
+  const createdCount = result.createdCount ?? 0;
+  if (!options.quiet) process.stderr.write(`\u2713 ${createdCount} annotations created
+`);
+  return { motivation, resourceId: rawResourceId, createdCount };
+}
+async function runMark(options) {
+  const startTime = Date.now();
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  if (options.delegate) {
+    const result = await runDelegate2(client, token, options);
+    process.stdout.write(JSON.stringify(result));
+    if (!options.quiet) process.stdout.write("\n");
+    return {
+      command: "mark",
+      environment: rawBusUrl,
+      timestamp: /* @__PURE__ */ new Date(),
+      duration: Date.now() - startTime,
+      summary: { succeeded: result.createdCount, failed: 0, total: result.createdCount, warnings: 0 },
+      executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+      results: [{ entity: result.resourceId, platform: "posix", success: true, metadata: { createdCount: result.createdCount, motivation: result.motivation }, duration: Date.now() - startTime }]
+    };
+  }
+  const rawResourceId = options.resourceIdArr[0];
+  const resourceId = toResourceId2(rawResourceId);
+  const selector = await buildSelector(options, client, resourceId, token);
+  const body = buildBody(options);
+  const target = selector !== void 0 ? { source: rawResourceId, selector } : { source: rawResourceId, selector: void 0 };
+  const request = {
+    motivation: options.motivation,
+    target,
+    body
   };
+  const { annotationId } = await client.markAnnotation(resourceId, request, { auth: token });
+  if (!options.quiet) printSuccess(`Marked: ${rawResourceId} \u2192 ${annotationId}`);
   return {
-    connect: async () => {
+    command: "mark",
+    environment: rawBusUrl,
+    timestamp: /* @__PURE__ */ new Date(),
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+    results: [{ entity: rawResourceId, platform: "posix", success: true, metadata: { annotationId }, duration: Date.now() - startTime }]
+  };
+}
+var markCmd = new CommandBuilder().name("mark").description(
+  "Create a W3C annotation on a resource. Manual mode (default): create a single explicitly-specified annotation. Delegate mode (--delegate): AI-assisted bulk annotation via SSE stream. Outputs JSON { motivation, resourceId, createdCount } in delegate mode."
+).requiresEnvironment(true).requiresServices(true).examples(
+  // Manual mode
+  'semiont mark <resourceId> --motivation highlighting --quote "some text"',
+  'semiont mark <resourceId> --motivation highlighting --quote "some text" --fetch-content',
+  'semiont mark <resourceId> --motivation commenting --quote "some text" --body-text "my comment"',
+  'semiont mark <resourceId> --motivation linking --quote "some text" --link <targetResourceId>',
+  'semiont mark <resourceId> --motivation tagging --quote "Einstein" --body-text "Person"',
+  // Detect mode
+  "semiont mark <resourceId> --delegate --motivation highlighting",
+  'semiont mark <resourceId> --delegate --motivation highlighting --instructions "Focus on key claims" --density 8',
+  "semiont mark <resourceId> --delegate --motivation assessing --tone analytical --density 4",
+  "semiont mark <resourceId> --delegate --motivation commenting --tone scholarly",
+  "semiont mark <resourceId> --delegate --motivation linking --entity-type Location --entity-type Person",
+  "semiont mark <resourceId> --delegate --motivation linking --entity-type Location --include-descriptive",
+  "semiont mark <resourceId> --delegate --motivation tagging --schema-id <schemaId> --category Biology --category Chemistry"
+).args({
+  ...withApiArgs({
+    "--motivation": {
+      type: "string",
+      description: `Annotation motivation: ${MOTIVATIONS.join(", ")}`
     },
-    disconnect: async () => {
+    // ── Mode switch ───────────────────────────────────────────────────
+    "--delegate": {
+      type: "boolean",
+      description: "Delegate annotation work to AI (request mode); incompatible with manual selector flags",
+      default: false
     },
-    isConnected: () => false,
-    createResource: noop2,
-    getResource: noop2,
-    updateResource: noop2,
-    deleteResource: noop2,
-    listResources: noop2,
-    searchResources: noop2,
-    createAnnotation: noop2,
-    getAnnotation: noop2,
-    updateAnnotation: noop2,
-    deleteAnnotation: noop2,
-    listAnnotations: noop2,
-    getHighlights: noop2,
-    resolveReference: noop2,
-    getReferences: noop2,
-    getEntityReferences: noop2,
-    getResourceAnnotations: noop2,
-    getResourceReferencedBy: noop2,
-    getResourceConnections: noop2,
-    findPath: noop2,
-    getEntityTypeStats: noop2,
-    getStats: noop2,
-    batchCreateResources: noop2,
-    createAnnotations: noop2,
-    resolveReferences: noop2,
-    detectAnnotations: noop2,
-    getEntityTypes: noop2,
-    addEntityType: noop2,
-    addEntityTypes: noop2,
-    generateId: () => "noop",
-    clearDatabase: noop2
-  };
-}
-var ArchiveOptionsSchema = BaseOptionsSchema.extend({
-  files: external_exports.array(external_exports.string()).min(1, "At least one file path is required"),
-  keepFile: external_exports.boolean().default(false),
-  noGit: external_exports.boolean().default(false)
+    // ── Manual mode options ───────────────────────────────────────────
+    "--quote": {
+      type: "string",
+      description: "Manual: TextQuoteSelector exact text to select"
+    },
+    "--prefix": {
+      type: "string",
+      description: "Manual: TextQuoteSelector context before the quote (auto-derived with --fetch-content)"
+    },
+    "--suffix": {
+      type: "string",
+      description: "Manual: TextQuoteSelector context after the quote (auto-derived with --fetch-content)"
+    },
+    "--start": {
+      type: "string",
+      description: "Manual: TextPositionSelector start character offset"
+    },
+    "--end": {
+      type: "string",
+      description: "Manual: TextPositionSelector end character offset"
+    },
+    "--fetch-content": {
+      type: "boolean",
+      description: "Manual: fetch resource text to auto-complete dual selector",
+      default: false
+    },
+    "--svg": {
+      type: "string",
+      description: "Manual: SvgSelector SVG markup defining a region (for images)"
+    },
+    "--fragment": {
+      type: "string",
+      description: "Manual: FragmentSelector media fragment value"
+    },
+    "--fragment-conforms-to": {
+      type: "string",
+      description: "Manual: FragmentSelector conformance URI"
+    },
+    "--body-text": {
+      type: "string",
+      description: "Manual: TextualBody text content"
+    },
+    "--body-format": {
+      type: "string",
+      description: "Manual: TextualBody MIME type (default: text/plain)"
+    },
+    "--body-language": {
+      type: "string",
+      description: "Manual: TextualBody BCP 47 language tag"
+    },
+    "--body-purpose": {
+      type: "string",
+      description: "Manual: TextualBody purpose (defaults to motivation)"
+    },
+    "--link": {
+      type: "array",
+      description: "Manual: SpecificResource body target resourceId to link to (repeatable)"
+    },
+    // ── Delegate mode: shared ───────────────────────────────────────────
+    "--instructions": {
+      type: "string",
+      description: "Delegate: free-text instructions for the AI (highlighting, assessing, commenting)"
+    },
+    "--density": {
+      type: "string",
+      description: "Delegate: annotations per 2000 words (highlighting: 1\u201315; assessing: 1\u201310; commenting: 2\u201312)"
+    },
+    "--tone": {
+      type: "string",
+      description: "Delegate: tone for assessing (analytical|critical|balanced|constructive) or commenting (scholarly|explanatory|conversational|technical)"
+    },
+    // ── Delegate mode: linking ──────────────────────────────────────────
+    "--entity-type": {
+      type: "array",
+      description: "Delegate linking: entity type to detect (repeatable; at least one required)"
+    },
+    "--include-descriptive": {
+      type: "boolean",
+      description: "Delegate linking: also detect descriptive/prose references",
+      default: false
+    },
+    // ── Delegate mode: tagging ──────────────────────────────────────────
+    "--schema-id": {
+      type: "string",
+      description: "Delegate tagging: tag schema ID (required)"
+    },
+    "--category": {
+      type: "array",
+      description: "Delegate tagging: category within the schema (repeatable; at least one required)"
+    }
+  }, {
+    "-m": "--motivation"
+  }),
+  restAs: "resourceIdArr",
+  aliases: {}
+}).schema(MarkOptionsSchema).handler(runMark).build();
+
+// src/core/commands/gather.ts
+init_zod();
+init_command_definition();
+init_base_options_schema();
+import { resourceId as toResourceId3, annotationId as toAnnotationId2, EventBus as EventBus6 } from "@semiont/core";
+var GatherOptionsSchema = ApiOptionsSchema.extend({
+  args: external_exports.array(external_exports.string()).min(2, "Usage: semiont gather resource <resourceId> | gather annotation <resourceId> <annotationId>"),
+  // resource options
+  depth: external_exports.coerce.number().int().min(1).max(3).default(2),
+  maxResources: external_exports.coerce.number().int().min(1).max(20).default(10),
+  noContent: external_exports.boolean().default(false),
+  summary: external_exports.boolean().default(false),
+  // annotation options
+  contextWindow: external_exports.coerce.number().int().min(100).max(5e3).default(1e3)
 });
-async function runArchive(options) {
+function waitForGatherResourceFinished(eventBus) {
+  return new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("gather:finished").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      resolve10(event.context);
+    });
+    const failSub = eventBus.get("gather:failed").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(event.error ?? new Error("Gather resource failed"));
+    });
+  });
+}
+function waitForGatherAnnotationFinished2(eventBus) {
+  return new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("gather:annotation-finished").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      resolve10(event.response);
+    });
+    const failSub = eventBus.get("gather:failed").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(event.error ?? new Error("Gather annotation failed"));
+    });
+  });
+}
+async function runGather(options) {
   const startTime = Date.now();
-  const projectRoot = findProjectRoot();
-  const environment = options.environment;
-  const logger = createCliLogger7(options.verbose ?? false);
-  const userId = `did:web:localhost:users:${process.env.USER ?? "cli"}`;
-  const project = new SemiontProject23(projectRoot);
-  if (project.gitSync && !options.noGit) {
-    const gitCheck = checkGitAvailable();
-    if (!gitCheck.pass) throw new Error(gitCheck.message);
-  }
-  const eventBus = new EventBus5();
-  const eventStore = createEventStore7(project, eventBus, logger);
-  const kb = createKnowledgeBase5(eventStore, project, createNoopGraphDatabase5(), logger);
-  const stower = new Stower5(kb, eventBus, logger.child({ component: "stower" }));
-  await stower.initialize();
-  let succeeded = 0;
-  let failed = 0;
-  const results = [];
-  try {
-    for (const filePath of options.files) {
-      const absPath = path44.isAbsolute(filePath) ? filePath : path44.resolve(projectRoot, filePath);
-      const relPath = path44.relative(projectRoot, absPath).replace(/\\/g, "/");
-      const storageUri = `file://${relPath}`;
-      const fileStart = Date.now();
-      let resourceId;
-      try {
-        resourceId = await resolveStorageUri2(kb.projectionsDir, storageUri);
-      } catch (e) {
-        if (e instanceof ResourceNotFoundError2) {
-          if (!options.quiet) printWarning(`Not tracked by semiont: ${filePath}`);
-          results.push({ entity: filePath, platform: "posix", success: false, metadata: { error: "Not tracked" }, duration: 0 });
-          failed++;
-          continue;
-        }
-        throw e;
-      }
-      eventBus.scope(resourceId).get("mark:archive").next({
-        userId,
-        resourceId,
-        storageUri,
-        keepFile: options.keepFile,
-        noGit: options.noGit
-      });
-      await new Promise((resolve12) => setTimeout(resolve12, 200));
-      if (!options.quiet) printSuccess(`Archived: ${filePath}`);
-      results.push({ entity: filePath, platform: "posix", success: true, metadata: { resourceId, storageUri }, duration: Date.now() - fileStart });
-      succeeded++;
-    }
-  } finally {
-    await stower.stop();
-    eventBus.destroy();
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  const [subcommand, rawResourceId, rawAnnotationId] = options.args;
+  let result;
+  if (subcommand === "resource") {
+    const id = toResourceId3(rawResourceId);
+    const eventBus = new EventBus6();
+    const donePromise = waitForGatherResourceFinished(eventBus);
+    client.sse.gatherResource(
+      id,
+      {
+        depth: options.depth,
+        maxResources: options.maxResources,
+        includeContent: !options.noContent,
+        includeSummary: options.summary
+      },
+      { auth: token, eventBus }
+    );
+    result = await donePromise;
+  } else if (subcommand === "annotation") {
+    if (!rawAnnotationId) {
+      throw new Error("Usage: semiont gather annotation <resourceId> <annotationId>");
+    }
+    const resourceId = toResourceId3(rawResourceId);
+    const annotationId = toAnnotationId2(rawAnnotationId);
+    const eventBus = new EventBus6();
+    const donePromise = waitForGatherAnnotationFinished2(eventBus);
+    client.sse.gatherAnnotation(
+      resourceId,
+      annotationId,
+      { contextWindow: options.contextWindow },
+      { auth: token, eventBus }
+    );
+    result = await donePromise;
+  } else {
+    throw new Error(`Unknown subcommand: ${subcommand}. Use 'resource' or 'annotation'.`);
   }
-  const duration = Date.now() - startTime;
+  process.stdout.write(JSON.stringify(result, null, 2));
+  if (!options.quiet) process.stdout.write("\n");
   return {
-    command: "archive",
-    environment,
+    command: "gather",
+    environment: rawBusUrl,
     timestamp: /* @__PURE__ */ new Date(),
-    duration,
-    summary: { succeeded, failed, total: options.files.length, warnings: 0 },
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
     executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
-    results
+    results: [{ entity: rawResourceId, platform: "posix", success: true, duration: Date.now() - startTime }]
   };
 }
-var archiveCmd = new CommandBuilder().name("archive").description("Archive tracked semiont resources (removes file from git and disk)").requiresEnvironment(true).requiresServices(false).examples(
-  "semiont archive docs/old.md",
-  "semiont archive docs/old.md --keep-file"
+var gatherCmd = new CommandBuilder().name("gather").description("Fetch LLM-optimized context for a resource or annotation. Outputs JSON to stdout: ResourceLLMContextResponse (resource) or AnnotationLLMContextResponse containing GatheredContext (annotation). Schemas defined in specs/src/components/schemas/.").requiresEnvironment(true).requiresServices(true).examples(
+  "semiont gather resource <resourceId>",
+  "semiont gather resource <resourceId> --depth 3 --max-resources 20",
+  "semiont gather resource <resourceId> --no-content",
+  "semiont gather annotation <resourceId> <annotationId>",
+  "semiont gather annotation <resourceId> <annotationId> --context-window 200",
+  "semiont gather resource <resourceId> | jq '.mainResource.name'",
+  "semiont gather annotation <resourceId> <annotationId> | jq '.context.sourceContext.selected'"
 ).args({
-  args: {
-    "--keep-file": {
+  ...withApiArgs({
+    "--depth": {
+      type: "string",
+      description: "Graph traversal depth: 1\u20133 (default: 2)"
+    },
+    "--max-resources": {
+      type: "string",
+      description: "Max related resources to include: 1\u201320 (default: 10)"
+    },
+    "--no-content": {
       type: "boolean",
-      description: "Remove from git index only \u2014 keep file on disk",
+      description: "Exclude full resource content (default: content included)",
       default: false
     },
-    "--no-git": {
+    "--summary": {
       type: "boolean",
-      description: "Skip git rm even when gitSync is configured",
+      description: "Request AI-generated summary (default: false)",
       default: false
+    },
+    "--context-window": {
+      type: "string",
+      description: "Characters of surrounding text context: 100\u20135000 (default: 1000)"
     }
-  },
-  aliases: {},
-  restAs: "files"
-}).schema(ArchiveOptionsSchema).handler(runArchive).build();
+  }, {}),
+  restAs: "args",
+  aliases: {}
+}).schema(GatherOptionsSchema).handler(runGather).build();
 
-// src/core/commands/unarchive.ts
+// src/core/commands/match.ts
 init_zod();
 init_command_definition();
 init_base_options_schema();
-init_cli_logger();
-init_config_loader();
-import * as path45 from "path";
-import { promises as nodeFs2 } from "fs";
-import { SemiontProject as SemiontProject24 } from "@semiont/core/node";
-import { EventBus as EventBus6 } from "@semiont/core";
-import { createEventStore as createEventStore8 } from "@semiont/event-sourcing";
-import { resolveStorageUri as resolveStorageUri3, ResourceNotFoundError as ResourceNotFoundError3 } from "@semiont/event-sourcing";
-import { Stower as Stower6, createKnowledgeBase as createKnowledgeBase6 } from "@semiont/make-meaning";
-function createCliLogger8(verbose) {
-  return {
-    debug: (msg, meta) => {
-      if (verbose) console.log(`[debug] ${msg}`, meta ?? "");
+import { resourceId as toResourceId4, annotationId as toAnnotationId3, EventBus as EventBus7 } from "@semiont/core";
+var MatchOptionsSchema = ApiOptionsSchema.extend({
+  args: external_exports.array(external_exports.string()).min(2, "Usage: semiont match <resourceId> <annotationId>").max(2),
+  contextWindow: external_exports.coerce.number().int().min(100).max(5e3).default(1e3),
+  userHint: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(20).default(10),
+  noSemantic: external_exports.boolean().default(false)
+});
+function waitForSearchResults(eventBus, referenceId) {
+  return new Promise((resolve10, reject) => {
+    const resultSub = eventBus.get("bind:search-results").subscribe((event) => {
+      if (event.referenceId === referenceId) {
+        resultSub.unsubscribe();
+        errorSub.unsubscribe();
+        resolve10(event.results);
+      }
+    });
+    const errorSub = eventBus.get("bind:search-failed").subscribe((event) => {
+      if (event.referenceId === referenceId) {
+        resultSub.unsubscribe();
+        errorSub.unsubscribe();
+        reject(event.error);
+      }
+    });
+  });
+}
+async function gatherContext(client, resourceId, annotationId, contextWindow, token) {
+  const eventBus = new EventBus7();
+  const contextPromise = new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("gather:annotation-finished").subscribe((event) => {
+      if (event.annotationId !== annotationId) return;
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      const context = event.response.context;
+      if (!context) {
+        reject(new Error("No context returned from gatherAnnotation"));
+      } else {
+        resolve10(context);
+      }
+    });
+    const failSub = eventBus.get("gather:failed").subscribe((event) => {
+      if (event.annotationId !== annotationId) return;
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(event.error ?? new Error("Gather annotation failed"));
+    });
+  });
+  client.sse.gatherAnnotation(
+    resourceId,
+    annotationId,
+    { contextWindow },
+    { auth: token, eventBus }
+  );
+  return contextPromise;
+}
+async function runMatch(options) {
+  const startTime = Date.now();
+  const [rawResourceId, rawAnnotationId] = options.args;
+  const resourceId = toResourceId4(rawResourceId);
+  const annotationId = toAnnotationId3(rawAnnotationId);
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  let context = await gatherContext(client, resourceId, annotationId, options.contextWindow, token);
+  if (options.userHint) {
+    context = { ...context, userHint: options.userHint };
+  }
+  const eventBus = new EventBus7();
+  const resultsPromise = waitForSearchResults(eventBus, rawAnnotationId);
+  client.sse.bindSearch(
+    resourceId,
+    {
+      referenceId: rawAnnotationId,
+      context,
+      limit: options.limit,
+      useSemanticScoring: !options.noSemantic
     },
-    info: (msg, meta) => console.log(`[info] ${msg}`, meta ?? ""),
-    warn: (msg, meta) => console.warn(`[warn] ${msg}`, meta ?? ""),
-    error: (msg, meta) => console.error(`[error] ${msg}`, meta ?? ""),
-    child: () => createCliLogger8(verbose)
+    { auth: token, eventBus }
+  );
+  const results = await resultsPromise;
+  process.stdout.write(JSON.stringify(results, null, 2));
+  if (!options.quiet) process.stdout.write("\n");
+  return {
+    command: "match",
+    environment: rawBusUrl,
+    timestamp: /* @__PURE__ */ new Date(),
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+    results: [{ entity: rawAnnotationId, platform: "posix", success: true, metadata: { resultCount: results.length }, duration: Date.now() - startTime }]
   };
 }
-function createNoopGraphDatabase6() {
-  const noop2 = async () => {
-    throw new Error("Graph not available during unarchive");
+var matchCmd = new CommandBuilder().name("match").description("Search for binding candidates for an annotation. Outputs JSON array of ResourceDescriptor & { score?, matchReason? } to stdout. Uses the same flow as the Search button in the Gather Context modal.").requiresEnvironment(true).requiresServices(true).examples(
+  "semiont match <resourceId> <annotationId>",
+  'semiont match <resourceId> <annotationId> --user-hint "look for papers about neural scaling"',
+  "semiont match <resourceId> <annotationId> --limit 5 --no-semantic",
+  "semiont match <resourceId> <annotationId> | jq '.[0].name'",
+  `semiont match <resourceId> <annotationId> | jq -r '.[0]["@id"]' | xargs -I{} semiont mark <resourceId> --motivation linking --link {}`
+).args({
+  ...withApiArgs({
+    "--context-window": {
+      type: "string",
+      description: "Characters of context around annotation: 100\u20135000 (default: 1000)"
+    },
+    "--user-hint": {
+      type: "string",
+      description: "Override/supplement the context text used for matching"
+    },
+    "--limit": {
+      type: "string",
+      description: "Max results to return: 1\u201320 (default: 10)"
+    },
+    "--no-semantic": {
+      type: "boolean",
+      description: "Disable semantic scoring (faster, keyword-only)",
+      default: false
+    }
+  }, {}),
+  restAs: "args",
+  aliases: {}
+}).schema(MatchOptionsSchema).handler(runMatch).build();
+
+// src/core/commands/bind.ts
+init_zod();
+init_command_definition();
+init_base_options_schema();
+init_cli_logger();
+import { resourceId as toResourceId5, annotationId as toAnnotationId4, EventBus as EventBus8 } from "@semiont/core";
+var BindOptionsSchema = ApiOptionsSchema.extend({
+  args: external_exports.array(external_exports.string()).min(3, "Usage: semiont bind <resourceId> <annotationId> <targetResourceId>").max(3)
+});
+function waitForBindFinished(eventBus) {
+  return new Promise((resolve10, reject) => {
+    const doneSub = eventBus.get("bind:finished").subscribe(() => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      resolve10();
+    });
+    const failSub = eventBus.get("bind:failed").subscribe((event) => {
+      doneSub.unsubscribe();
+      failSub.unsubscribe();
+      reject(event.error ?? new Error("Bind failed"));
+    });
+  });
+}
+async function runBind(options) {
+  const startTime = Date.now();
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  const [rawResourceId, rawAnnotationId, targetResourceId] = options.args;
+  const resourceId = toResourceId5(rawResourceId);
+  const annotationId = toAnnotationId4(rawAnnotationId);
+  const request = {
+    resourceId: rawResourceId,
+    operations: [{
+      op: "add",
+      item: {
+        type: "SpecificResource",
+        source: targetResourceId,
+        purpose: "linking"
+      }
+    }]
   };
+  const eventBus = new EventBus8();
+  const donePromise = waitForBindFinished(eventBus);
+  client.sse.bindAnnotation(resourceId, annotationId, request, { auth: token, eventBus });
+  await donePromise;
+  if (!options.quiet) printSuccess(`Bound: ${rawAnnotationId} \u2192 ${targetResourceId}`);
   return {
-    connect: async () => {
+    command: "bind",
+    environment: rawBusUrl,
+    timestamp: /* @__PURE__ */ new Date(),
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+    results: [{ entity: rawAnnotationId, platform: "posix", success: true, metadata: { targetResourceId }, duration: Date.now() - startTime }]
+  };
+}
+var bindCmd = new CommandBuilder().name("bind").description("Resolve a linking annotation to a target resource. Adds a SpecificResource body item (purpose: linking) via PUT /resources/{resourceId}/annotations/{annotationId}/body.").requiresEnvironment(true).requiresServices(true).examples(
+  "semiont bind <resourceId> <annotationId> <targetResourceId>",
+  `TARGET=$(semiont match <resourceId> <annotationId> --quiet | jq -r '.[0]["@id"]') && semiont bind <resourceId> <annotationId> "$TARGET"`
+).args({
+  ...withApiArgs({}, {}),
+  restAs: "args",
+  aliases: {}
+}).schema(BindOptionsSchema).handler(runBind).build();
+
+// src/core/commands/beckon.ts
+init_zod();
+init_command_definition();
+init_base_options_schema();
+var BeckonOptionsSchema = ApiOptionsSchema.extend({
+  participantArr: external_exports.array(external_exports.string()).min(1, "participantId is required").max(1, "Only one participant per beckon"),
+  resource: external_exports.string({ required_error: "--resource <resourceId> is required" }),
+  annotation: external_exports.string().optional(),
+  message: external_exports.string().max(500).optional()
+});
+async function runBeckon(options) {
+  const startTime = Date.now();
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  const [participantId] = options.participantArr;
+  const result = await client.beckonAttention(
+    participantId,
+    {
+      resourceId: options.resource,
+      ...options.annotation ? { annotationId: options.annotation } : {},
+      ...options.message ? { message: options.message } : {}
     },
-    disconnect: async () => {
+    { auth: token }
+  );
+  if (!options.quiet) {
+    const target = options.annotation ? `${options.resource} (${options.annotation})` : options.resource;
+    process.stderr.write(`Beckoned ${participantId} \u2192 ${target}
+`);
+  }
+  process.stdout.write(JSON.stringify(result) + "\n");
+  return {
+    command: "beckon",
+    environment: rawBusUrl,
+    timestamp: /* @__PURE__ */ new Date(),
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+    results: [{ entity: participantId, platform: "posix", success: true, duration: Date.now() - startTime }]
+  };
+}
+var beckonCmd = new CommandBuilder().name("beckon").description(
+  "Direct a participant's attention to a resource or annotation. Produces no persistent state \u2014 attention signal only. The participant may be a human username or an agent identifier."
+).requiresEnvironment(true).requiresServices(true).examples(
+  "semiont beckon alice --resource <resourceId>",
+  "semiont beckon alice --resource <resourceId> --annotation <annotationId>",
+  'semiont beckon alice --resource <resourceId> --annotation <annotationId> --message "Needs manual review"',
+  "semiont beckon my-review-agent --resource <resourceId> --annotation <annotationId>"
+).args({
+  ...withApiArgs({
+    "--resource": {
+      type: "string",
+      description: "Resource to direct attention at (required)",
+      required: true
     },
-    isConnected: () => false,
-    createResource: noop2,
-    getResource: noop2,
-    updateResource: noop2,
-    deleteResource: noop2,
-    listResources: noop2,
-    searchResources: noop2,
-    createAnnotation: noop2,
-    getAnnotation: noop2,
-    updateAnnotation: noop2,
-    deleteAnnotation: noop2,
-    listAnnotations: noop2,
-    getHighlights: noop2,
-    resolveReference: noop2,
-    getReferences: noop2,
-    getEntityReferences: noop2,
-    getResourceAnnotations: noop2,
-    getResourceReferencedBy: noop2,
-    getResourceConnections: noop2,
-    findPath: noop2,
-    getEntityTypeStats: noop2,
-    getStats: noop2,
-    batchCreateResources: noop2,
-    createAnnotations: noop2,
-    resolveReferences: noop2,
-    detectAnnotations: noop2,
-    getEntityTypes: noop2,
-    addEntityType: noop2,
-    addEntityTypes: noop2,
-    generateId: () => "noop",
-    clearDatabase: noop2
+    "--annotation": {
+      type: "string",
+      description: "Specific annotation within the resource (optional)"
+    },
+    "--message": {
+      type: "string",
+      description: "Human-readable context for the participant (max 500 chars)"
+    }
+  }, {}),
+  restAs: "participantArr",
+  aliases: {}
+}).schema(BeckonOptionsSchema).handler(runBeckon).build();
+
+// src/core/commands/browse.ts
+init_zod();
+init_command_definition();
+init_base_options_schema();
+import { resourceId as toResourceId6, annotationId as toAnnotationId5 } from "@semiont/core";
+var BrowseOptionsSchema = ApiOptionsSchema.extend({
+  args: external_exports.array(external_exports.string()).min(1, "Subcommand required: resources | resource | annotation | references | events | history | entity-types"),
+  // browse resources options
+  search: external_exports.string().optional(),
+  entityType: external_exports.array(external_exports.string()).default([]),
+  limit: external_exports.coerce.number().int().min(1).max(200).default(50),
+  // browse resource options
+  annotations: external_exports.boolean().default(false),
+  references: external_exports.boolean().default(false)
+}).superRefine((val, ctx) => {
+  const sub = val.args[0];
+  const valid = ["resources", "resource", "annotation", "references", "events", "history", "entity-types"];
+  if (!valid.includes(sub)) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `Unknown subcommand '${sub}'. Valid: ${valid.join(", ")}` });
+  }
+  if (sub === "resource" && val.args.length < 2) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Usage: semiont browse resource <resourceId>" });
+  }
+  if (sub === "annotation" && val.args.length < 3) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Usage: semiont browse annotation <resourceId> <annotationId>" });
+  }
+  if (sub === "references" && val.args.length < 2) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Usage: semiont browse references <resourceId>" });
+  }
+  if (sub === "events" && val.args.length < 2) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Usage: semiont browse events <resourceId>" });
+  }
+  if (sub === "history" && val.args.length < 3) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Usage: semiont browse history <resourceId> <annotationId>" });
+  }
+});
+async function runBrowse(options) {
+  const startTime = Date.now();
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  const [subcommand, rawResourceId, rawAnnotationId] = options.args;
+  let result;
+  let label;
+  if (subcommand === "resources") {
+    const data = await client.browseResources(
+      options.limit,
+      void 0,
+      options.search,
+      { auth: token }
+    );
+    result = data;
+    const items = Array.isArray(data) ? data : data?.resources ?? [];
+    label = `${items.length} resource${items.length !== 1 ? "s" : ""} found`;
+  } else if (subcommand === "resource") {
+    const id = toResourceId6(rawResourceId);
+    const resourceData = await client.browseResource(id, { auth: token });
+    if (options.annotations || options.references) {
+      const annotationsData = await client.browseAnnotations(id, void 0, { auth: token });
+      const annotations = annotationsData?.annotations ?? annotationsData ?? [];
+      let referencedBy = [];
+      if (options.references) {
+        const refData = await client.browseReferences(id, { auth: token });
+        referencedBy = refData.referencedBy ?? [];
+      }
+      result = {
+        ...resourceData,
+        ...options.annotations ? { annotations } : {},
+        ...options.references ? { referencedBy } : {}
+      };
+    } else {
+      result = resourceData;
+    }
+    label = `${rawResourceId}: ${resourceData?.name ?? rawResourceId}`;
+  } else if (subcommand === "annotation") {
+    const resourceId = toResourceId6(rawResourceId);
+    const annotationId = toAnnotationId5(rawAnnotationId);
+    result = await client.browseAnnotation(resourceId, annotationId, { auth: token });
+    label = `${rawAnnotationId}: annotation on ${rawResourceId}`;
+  } else if (subcommand === "references") {
+    const id = toResourceId6(rawResourceId);
+    const data = await client.browseReferences(id, { auth: token });
+    result = data.referencedBy ?? [];
+    const count = Array.isArray(result) ? result.length : 0;
+    label = `${count} resource${count !== 1 ? "s" : ""} reference ${rawResourceId}`;
+  } else if (subcommand === "events") {
+    const id = toResourceId6(rawResourceId);
+    const data = await client.getResourceEvents(id, { auth: token });
+    result = data.events ?? data;
+    const items = Array.isArray(result) ? result : [];
+    label = `${items.length} event${items.length !== 1 ? "s" : ""} for ${rawResourceId}`;
+  } else if (subcommand === "history") {
+    const resourceId = toResourceId6(rawResourceId);
+    const annotationId = toAnnotationId5(rawAnnotationId);
+    result = await client.getAnnotationHistory(resourceId, annotationId, { auth: token });
+    label = `history for annotation ${rawAnnotationId} on ${rawResourceId}`;
+  } else {
+    result = await client.listEntityTypes({ auth: token });
+    const items = Array.isArray(result) ? result : result?.tags ?? [];
+    label = `${items.length} entity type${items.length !== 1 ? "s" : ""}`;
+  }
+  if (!options.quiet) process.stderr.write(label + "\n");
+  process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  return {
+    command: "browse",
+    environment: rawBusUrl,
+    timestamp: /* @__PURE__ */ new Date(),
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+    results: [{ entity: rawResourceId ?? subcommand, platform: "posix", success: true, duration: Date.now() - startTime }]
   };
 }
-var UnarchiveOptionsSchema = BaseOptionsSchema.extend({
-  files: external_exports.array(external_exports.string()).min(1, "At least one file path is required")
+var browseCmd = new CommandBuilder().name("browse").description(
+  "Human-readable traversal of the knowledge base. Subcommands: resources (list), resource <id> (inspect), annotation <resourceId> <annotationId> (inspect), references <id> (who links here), events <resourceId> (historical event log), history <resourceId> <annotationId> (annotation audit trail), entity-types (available entity type catalogue). Outputs JSON to stdout; progress label to stderr. For LLM pipeline consumption use `semiont gather` instead."
+).requiresEnvironment(true).requiresServices(true).examples(
+  "semiont browse resources",
+  'semiont browse resources --search "Paris"',
+  "semiont browse resources --entity-type Location --limit 20",
+  "semiont browse resource <resourceId>",
+  "semiont browse resource <resourceId> --annotations",
+  "semiont browse resource <resourceId> --references",
+  "semiont browse annotation <resourceId> <annotationId>",
+  "semiont browse references <resourceId>",
+  "semiont browse events <resourceId>",
+  "semiont browse history <resourceId> <annotationId>",
+  "semiont browse entity-types",
+  `semiont browse resources --search "Paris" | jq '.[]["@id"]'`,
+  "semiont browse references <resourceId> | jq '.[].name'",
+  "semiont browse entity-types | jq '.[].tag'"
+).args({
+  ...withApiArgs({
+    "--search": {
+      type: "string",
+      description: "Filter resources by name or content (browse resources only)"
+    },
+    "--entity-type": {
+      type: "array",
+      description: "Filter resources by entity type (browse resources only; repeatable)"
+    },
+    "--limit": {
+      type: "string",
+      description: "Maximum number of results (browse resources only; default: 50)"
+    },
+    "--annotations": {
+      type: "boolean",
+      description: "Include annotation list in resource output (browse resource only)",
+      default: false
+    },
+    "--references": {
+      type: "boolean",
+      description: "Include resolved reference targets (browse resource only)",
+      default: false
+    }
+  }, {}),
+  restAs: "args",
+  aliases: {}
+}).schema(BrowseOptionsSchema).handler(runBrowse).build();
+
+// src/core/commands/listen.ts
+init_zod();
+init_command_definition();
+init_base_options_schema();
+import { resourceId as toResourceId7, EventBus as EventBus9 } from "@semiont/core";
+var ListenOptionsSchema = ApiOptionsSchema.extend({
+  args: external_exports.array(external_exports.string()).default([])
+}).superRefine((val, ctx) => {
+  const sub = val.args[0];
+  if (sub !== void 0 && sub !== "resource") {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `Unknown subcommand '${sub}'. Usage: semiont listen [resource <resourceId>]` });
+  }
+  if (sub === "resource" && val.args.length < 2) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Usage: semiont listen resource <resourceId>" });
+  }
 });
-async function runUnarchive(options) {
+async function runListen(options) {
   const startTime = Date.now();
-  const projectRoot = findProjectRoot();
-  const environment = options.environment;
-  const logger = createCliLogger8(options.verbose ?? false);
-  const userId = `did:web:localhost:users:${process.env.USER ?? "cli"}`;
-  const project = new SemiontProject24(projectRoot);
-  const eventBus = new EventBus6();
-  const eventStore = createEventStore8(project, eventBus, logger);
-  const kb = createKnowledgeBase6(eventStore, project, createNoopGraphDatabase6(), logger);
-  const stower = new Stower6(kb, eventBus, logger.child({ component: "stower" }));
-  await stower.initialize();
-  let succeeded = 0;
-  let failed = 0;
-  const results = [];
+  const rawBusUrl = resolveBusUrl(options.bus);
+  const { client, token } = loadCachedClient(rawBusUrl);
+  const [subcommand, rawResourceId] = options.args;
+  const isResourceScoped = subcommand === "resource";
+  const eventBus = new EventBus9();
+  let eventCount = 0;
+  eventBus.get("make-meaning:event").subscribe((event) => {
+    eventCount++;
+    process.stdout.write(JSON.stringify(event) + "\n");
+  });
+  const label = isResourceScoped ? `Listening for events on resource ${rawResourceId}` : "Listening for global events";
+  if (!options.quiet) process.stderr.write(label + " (Ctrl-C to stop)\n");
+  const stream = isResourceScoped ? client.sse.resourceEvents(toResourceId7(rawResourceId), { auth: token, eventBus }) : client.sse.globalEvents({ auth: token, eventBus });
+  await new Promise((resolve10) => {
+    const cleanup = () => {
+      stream.close();
+      resolve10();
+    };
+    process.once("SIGINT", cleanup);
+    process.once("SIGTERM", cleanup);
+  });
+  return {
+    command: "listen",
+    environment: rawBusUrl,
+    timestamp: /* @__PURE__ */ new Date(),
+    duration: Date.now() - startTime,
+    summary: { succeeded: eventCount, failed: 0, total: eventCount, warnings: 0 },
+    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
+    results: [{ entity: rawResourceId ?? "global", platform: "posix", success: true, duration: Date.now() - startTime }]
+  };
+}
+var listenCmd = new CommandBuilder().name("listen").description(
+  "Open a persistent SSE connection and stream domain events as NDJSON to stdout. Without a subcommand, streams global system events. With `resource <resourceId>`, streams events scoped to that resource. Runs until Ctrl-C or the server closes the connection."
+).requiresEnvironment(true).requiresServices(true).examples(
+  "semiont listen",
+  "semiont listen resource <resourceId>",
+  "semiont listen resource <resourceId> | jq .type",
+  "semiont listen | grep entitytype"
+).args({
+  ...withApiArgs({}, {}),
+  restAs: "args",
+  aliases: {}
+}).schema(ListenOptionsSchema).handler(runListen).build();
+
+// src/core/commands/login.ts
+init_zod();
+init_dist();
+init_command_definition();
+init_base_options_schema();
+import * as fs52 from "fs";
+import * as os6 from "os";
+import * as path45 from "path";
+import * as readline4 from "readline";
+var LoginOptionsSchema = BaseOptionsSchema.extend({
+  bus: external_exports.string().optional(),
+  user: external_exports.string().optional(),
+  password: external_exports.string().optional(),
+  refresh: external_exports.boolean().optional().default(false)
+});
+function readLoginConfig() {
+  const configPath = path45.join(os6.homedir(), ".semiontconfig");
   try {
-    for (const filePath of options.files) {
-      const absPath = path45.isAbsolute(filePath) ? filePath : path45.resolve(projectRoot, filePath);
-      const relPath = path45.relative(projectRoot, absPath).replace(/\\/g, "/");
-      const storageUri = `file://${relPath}`;
-      const fileStart = Date.now();
-      try {
-        await nodeFs2.access(absPath);
-      } catch {
-        console.error(
-          `Error: File not found at storageUri '${storageUri}'
-To restore from git: git checkout -- ${relPath}
-Then re-run: semiont unarchive ${filePath}`
-        );
-        results.push({ entity: filePath, platform: "posix", success: false, metadata: { error: "File not found on disk" }, duration: 0 });
-        failed++;
-        continue;
-      }
-      let resourceId;
-      try {
-        resourceId = await resolveStorageUri3(kb.projectionsDir, storageUri);
-      } catch (e) {
-        if (e instanceof ResourceNotFoundError3) {
-          if (!options.quiet) printWarning(`Not tracked by semiont: ${filePath}`);
-          results.push({ entity: filePath, platform: "posix", success: false, metadata: { error: "Not tracked" }, duration: 0 });
-          failed++;
-          continue;
-        }
-        throw e;
-      }
-      eventBus.scope(resourceId).get("mark:unarchive").next({
-        userId,
-        resourceId,
-        storageUri
-      });
-      await new Promise((resolve12) => setTimeout(resolve12, 200));
-      if (!options.quiet) printSuccess(`Unarchived: ${filePath}`);
-      results.push({ entity: filePath, platform: "posix", success: true, metadata: { resourceId, storageUri }, duration: Date.now() - fileStart });
-      succeeded++;
+    const content = fs52.existsSync(configPath) ? fs52.readFileSync(configPath, "utf-8") : null;
+    if (!content) return {};
+    return parse(content);
+  } catch {
+    return {};
+  }
+}
+function getDefaultEnvironment(config) {
+  return config.defaults?.environment ?? null;
+}
+function promptPassword(prompt3) {
+  return new Promise((resolve10, reject) => {
+    if (!process.stdin.isTTY) {
+      reject(new Error("No password provided and stdin is not a TTY. Use --password or $SEMIONT_PASSWORD."));
+      return;
     }
-  } finally {
-    await stower.stop();
-    eventBus.destroy();
+    const rl = readline4.createInterface({ input: process.stdin, output: process.stderr });
+    process.stderr.write(prompt3);
+    if (process.stdin.setRawMode) {
+      process.stdin.setRawMode(true);
+    }
+    let value = "";
+    process.stdin.on("data", function onData(chunk) {
+      const char = chunk.toString();
+      if (char === "\r" || char === "\n") {
+        process.stdin.removeListener("data", onData);
+        if (process.stdin.setRawMode) {
+          process.stdin.setRawMode(false);
+        }
+        process.stderr.write("\n");
+        rl.close();
+        resolve10(value);
+      } else if (char === "") {
+        process.stderr.write("\n");
+        rl.close();
+        reject(new Error("Interrupted"));
+      } else if (char === "\x7F" || char === "\b") {
+        value = value.slice(0, -1);
+      } else {
+        value += char;
+      }
+    });
+    process.stdin.resume();
+  });
+}
+async function runLogin(options) {
+  const startTime = Date.now();
+  const config = readLoginConfig();
+  const defaultEnv = getDefaultEnvironment(config);
+  const envSection = defaultEnv ? config.environments?.[defaultEnv] : void 0;
+  const rawBusUrl = resolveBusUrl(
+    options.bus ?? envSection?.backend?.publicURL
+  );
+  const emailStr = options.user ?? process.env.SEMIONT_USER ?? envSection?.auth?.email ?? null;
+  if (!emailStr) {
+    throw new Error(
+      'No auth email configured. Use --user, set $SEMIONT_USER, or add:\n  [environments.<env>.auth]\n  email = "you@example.com"\nto ~/.semiontconfig'
+    );
+  }
+  let passwordStr = options.password ?? process.env.SEMIONT_PASSWORD ?? envSection?.auth?.password ?? "";
+  if (!passwordStr) {
+    passwordStr = await promptPassword(`Password for ${emailStr}: `);
+  }
+  if (!passwordStr) {
+    throw new Error("Password is required.");
+  }
+  await acquireToken(rawBusUrl, emailStr, passwordStr);
+  const slug = busSlug(rawBusUrl);
+  const xdgState = process.env.XDG_STATE_HOME ?? path45.join(os6.homedir(), ".local", "state");
+  const cachePath = path45.join(xdgState, "semiont", "auth", `${slug}.json`);
+  if (!options.quiet) {
+    process.stderr.write(`Logged in to ${rawBusUrl} as ${emailStr}
+`);
+    process.stderr.write(`Token cached at ${cachePath} (expires in 24h)
+`);
   }
-  const duration = Date.now() - startTime;
   return {
-    command: "unarchive",
-    environment,
+    command: "login",
+    environment: "n/a",
     timestamp: /* @__PURE__ */ new Date(),
-    duration,
-    summary: { succeeded, failed, total: options.files.length, warnings: 0 },
-    executionContext: { user: process.env.USER || "unknown", workingDirectory: process.cwd(), dryRun: options.dryRun },
-    results
+    duration: Date.now() - startTime,
+    summary: { succeeded: 1, failed: 0, total: 1, warnings: 0 },
+    executionContext: { user: emailStr, workingDirectory: process.cwd(), dryRun: false },
+    results: [{ entity: rawBusUrl, platform: "posix", success: true, duration: Date.now() - startTime }]
   };
 }
-var unarchiveCmd = new CommandBuilder().name("unarchive").description("Restore an archived semiont resource (file must already exist on disk)").requiresEnvironment(true).requiresServices(false).examples(
-  "semiont unarchive docs/old.md"
+var loginCmd = new CommandBuilder().name("login").description(
+  "Authenticate against a Semiont backend and cache the token. Run this once before using browse, gather, mark, bind, match, listen, yield, or beckon. Credentials resolved from: --bus/--user/--password flags \u2192 $SEMIONT_BUS/$SEMIONT_USER/$SEMIONT_PASSWORD \u2192 ~/.semiontconfig \u2192 interactive prompt."
+).requiresEnvironment(false).requiresServices(false).examples(
+  "semiont login --bus http://localhost:4000 --user alice@example.com",
+  "semiont login --bus https://api.acme.com",
+  "semiont login --refresh --bus https://api.acme.com"
 ).args({
-  args: {},
-  aliases: {},
-  restAs: "files"
-}).schema(UnarchiveOptionsSchema).handler(runUnarchive).build();
+  args: {
+    ...BASE_ARGS,
+    "--bus": {
+      type: "string",
+      description: "Backend URL (e.g. http://localhost:4000). Fallback: $SEMIONT_BUS \u2192 ~/.semiontconfig"
+    },
+    "--user": {
+      type: "string",
+      description: "Login email. Fallback: $SEMIONT_USER \u2192 ~/.semiontconfig [environments.<env>.auth] email"
+    },
+    "--password": {
+      type: "string",
+      description: "Login password. Fallback: $SEMIONT_PASSWORD \u2192 ~/.semiontconfig \u2192 interactive prompt"
+    },
+    "--refresh": {
+      type: "boolean",
+      description: "Re-authenticate using cached email without requiring a new password (if stored)",
+      default: false
+    }
+  },
+  aliases: { ...BASE_ALIASES, "-b": "--bus", "-u": "--user" }
+}).schema(LoginOptionsSchema).handler(runLogin).build();
 
 // src/core/command-discovery.ts
 var commandCache = /* @__PURE__ */ new Map();
@@ -30265,8 +31224,14 @@ var COMMANDS = {
   "clean": cleanCommand,
   "mv": mvCmd,
   "yield": yieldCmd,
-  "archive": archiveCmd,
-  "unarchive": unarchiveCmd
+  "mark": markCmd,
+  "gather": gatherCmd,
+  "match": matchCmd,
+  "bind": bindCmd,
+  "beckon": beckonCmd,
+  "browse": browseCmd,
+  "listen": listenCmd,
+  "login": loginCmd
 };
 async function loadCommand(name) {
   if (commandCache.has(name)) {