@standards/cli 0.0.0-stage → 1.0.0-alpha.384

package/dist/bin.mjs

@@ -0,0 +1,2056 @@
+#!/usr/bin/env node
+/*! © 2025-2026 AND YOU CREATE SAS (RCS Paris 940 190 614). Proprietary — see LICENSE (Standards SDK License 1.0). */
+import { createRequire } from "node:module";
+import { styleText } from "node:util";
+import { StandardsRequestError, createTransport } from "@standards/client";
+import { Command } from "commander";
+import { DEVICE_CHANNEL_WORKER_CLOSE_PROTOCOL_VIOLATION, RECORDING_OVERRIDES, RECORD_ACCESS_ROLES, RESOURCE_VISIBILITIES, SchemaError, SchemaErrorCode, ValidationError, canonicalStringify, computeReconnectDelay, computeRetryDelay, deviceChannelUrl, diffSchemaState, formatByteSize, parseRecordAccessRole, parseSchemaState, parseServerFrame, schemaStateSourcePayload } from "@standards/schema";
+import Table from "cli-table3";
+import { createAppClient } from "@standards/client/app";
+import { homedir, hostname } from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+import { access, chmod, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { WebSocket } from "ws";
+import { spawn } from "node:child_process";
+import { constants, createWriteStream } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { buildOperationPath, recordsOperations } from "@standards/schema/api";
+import { stdin, stdout } from "node:process";
+import { createInterface } from "node:readline/promises";
+//#region src/output.ts
+const MAX_CELL_WIDTH = 50;
+function truncate(value, maxLength) {
+	if (value.length <= maxLength) return value;
+	return `${value.slice(0, maxLength - 1)}…`;
+}
+function escapeCsvValue(value) {
+	if (value === null || value === void 0) return "";
+	const str = typeof value === "object" ? JSON.stringify(value) : String(value);
+	if (str.includes(",") || str.includes("\"") || str.includes("\n")) return `"${str.replace(/"/g, "\"\"")}"`;
+	return str;
+}
+function formatJson(data) {
+	return JSON.stringify(data, null, 2);
+}
+function formatCsv(items) {
+	if (items.length === 0) return "";
+	const headers = Object.keys(items[0]);
+	return [headers.join(","), ...items.map((item) => headers.map((h) => escapeCsvValue(item[h])).join(","))].join("\n");
+}
+function formatTable(items) {
+	if (items.length === 0) return "No results.";
+	const headers = Object.keys(items[0]);
+	const table = new Table({
+		head: headers.map((h) => styleText("bold", h)),
+		style: {
+			head: [],
+			border: []
+		}
+	});
+	for (const item of items) {
+		const row = headers.map((h) => {
+			const val = item[h];
+			if (val === null || val === void 0) return "";
+			return truncate(typeof val === "object" ? JSON.stringify(val) : String(val), MAX_CELL_WIDTH);
+		});
+		table.push(row);
+	}
+	return table.toString();
+}
+function formatOutput(data, format) {
+	if (format === "json") {
+		process.stdout.write(`${formatJson(data)}\n`);
+		return;
+	}
+	const items = Array.isArray(data) ? data : [data];
+	if (format === "csv") {
+		process.stdout.write(`${formatCsv(items)}\n`);
+		return;
+	}
+	process.stdout.write(`${formatTable(items)}\n`);
+}
+//#endregion
+//#region src/client.ts
+/** The CLI's transport: the profile's bearer key and tenant header over the shared HTTP transport. */
+function createClient(config) {
+	return createTransport({
+		baseUrl: config.apiUrl,
+		apiKey: config.apiKey,
+		tenantId: config.tenantId
+	});
+}
+//#endregion
+//#region src/commands/common.ts
+function getGlobalOptions(cmd) {
+	return cmd.optsWithGlobals();
+}
+function getFormat(cmd) {
+	return getGlobalOptions(cmd).format;
+}
+/** Parse a comma-separated flag value into a trimmed, non-empty list. */
+function parseCsvList(value) {
+	return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
+function getClientFromCommand(cmd) {
+	const root = getGlobalOptions(cmd);
+	if (!(root.apiUrl && root.apiKey)) throw new Error("No Standards instance configured. Run \"standards login\" or pass --api-key.");
+	return createClient({
+		apiUrl: root.apiUrl,
+		apiKey: root.apiKey,
+		tenantId: root.tenant
+	});
+}
+/** The operation-contract client over the same transport, for the routes the contract covers. */
+function getAppClientFromCommand(cmd) {
+	return createAppClient(getClientFromCommand(cmd));
+}
+/**
+* The `--tenant` guard every admin command shares. The API takes the tenant in
+* the body as a confirmation of intent, never as a target selector: it refuses
+* any value other than the authenticated tenant. The CLI cannot invent it, so
+* it asks for it rather than guessing the primary tenant.
+*
+* `message` is passed whole rather than composed: each command's exact wording
+* is what its users (and its tests) read.
+*/
+function requireTenant(cmd, message) {
+	const { tenant } = getGlobalOptions(cmd);
+	if (!tenant) throw new Error(message);
+	return tenant;
+}
+/**
+* The `--yes` guard for a destructive or outbound command: shared rather than
+* inlined so the refusal is a typed `ValidationError`, not a raw `Error`. The
+* commands that still inline their own check belong here when they move.
+*
+* Like `requireTenant`, `message` is passed whole rather than composed: each
+* command's exact wording is what its users (and its tests) read.
+*/
+function requireConfirmation(yes, message) {
+	if (!yes) throw new ValidationError(message, []);
+}
+/** Renders any caught value as a message string — shared by every command's top-level `catch`. */
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/commands/ai.ts
+const SCOPES = ["me", "workspace"];
+/** `GET /ai/usage` reads inclusive UTC days; anything else reaches the API as a 400. */
+const ISO_DAY = /^\d{4}-\d{2}-\d{2}$/u;
+function parseDay(flag, value) {
+	if (!ISO_DAY.test(value)) throw new ValidationError(`${flag} must be a YYYY-MM-DD date`, []);
+	return value;
+}
+/**
+* The window's own rules (maximum span, ordering) belong to the server, which
+* owns the calendar; the CLI only rejects what it can judge on its own.
+*/
+function parseScope(scope) {
+	if (SCOPES.includes(scope)) return scope;
+	throw new ValidationError(`--scope must be one of: ${SCOPES.join(", ")}`, []);
+}
+function registerAiCommand(program) {
+	const ai = program.command("ai").description("Inspect AI usage and credit state");
+	ai.command("usage").description("Aggregate the AI journal over an inclusive UTC day window").requiredOption("--from <day>", "first day of the window (YYYY-MM-DD)").requiredOption("--to <day>", "last day of the window, inclusive (YYYY-MM-DD)").option("--scope <scope>", "me or workspace", "me").action(async (opts, cmd) => {
+		const params = {
+			from: parseDay("--from", opts.from),
+			to: parseDay("--to", opts.to),
+			scope: parseScope(opts.scope ?? "me")
+		};
+		formatOutput(await getAppClientFromCommand(cmd).ai.usage(params), getFormat(cmd));
+	});
+	ai.command("wallet").description("Show the tenant's billing mode and AI credit state").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).ai.wallet({}), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/auth.ts
+function registerAuthCommand(program) {
+	program.command("auth").description("Inspect CLI authentication").command("whoami").description("Show current configuration and validate API key").action(async (_opts, cmd) => {
+		const root = getGlobalOptions(cmd);
+		const client = getAppClientFromCommand(cmd);
+		const write = (msg) => process.stdout.write(`${msg}\n`);
+		write(styleText("bold", "Standards CLI Configuration"));
+		write(`  API URL:  ${root.apiUrl}`);
+		write(`  API Key:  ${root.apiKey ? `${root.apiKey.slice(0, 8)}...` : styleText("red", "not set")}`);
+		write("");
+		const keys = await client.apiKeys.list({});
+		write(styleText("green", "✓ API key is valid"));
+		if (Array.isArray(keys) && keys.length > 0) write(`  Active keys: ${keys.filter((key) => !key.revokedAt).length}`);
+	});
+}
+//#endregion
+//#region src/commands/bundles.ts
+/**
+* System bundles (admin / workspace:manage). A bundle is a code-defined,
+* versioned set of schema that can be assigned to — and updated on — a tenant.
+*/
+function registerBundlesCommand(program) {
+	const bundles = program.command("bundles").description("Manage system bundles assigned to the current tenant (admin)");
+	bundles.command("list").description("List the bundles actively assigned to the current tenant").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).bundles.listAssigned({}), getFormat(cmd));
+	});
+	bundles.command("updatable").description("List assigned bundles that have a newer version available").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).bundles.listUpdatable({}), getFormat(cmd));
+	});
+	bundles.command("assign").description("Assign (install) a bundle to the current tenant").argument("<bundleId>", "bundle ID to assign").action(async (bundleId, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).bundles.assign({ bundleId }), getFormat(cmd));
+	});
+	bundles.command("uninstall").description("Uninstall a bundle: deactivate it and demote its now-orphaned objects").argument("<bundleId>", "bundle ID to uninstall").option("--yes", "uninstall without confirmation").action(async (bundleId, opts, cmd) => {
+		if (!opts.yes) throw new Error("Uninstalling a bundle is explicit. Re-run with \"--yes\" to confirm.");
+		formatOutput(await getAppClientFromCommand(cmd).bundles.uninstall({ bundleId }), getFormat(cmd));
+	});
+	bundles.command("update").description("Apply assigned bundles — picks up newer bundle versions (additive sync)").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).bundles.update({}), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/codemod.ts
+/** Rewrites consumer code for a breaking SDK change. */
+function registerCodemodCommand(program) {
+	const codemod = program.command("codemod").description("Rewrite code for a breaking SDK change");
+	codemod.command("builder-shorthand").description("Rewrite text({ name, label }) builders to text(name, label)").argument("[paths...]", "files or directories to rewrite", ["."]).option("--dry-run", "report without writing").option("--relative-imports", "also treat relative imports as Standards builders — for the Standards monorepo itself").action(async (paths, opts) => {
+		const { runBuilderShorthand } = await import("./builder-shorthand-DPVmGTec.mjs");
+		const report = await runBuilderShorthand(paths, {
+			write: !opts.dryRun,
+			relativeImports: opts.relativeImports === true
+		});
+		const verb = opts.dryRun ? "Would rewrite" : "Rewrote";
+		process.stdout.write(`${verb} ${report.changed} calls in ${report.files} files.\n`);
+		for (const call of report.skipped) process.stdout.write(`${call.file}:${call.line}:${call.column}  ${call.callee}  ${call.reason}\n`);
+		if (report.skipped.length > 0) {
+			process.stdout.write(`${report.skipped.length} calls need a manual rewrite to fn(name, label), then re-run "standards codemod builder-shorthand".\n`);
+			process.exitCode = 1;
+		}
+	});
+	codemod.command("palette").description("Rewrite old colour ids (blue, green, ...) to the Standards palette").argument("[paths...]", "files or directories to rewrite", ["."]).option("--dry-run", "report without writing").action(async (paths, opts) => {
+		const { runPalette } = await import("./palette-D63ag-eX.mjs");
+		const report = await runPalette(paths, { write: !opts.dryRun });
+		const verb = opts.dryRun ? "Would rewrite" : "Rewrote";
+		process.stdout.write(`${verb} ${report.changed} colours in ${report.files} files.\n`);
+		if (opts.dryRun) for (const entry of report.rewritten) process.stdout.write(`  ${entry.file}: ${entry.changed}\n`);
+		for (const failure of report.failures) process.stderr.write(`${failure.message}\n`);
+		if (report.failures.length > 0) process.exitCode = 1;
+	});
+	codemod.command("image").description("Rewrite .imageShape(x) to .image({ shape: x }) and appearance.imageFileId to appearance.image?.fileId").argument("[paths...]", "files or directories to rewrite", ["."]).option("--dry-run", "report without writing").action(async (paths, opts) => {
+		const { runImage } = await import("./image-Ca-XlG3r.mjs");
+		const report = await runImage(paths, { write: !opts.dryRun });
+		const verb = opts.dryRun ? "Would rewrite" : "Rewrote";
+		process.stdout.write(`${verb} ${report.changed} references in ${report.files} files.\n`);
+		for (const { file, line, column } of report.skipped) process.stdout.write(`${file}:${line}:${column}  appearance.imageFileId  a write, rewrite by hand\n`);
+		for (const failure of report.failures) process.stderr.write(`${failure.message}\n`);
+		if (report.skipped.length > 0 || report.failures.length > 0) process.exitCode = 1;
+	});
+	codemod.command("engine-imports").description("Move imports of names that left @standards/schema to @standards/engine").argument("[paths...]", "files or directories to rewrite", ["."]).option("--dry-run", "report without writing").option("--root <dir>", "where @standards/schema and @standards/engine are installed", ".").action(async (paths, opts) => {
+		const { runEngineImports } = await import("./engine-imports-K-yySYo3.mjs");
+		const report = await runEngineImports(paths, {
+			write: !opts.dryRun,
+			root: opts.root
+		});
+		if (typeof report === "string") {
+			process.stderr.write(`${report}\n`);
+			process.exitCode = 1;
+			return;
+		}
+		const verb = opts.dryRun ? "Would move" : "Moved";
+		process.stdout.write(`${verb} ${report.moved} imports in ${report.files} files.\n`);
+		for (const { file, name } of report.unresolved) process.stdout.write(`${file}  ${name}  not moved, check by hand\n`);
+		for (const failure of report.failures) process.stderr.write(`${failure.message}\n`);
+		if (report.failures.length > 0) process.exitCode = 1;
+	});
+	codemod.command("scopes").description("Move every @stndrds/* package to @standards/* and point @standards at the licensed registry").argument("[paths...]", "files or directories to rewrite", ["."]).option("--dry-run", "report without writing").option("--root <dir>", "where the project's .npmrc lives", ".").action(async (paths, opts) => {
+		const { runScopes } = await import("./scopes-Bqw1v3wB.mjs");
+		const report = await runScopes(paths, {
+			write: !opts.dryRun,
+			root: opts.root
+		});
+		const verb = opts.dryRun ? "Would rewrite" : "Rewrote";
+		process.stdout.write(`${verb} ${report.changed} references in ${report.files} files.\n`);
+		if (report.npmrc !== void 0) {
+			const action = opts.dryRun ? "Would point" : "Pointed";
+			process.stdout.write(`${action} @standards at the licensed registry in ${report.npmrc}.\n`);
+		}
+		if (!report.licensed) {
+			process.stdout.write("Then reinstall to refresh the lockfile.\n");
+			return;
+		}
+		process.stdout.write([
+			"Your licence key goes in your user ~/.npmrc, never the project one (pnpm ignores it there):",
+			"  npm config set \"//registry.standards.run/:_authToken\" \"$STANDARDS_TOKEN\"",
+			"In CI, add it to $HOME/.npmrc before installing, with STANDARDS_TOKEN set from a secret:",
+			`  echo '//registry.standards.run/:_authToken=\${STANDARDS_TOKEN}' >> "$HOME/.npmrc"`,
+			"Then reinstall to refresh the lockfile.",
+			""
+		].join("\n"));
+	});
+}
+//#endregion
+//#region src/commands/connectors.ts
+const PROVIDERS = Object.keys({
+	github: true,
+	slack: true,
+	gmail: true,
+	outlook: true,
+	"google-calendar": true,
+	"outlook-calendar": true
+});
+const CAPABILITIES = Object.keys({
+	modify: true,
+	send: true
+});
+/** Parse a comma-separated `--capabilities` flag; unknown tiers are refused before the request. */
+function parseCapabilities(raw) {
+	if (raw === void 0) return void 0;
+	const requested = raw.split(",").map((c) => c.trim()).filter((c) => c.length > 0);
+	if (requested.filter((c) => !CAPABILITIES.includes(c)).length > 0) throw new ValidationError(`--capabilities must be a comma-separated list of: ${CAPABILITIES.join(", ")}`, []);
+	return requested;
+}
+/** Coerce a free-form scope flag to the two values the API accepts. */
+function resolveScope(scope) {
+	return scope === "actor" ? "actor" : "tenant";
+}
+function registerConnectorsCommand(program) {
+	const connectors = program.command("connectors").description("Manage connectors (OAuth connections)");
+	connectors.command("providers").description("List the connector providers this deployment holds credentials for").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).connectors.providers({}), getFormat(cmd));
+	});
+	connectors.command("list").description("List connector connections").option("--scope <scope>", "connection scope (tenant or actor)", "tenant").action(async (opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).connectors.list({ scope: resolveScope(opts.scope) }), getFormat(cmd));
+	});
+	connectors.command("connect").description("Start an OAuth flow and return the authorization URL to open").requiredOption("--provider <provider>", `connector provider (${PROVIDERS.join(", ")}); run "connectors providers" for the ones this deployment configured`).option("--scope <scope>", "connection scope (tenant or actor)", "tenant").option("--capabilities <list>", `comma-separated capability tiers beyond read (${CAPABILITIES.join(", ")})`).action(async (opts, cmd) => {
+		if (!PROVIDERS.includes(opts.provider)) throw new ValidationError(`--provider must be one of: ${PROVIDERS.join(", ")}`, []);
+		const capabilities = parseCapabilities(opts.capabilities);
+		formatOutput(await getAppClientFromCommand(cmd).connectors.startAuth({
+			provider: opts.provider,
+			scope: resolveScope(opts.scope),
+			...capabilities ? { capabilities } : {}
+		}), getFormat(cmd));
+	});
+	connectors.command("disconnect").description("Disconnect (delete) a connector connection").argument("<id>", "connection ID").option("--yes", "disconnect without confirmation").option("--remove-imported", "also remove what a mail or calendar connection imported (kept by default)").action(async (id, opts, cmd) => {
+		if (!opts.yes) throw new Error("Disconnecting a connector is explicit. Re-run with \"--yes\" to confirm.");
+		await getAppClientFromCommand(cmd).connectors.delete({
+			id,
+			...opts.removeImported ? { removeImported: "true" } : {}
+		});
+		process.stdout.write(`${styleText("green", "✓")} Connector connection ${id} disconnected.\n`);
+	});
+}
+//#endregion
+//#region src/config.ts
+const DEFAULT_API_URL = "http://localhost:4100/v1";
+const ENV_PROFILE_NAME = "sandbox";
+function getDefaultApiUrl() {
+	return DEFAULT_API_URL;
+}
+function getConfigPath() {
+	const configDir = process.env.STANDARDS_CONFIG_DIR ?? join(homedir(), ".standards");
+	return join(configDir, "config.json");
+}
+async function readConfig() {
+	try {
+		const raw = await readFile(getConfigPath(), "utf8");
+		const parsed = JSON.parse(raw);
+		return {
+			...parsed.installationId ? { installationId: parsed.installationId } : {},
+			currentProfile: parsed.currentProfile,
+			profiles: parsed.profiles ?? {}
+		};
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return { profiles: {} };
+		throw error;
+	}
+}
+async function writeConfig(config) {
+	const path = getConfigPath();
+	const directory = dirname(path);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(directory, 448);
+	await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+	await chmod(path, 384);
+}
+function normalizeApiOrigin(apiUrl) {
+	try {
+		return new URL(apiUrl).origin;
+	} catch {
+		return apiUrl.replace(/\/+$/, "");
+	}
+}
+async function upsertProfile(input) {
+	const config = await readConfig();
+	const existingProfile = config.profiles[input.name];
+	const device = existingProfile?.device && normalizeApiOrigin(existingProfile.apiUrl) === normalizeApiOrigin(input.apiUrl) ? existingProfile.device : void 0;
+	config.profiles[input.name] = {
+		apiUrl: input.apiUrl,
+		apiKey: input.apiKey,
+		...device ? { device } : {}
+	};
+	config.currentProfile = input.name;
+	await writeConfig(config);
+}
+async function getOrCreateInstallationId() {
+	const config = await readConfig();
+	if (config.installationId) return config.installationId;
+	const installationId = randomUUID();
+	config.installationId = installationId;
+	await writeConfig(config);
+	return installationId;
+}
+async function getStoredDeviceCredential(profileName) {
+	return (await readConfig()).profiles[profileName]?.device ?? null;
+}
+async function storeDeviceCredential(profileName, credential) {
+	const config = await readConfig();
+	const profile = config.profiles[profileName];
+	if (!profile) return false;
+	profile.device = credential;
+	await writeConfig(config);
+	return true;
+}
+async function removeDeviceCredential(profileName) {
+	const config = await readConfig();
+	const profile = config.profiles[profileName];
+	if (!profile?.device) return false;
+	profile.device = void 0;
+	await writeConfig(config);
+	return true;
+}
+async function setCurrentProfile(name) {
+	const config = await readConfig();
+	if (!config.profiles[name]) throw new Error(`Unknown Standards instance "${name}"`);
+	config.currentProfile = name;
+	await writeConfig(config);
+}
+async function removeProfile(name) {
+	const config = await readConfig();
+	const profileName = name ?? config.currentProfile;
+	if (!profileName) return;
+	delete config.profiles[profileName];
+	if (config.currentProfile === profileName) config.currentProfile = void 0;
+	await writeConfig(config);
+}
+async function listProfiles() {
+	const config = await readConfig();
+	const profiles = Object.entries(config.profiles).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({
+		name,
+		apiUrl: profile.apiUrl,
+		current: config.currentProfile === name
+	}));
+	const envProfile = getEnvProfile();
+	if (envProfile) profiles.push({
+		name: ENV_PROFILE_NAME,
+		apiUrl: envProfile.apiUrl,
+		current: !config.currentProfile,
+		source: "env"
+	});
+	return profiles;
+}
+async function getActiveProfile() {
+	const config = await readConfig();
+	if (!config.currentProfile) {
+		const envProfile = getEnvProfile();
+		return envProfile ? {
+			name: ENV_PROFILE_NAME,
+			...envProfile
+		} : null;
+	}
+	const profile = config.profiles[config.currentProfile];
+	if (!profile) return null;
+	return {
+		name: config.currentProfile,
+		...profile
+	};
+}
+function getEnvProfile() {
+	if (!process.env.STANDARDS_API_KEY) return null;
+	return {
+		apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+		apiKey: process.env.STANDARDS_API_KEY
+	};
+}
+async function resolveCliConfig(options) {
+	if (options.apiUrl || options.apiKey) return {
+		apiUrl: options.apiUrl ?? process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+		apiKey: options.apiKey ?? process.env.STANDARDS_API_KEY
+	};
+	const config = await readConfig();
+	const profileName = options.instance ?? config.currentProfile;
+	if (profileName) {
+		const profile = config.profiles[profileName];
+		if (!profile) throw new Error(`Unknown Standards instance "${profileName}"`);
+		return {
+			apiUrl: profile.apiUrl,
+			apiKey: profile.apiKey,
+			profileName
+		};
+	}
+	return {
+		apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+		apiKey: process.env.STANDARDS_API_KEY
+	};
+}
+//#endregion
+//#region src/device/worker-client.ts
+/** How long a connection may wait for `ready` after sending `authenticate`. */
+const REQUEST_TIMEOUT_MS = 3e4;
+/** The code the SERVER closes an authenticated-but-not-ready socket with. */
+const SERVER_POLICY_VIOLATION_CLOSE_CODE = 1008;
+const NORMAL_CLOSE_CODE = 1e3;
+const BROWSER_COMMAND_REFUSED = "Shell worker cannot run browser commands";
+const EMPTY_SHELL_COMMAND_REFUSED = "Shell command frame carries no command";
+var DeviceWorkerRequestError = class extends SchemaError {
+	constructor(statusCode, message, code = SchemaErrorCode.REPOSITORY_QUERY_FAILED) {
+		super(message, code, { statusCode });
+		this.statusCode = statusCode;
+		this.name = "DeviceWorkerRequestError";
+	}
+};
+var DeviceCredentialRejectedError = class extends DeviceWorkerRequestError {
+	constructor() {
+		super(401, "Device credential rejected; run standards device pair again", SchemaErrorCode.ACCESS_DENIED);
+		this.name = "DeviceCredentialRejectedError";
+	}
+};
+/** The lease poll's own curve: 250 ms doubling up to 10 s, well under the channel's. */
+const LEASE_RETRY = {
+	initialMs: 250,
+	maxMs: 1e4
+};
+function computeRetryDelay$1(attempt, random = Math.random) {
+	return computeRetryDelay(attempt, random, LEASE_RETRY);
+}
+function abortError() {
+	return new DOMException("Aborted", "AbortError");
+}
+function isAbortError$1(error) {
+	return error instanceof DOMException && error.name === "AbortError";
+}
+function sleepWithAbort(milliseconds, signal) {
+	if (signal?.aborted) return Promise.reject(abortError());
+	return new Promise((resolve, reject) => {
+		function abort() {
+			clearTimeout(timer);
+			reject(abortError());
+		}
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", abort);
+			resolve();
+		}, milliseconds);
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+function withAbort(promise, signal) {
+	if (!signal) return promise;
+	if (signal.aborted) return Promise.reject(abortError());
+	return new Promise((resolve, reject) => {
+		const abort = () => reject(abortError());
+		signal.addEventListener("abort", abort, { once: true });
+		promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+	});
+}
+function transmit(socket, frame) {
+	return new Promise((resolve, reject) => {
+		socket.send(JSON.stringify(frame), (error) => {
+			if (error) reject(new DeviceWorkerRequestError(0, "Device channel send failed"));
+			else resolve();
+		});
+	});
+}
+function leasedCommand(frame, command) {
+	return {
+		id: frame.id,
+		leaseToken: frame.leaseToken,
+		intent: frame.intent,
+		command,
+		timeoutMs: frame.timeoutMs,
+		...typeof frame.cwd === "string" ? { cwd: frame.cwd } : {}
+	};
+}
+/**
+* One WebSocket to the device channel. The first frame authenticates the
+* device; commands are queued as they arrive and handed to `lease()`.
+* A dropped connection reconnects with backoff; a credential rejection
+* (`revoked`, or close 1008 before `ready`) is terminal.
+*/
+var DeviceWorkerClient = class {
+	constructor(options) {
+		this.lifecycle = new AbortController();
+		this.queue = [];
+		this.waiters = /* @__PURE__ */ new Set();
+		this.cancellations = /* @__PURE__ */ new Map();
+		this.socket = null;
+		this.ready = false;
+		this.connection = null;
+		this.rejection = null;
+		this.closed = false;
+		this.url = deviceChannelUrl(options.apiUrl);
+		this.credential = `Device ${options.token}`;
+		this.sleep = options.sleep ?? sleepWithAbort;
+		this.random = options.random ?? Math.random;
+		this.now = options.now ?? Date.now;
+	}
+	/** Stops reconnecting and closes the socket; pending and later leases reject with an AbortError. */
+	close() {
+		this.closed = true;
+		this.lifecycle.abort();
+		this.socket?.close(NORMAL_CLOSE_CODE);
+		this.failWaiters(abortError());
+	}
+	lease(signal) {
+		if (this.rejection) return Promise.reject(this.rejection);
+		if (this.closed || signal?.aborted) return Promise.reject(abortError());
+		this.connection ??= this.maintainConnection().catch((error) => this.failWaiters(error));
+		const queued = this.queue.shift();
+		if (queued) return Promise.resolve(queued);
+		return new Promise((resolve, reject) => {
+			const settle = () => {
+				this.waiters.delete(waiter);
+				signal?.removeEventListener("abort", abort);
+			};
+			const waiter = {
+				resolve: (command) => {
+					settle();
+					resolve(command);
+				},
+				reject: (error) => {
+					settle();
+					reject(error);
+				}
+			};
+			const abort = () => waiter.reject(abortError());
+			signal?.addEventListener("abort", abort, { once: true });
+			this.waiters.add(waiter);
+		});
+	}
+	async markRunning(commandId, leaseToken) {
+		await this.send({
+			type: "running",
+			id: commandId,
+			leaseToken
+		});
+	}
+	async heartbeat(commandId, leaseToken, signal) {
+		const cancelled = this.cancellations.get(commandId);
+		if (cancelled) return {
+			cancel: true,
+			reason: cancelled
+		};
+		await withAbort(this.send({
+			type: "heartbeat",
+			id: commandId,
+			leaseToken
+		}), signal);
+		const reason = this.cancellations.get(commandId);
+		return reason ? {
+			cancel: true,
+			reason
+		} : { cancel: false };
+	}
+	async output(commandId, leaseToken, stdout, stderr) {
+		if (!(stdout || stderr)) return;
+		await this.send({
+			type: "output",
+			id: commandId,
+			leaseToken,
+			...stdout ? { stdout } : {},
+			...stderr ? { stderr } : {}
+		});
+	}
+	async complete(commandId, leaseToken, result) {
+		await this.send({
+			type: "complete",
+			id: commandId,
+			leaseToken,
+			result: {
+				stdout: result.stdout,
+				stderr: result.stderr,
+				exitCode: result.exitCode,
+				success: result.success,
+				...result.errorCode ? { errorCode: result.errorCode } : {}
+			}
+		});
+		this.cancellations.delete(commandId);
+	}
+	send(frame) {
+		const socket = this.socket;
+		if (!(socket && this.ready && socket.readyState === WebSocket.OPEN)) return Promise.reject(new DeviceWorkerRequestError(0, "Device channel is not connected"));
+		return transmit(socket, frame);
+	}
+	reject(error) {
+		this.rejection = error;
+		this.failWaiters(error);
+	}
+	failWaiters(error) {
+		for (const waiter of [...this.waiters]) waiter.reject(error);
+	}
+	deliver(command) {
+		const [waiter] = this.waiters;
+		if (waiter) waiter.resolve(command);
+		else this.queue.push(command);
+	}
+	async maintainConnection() {
+		const signal = this.lifecycle.signal;
+		let attempt = 0;
+		let lastDelay = 0;
+		while (!(signal.aborted || this.rejection)) {
+			const { ready, readyAt } = await this.connectOnce();
+			if (signal.aborted || this.rejection) return;
+			if (ready && readyAt !== null && this.now() - readyAt > lastDelay) attempt = 0;
+			lastDelay = computeReconnectDelay(attempt, this.random);
+			try {
+				await this.sleep(lastDelay, signal);
+			} catch (error) {
+				if (isAbortError$1(error)) return;
+				throw error;
+			}
+			attempt += 1;
+		}
+	}
+	/** Opens one socket and resolves once it has closed, telling whether and when `ready` was seen. */
+	connectOnce() {
+		return new Promise((resolve) => {
+			const signal = this.lifecycle.signal;
+			const socket = new WebSocket(this.url);
+			let authenticated = false;
+			let ready = false;
+			let readyAt = null;
+			const stop = () => socket.close(NORMAL_CLOSE_CODE);
+			const readyTimer = setTimeout(stop, REQUEST_TIMEOUT_MS);
+			signal.addEventListener("abort", stop, { once: true });
+			this.socket = socket;
+			socket.on("open", () => {
+				authenticated = true;
+				transmit(socket, {
+					type: "authenticate",
+					credential: this.credential
+				}).catch(stop);
+			});
+			socket.on("error", () => void 0);
+			socket.on("message", (data) => {
+				let frame;
+				try {
+					frame = parseServerFrame(data.toString());
+				} catch {
+					socket.close(DEVICE_CHANNEL_WORKER_CLOSE_PROTOCOL_VIOLATION, "DEVICE_CHANNEL_PROTOCOL");
+					return;
+				}
+				if (frame.type === "ready") {
+					clearTimeout(readyTimer);
+					ready = true;
+					readyAt = this.now();
+					this.ready = true;
+					return;
+				}
+				this.handleFrame(socket, frame);
+			});
+			socket.on("close", (code) => {
+				clearTimeout(readyTimer);
+				signal.removeEventListener("abort", stop);
+				this.socket = null;
+				this.ready = false;
+				if (code === SERVER_POLICY_VIOLATION_CLOSE_CODE && authenticated && !ready) this.reject(new DeviceCredentialRejectedError());
+				resolve({
+					ready,
+					readyAt
+				});
+			});
+		});
+	}
+	handleFrame(socket, frame) {
+		switch (frame.type) {
+			case "command":
+				this.receiveCommand(socket, frame);
+				return;
+			case "cancel":
+				this.cancellations.set(frame.id, frame.reason);
+				return;
+			case "reauthenticate":
+				transmit(socket, {
+					type: "authenticate",
+					credential: this.credential
+				}).catch(() => socket.close(NORMAL_CLOSE_CODE));
+				return;
+			case "revoked":
+				this.reject(new DeviceCredentialRejectedError());
+				socket.close(NORMAL_CLOSE_CODE);
+				return;
+			case "ping":
+				transmit(socket, { type: "pong" }).catch(() => socket.close(NORMAL_CLOSE_CODE));
+				return;
+		}
+	}
+	receiveCommand(socket, frame) {
+		if (frame.kind === "browser") {
+			this.refuse(socket, frame, BROWSER_COMMAND_REFUSED);
+			return;
+		}
+		if (frame.command === void 0) {
+			this.refuse(socket, frame, EMPTY_SHELL_COMMAND_REFUSED);
+			return;
+		}
+		this.deliver(leasedCommand(frame, frame.command));
+	}
+	/** Completes a command the shell worker cannot run, without handing it to the loop. */
+	refuse(socket, frame, stderr) {
+		const { id, leaseToken } = frame;
+		transmit(socket, {
+			type: "running",
+			id,
+			leaseToken
+		}).then(() => transmit(socket, {
+			type: "complete",
+			id,
+			leaseToken,
+			result: {
+				stdout: "",
+				stderr,
+				exitCode: 1,
+				success: false,
+				errorCode: "execution_failed"
+			}
+		})).catch(() => void 0);
+	}
+};
+//#endregion
+//#region src/device/process-runner.ts
+const OUTPUT_LIMIT = 3e4;
+const TERMINATION_GRACE_MS = 5e3;
+const TERMINATION_POLL_MS = 50;
+var BoundedTextBuffer = class {
+	constructor() {
+		this.decoder = new StringDecoder("utf8");
+		this.decoderFlushed = false;
+		this.value = "";
+		this.truncated = false;
+	}
+	append(chunk) {
+		if (this.truncated) return;
+		const text = typeof chunk === "string" ? chunk : this.decoder.write(Buffer.from(chunk));
+		this.appendText(text);
+	}
+	appendText(text) {
+		const remaining = OUTPUT_LIMIT - this.value.length;
+		if (text.length <= remaining) {
+			this.value += text;
+			return;
+		}
+		this.value += text.slice(0, Math.max(remaining, 0));
+		this.truncated = true;
+	}
+	toString() {
+		if (!this.decoderFlushed) {
+			this.decoderFlushed = true;
+			this.appendText(this.decoder.end());
+		}
+		return this.truncated ? `${this.value}\n... output truncated to ${OUTPUT_LIMIT} chars` : this.value;
+	}
+};
+function isMissingProcess(error) {
+	return error instanceof Error && "code" in error && error.code === "ESRCH";
+}
+function signalProcessGroup(pid, signal, kill) {
+	try {
+		kill(-pid, signal);
+		return true;
+	} catch (error) {
+		if (isMissingProcess(error)) return false;
+		throw error;
+	}
+}
+function beginProcessGroupTermination(pid, deps = {}) {
+	const kill = deps.kill ?? process.kill.bind(process);
+	const setTimer = deps.setTimer ?? setTimeout;
+	const clearTimer = deps.clearTimer ?? clearTimeout;
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let escalationTimer;
+		let pollTimer;
+		function clearTimers() {
+			if (escalationTimer) clearTimer(escalationTimer);
+			if (pollTimer) clearTimer(pollTimer);
+		}
+		function finish() {
+			if (settled) return;
+			settled = true;
+			clearTimers();
+			resolve();
+		}
+		function fail(error) {
+			if (settled) return;
+			settled = true;
+			clearTimers();
+			reject(error);
+		}
+		function poll() {
+			if (settled) return;
+			try {
+				if (!signalProcessGroup(pid, 0, kill)) {
+					finish();
+					return;
+				}
+				pollTimer = setTimer(poll, TERMINATION_POLL_MS);
+			} catch (error) {
+				fail(error);
+			}
+		}
+		try {
+			if (!signalProcessGroup(pid, "SIGTERM", kill)) {
+				finish();
+				return;
+			}
+			escalationTimer = setTimer(() => {
+				try {
+					if (!signalProcessGroup(pid, 0, kill)) {
+						finish();
+						return;
+					}
+					signalProcessGroup(pid, "SIGKILL", kill);
+				} catch (error) {
+					fail(error);
+				}
+			}, TERMINATION_GRACE_MS);
+			pollTimer = setTimer(poll, TERMINATION_POLL_MS);
+		} catch (error) {
+			fail(error);
+		}
+	});
+}
+async function resolveShell(shell = process.env.SHELL) {
+	if (!(shell && isAbsolute(shell))) return "/bin/sh";
+	try {
+		if (!(await stat(shell)).isFile()) return "/bin/sh";
+		await access(shell, constants.X_OK);
+		return shell;
+	} catch {
+		return "/bin/sh";
+	}
+}
+function terminalResult(reason, stdout, stderr) {
+	return {
+		stdout: stdout.toString(),
+		stderr: stderr.toString(),
+		exitCode: reason === "timed_out" ? 124 : 130,
+		success: false,
+		errorCode: reason
+	};
+}
+async function runDeviceProcess(input) {
+	if (input.signal?.aborted) return {
+		stdout: "",
+		stderr: "",
+		exitCode: 130,
+		success: false,
+		errorCode: "cancelled"
+	};
+	const shell = await resolveShell();
+	if (input.signal?.aborted) return {
+		stdout: "",
+		stderr: "",
+		exitCode: 130,
+		success: false,
+		errorCode: "cancelled"
+	};
+	const stdout = new BoundedTextBuffer();
+	const stderr = new BoundedTextBuffer();
+	return new Promise((resolve) => {
+		let settled = false;
+		let terminationReason;
+		let termination;
+		let child;
+		function finish(result) {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			input.signal?.removeEventListener("abort", cancel);
+			resolve(result);
+		}
+		function finishTerminationFailure(error) {
+			finish({
+				stdout: stdout.toString(),
+				stderr: error instanceof Error ? error.message : String(error),
+				exitCode: 1,
+				success: false,
+				errorCode: "execution_failed"
+			});
+		}
+		function terminate(reason) {
+			if (settled || terminationReason || !child?.pid) return;
+			terminationReason = reason;
+			termination = beginProcessGroupTermination(child.pid);
+			termination.catch(finishTerminationFailure);
+		}
+		function cancel() {
+			terminate("cancelled");
+		}
+		const timeout = setTimeout(() => terminate("timed_out"), input.timeoutMs);
+		try {
+			child = spawn(shell, ["-lc", input.command], {
+				cwd: input.cwd,
+				env: process.env,
+				detached: true,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+		} catch (error) {
+			finish({
+				stdout: "",
+				stderr: error instanceof Error ? error.message : String(error),
+				exitCode: 1,
+				success: false,
+				errorCode: "execution_failed"
+			});
+			return;
+		}
+		input.signal?.addEventListener("abort", cancel, { once: true });
+		if (input.signal?.aborted) cancel();
+		const spawned = child;
+		spawned.stdout.on("data", (chunk) => stdout.append(chunk));
+		spawned.stderr.on("data", (chunk) => stderr.append(chunk));
+		spawned.once("error", (error) => {
+			finish({
+				stdout: stdout.toString(),
+				stderr: error.message,
+				exitCode: 1,
+				success: false,
+				errorCode: "execution_failed"
+			});
+		});
+		spawned.once("close", (code) => {
+			if (terminationReason) {
+				const reason = terminationReason;
+				(termination ?? Promise.resolve()).then(() => finish(terminalResult(reason, stdout, stderr)), finishTerminationFailure);
+				return;
+			}
+			const exitCode = code ?? 1;
+			finish({
+				stdout: stdout.toString(),
+				stderr: stderr.toString(),
+				exitCode,
+				success: exitCode === 0,
+				...code === null ? { errorCode: "execution_failed" } : {}
+			});
+		});
+	});
+}
+//#endregion
+//#region src/device/worker-loop.ts
+const HEARTBEAT_INTERVAL_MS = 2e3;
+function isAbortError(error) {
+	return error instanceof DOMException && error.name === "AbortError";
+}
+/** The channel client reconnects on its own; only a transport failure (status 0) is retried here. */
+function isRetryableIdleError(error) {
+	return error instanceof DeviceWorkerRequestError && error.statusCode === 0;
+}
+function isLeaseConflict(error) {
+	return error instanceof DeviceWorkerRequestError && error.statusCode === 409;
+}
+async function executeLease(command, input, runProcess, sleep) {
+	try {
+		await input.client.markRunning(command.id, command.leaseToken);
+	} catch (error) {
+		if (error instanceof DeviceCredentialRejectedError) throw error;
+		return;
+	}
+	input.onEvent?.({
+		type: "running",
+		commandId: command.id,
+		intent: command.intent
+	});
+	const commandController = new AbortController();
+	const heartbeatController = new AbortController();
+	let completionAllowed = true;
+	let heartbeatFailure;
+	function abortCommand() {
+		commandController.abort();
+	}
+	input.signal.addEventListener("abort", abortCommand, { once: true });
+	const processPromise = runProcess({
+		command: command.command,
+		cwd: command.cwd,
+		timeoutMs: command.timeoutMs,
+		signal: commandController.signal
+	});
+	const heartbeatPromise = (async () => {
+		while (!heartbeatController.signal.aborted) try {
+			await sleep(HEARTBEAT_INTERVAL_MS, heartbeatController.signal);
+			const heartbeat = await input.client.heartbeat(command.id, command.leaseToken, heartbeatController.signal);
+			if (heartbeat.cancel) {
+				if (heartbeat.reason === "revoked") completionAllowed = false;
+				commandController.abort();
+				return;
+			}
+		} catch (error) {
+			if (heartbeatController.signal.aborted && isAbortError(error)) return;
+			heartbeatFailure = error;
+			completionAllowed = false;
+			commandController.abort();
+			return;
+		}
+	})();
+	let result;
+	try {
+		result = await processPromise;
+	} catch (error) {
+		result = {
+			stdout: "",
+			stderr: error instanceof Error ? error.message : String(error),
+			exitCode: 1,
+			success: false,
+			errorCode: "execution_failed"
+		};
+	} finally {
+		heartbeatController.abort();
+		await heartbeatPromise;
+		input.signal.removeEventListener("abort", abortCommand);
+	}
+	if (heartbeatFailure instanceof DeviceCredentialRejectedError) throw heartbeatFailure;
+	if (!completionAllowed || isLeaseConflict(heartbeatFailure)) return;
+	try {
+		await input.client.output(command.id, command.leaseToken, result.stdout, result.stderr);
+		await input.client.complete(command.id, command.leaseToken, result);
+	} catch (error) {
+		if (error instanceof DeviceCredentialRejectedError) throw error;
+		return;
+	}
+	input.onEvent?.({
+		type: "completed",
+		commandId: command.id,
+		exitCode: result.exitCode
+	});
+}
+async function runDeviceWorker(input) {
+	const runProcess = input.runProcess ?? runDeviceProcess;
+	const sleep = input.sleep ?? sleepWithAbort;
+	const random = input.random ?? Math.random;
+	let retryAttempt = 0;
+	while (!input.signal.aborted) {
+		let command;
+		try {
+			command = await input.client.lease(input.signal);
+			retryAttempt = 0;
+		} catch (error) {
+			if (input.signal.aborted) return;
+			if (error instanceof DeviceCredentialRejectedError) throw error;
+			if (!isRetryableIdleError(error)) throw error;
+			try {
+				await sleep(computeRetryDelay$1(retryAttempt, random), input.signal);
+			} catch (sleepError) {
+				if (input.signal.aborted && isAbortError(sleepError)) return;
+				throw sleepError;
+			}
+			retryAttempt += 1;
+			continue;
+		}
+		if (!command) continue;
+		await executeLease(command, input, runProcess, sleep);
+	}
+}
+//#endregion
+//#region src/commands/device.ts
+const NAMED_PROFILE_REQUIRED = "Device pairing requires a named Standards profile";
+const SUPPORTED_PLATFORMS_REQUIRED = "Device workers support macOS and Linux only";
+var DeviceCommandError = class extends SchemaError {
+	constructor(message) {
+		super(message, SchemaErrorCode.VALIDATION_FAILED);
+		this.name = "DeviceCommandError";
+	}
+};
+function requireSupportedPlatform(platform) {
+	if (platform === "darwin" || platform === "linux") return platform;
+	throw new DeviceCommandError(SUPPORTED_PLATFORMS_REQUIRED);
+}
+function requireNamedProfile(command) {
+	const options = getGlobalOptions(command);
+	if (!(options.profileName && options.apiUrl && options.apiKey)) throw new DeviceCommandError(NAMED_PROFILE_REQUIRED);
+	return {
+		apiUrl: options.apiUrl,
+		apiKey: options.apiKey,
+		profileName: options.profileName,
+		tenantId: options.tenant
+	};
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseDeviceView(value) {
+	if (!isRecord(value)) throw new DeviceCommandError("Invalid device response");
+	const { id, name, platform, arch, hostname: deviceHostname } = value;
+	const { status } = value;
+	if (typeof id !== "string" || typeof name !== "string" || platform !== "darwin" && platform !== "linux" || typeof arch !== "string" || typeof deviceHostname !== "string" || status !== "online" && status !== "offline" && status !== "revoked") throw new DeviceCommandError("Invalid device response");
+	return {
+		id,
+		name,
+		platform,
+		arch,
+		hostname: deviceHostname,
+		status
+	};
+}
+function parsePairDeviceResponse(value) {
+	if (!isRecord(value) || typeof value.token !== "string") throw new DeviceCommandError("Invalid device pairing response");
+	return {
+		device: parseDeviceView(value.device),
+		token: value.token
+	};
+}
+function parseDeviceList(value) {
+	if (!Array.isArray(value)) throw new DeviceCommandError("Invalid device list response");
+	return value.map(parseDeviceView);
+}
+async function pairDevice(name, command) {
+	const platform = requireSupportedPlatform(process.platform);
+	const profile = requireNamedProfile(command);
+	const installationId = await getOrCreateInstallationId();
+	const client = createClient({
+		apiUrl: profile.apiUrl,
+		apiKey: profile.apiKey,
+		tenantId: profile.tenantId
+	});
+	const response = parsePairDeviceResponse(await createAppClient(client).devices.pair({
+		installationId,
+		name,
+		platform,
+		arch: process.arch,
+		hostname: hostname()
+	}));
+	if (!await storeDeviceCredential(profile.profileName, {
+		id: response.device.id,
+		name: response.device.name,
+		token: response.token
+	})) throw new DeviceCommandError(NAMED_PROFILE_REQUIRED);
+	process.stdout.write(`Paired ${response.device.name} (${response.device.id})\n`);
+}
+async function showDeviceStatus(command) {
+	const profile = requireNamedProfile(command);
+	const credential = await getStoredDeviceCredential(profile.profileName);
+	if (!credential) throw new DeviceCommandError("No paired device; run standards device pair first");
+	const client = createClient({
+		apiUrl: profile.apiUrl,
+		apiKey: profile.apiKey,
+		tenantId: profile.tenantId
+	});
+	const pairedDevice = parseDeviceList(await createAppClient(client).devices.list({})).find((device) => device.id === credential.id);
+	formatOutput(pairedDevice ? [pairedDevice] : [{
+		id: credential.id,
+		name: credential.name,
+		status: "revoked"
+	}], getFormat(command));
+}
+async function revokeDevice(command) {
+	const profile = requireNamedProfile(command);
+	const credential = await getStoredDeviceCredential(profile.profileName);
+	if (!credential) throw new DeviceCommandError("No paired device; run standards device pair first");
+	const client = createClient({
+		apiUrl: profile.apiUrl,
+		apiKey: profile.apiKey,
+		tenantId: profile.tenantId
+	});
+	await createAppClient(client).devices.revoke({ id: credential.id });
+	await removeDeviceCredential(profile.profileName);
+}
+async function serveDevice(command) {
+	const platform = requireSupportedPlatform(process.platform);
+	const profile = requireNamedProfile(command);
+	const credential = await getStoredDeviceCredential(profile.profileName);
+	if (!credential) throw new DeviceCommandError("No paired device; run standards device pair first");
+	const userClient = createClient({
+		apiUrl: profile.apiUrl,
+		apiKey: profile.apiKey,
+		tenantId: profile.tenantId
+	});
+	const device = parseDeviceList(await createAppClient(userClient).devices.list({})).find((candidate) => candidate.id === credential.id);
+	if (!device) throw new DeviceCommandError("Device is unavailable");
+	if (device.platform !== platform) throw new DeviceCommandError("Device platform does not match paired device");
+	const controller = new AbortController();
+	const stop = () => controller.abort();
+	process.once("SIGINT", stop);
+	process.once("SIGTERM", stop);
+	process.stdout.write(`Connected as ${credential.name}\n`);
+	process.stdout.write("Waiting for commands — press Ctrl+C to disconnect\n");
+	const client = new DeviceWorkerClient({
+		apiUrl: profile.apiUrl,
+		token: credential.token
+	});
+	try {
+		await runDeviceWorker({
+			client,
+			signal: controller.signal,
+			onEvent: (event) => {
+				if (event.type === "running") {
+					process.stdout.write(`Running ${event.commandId}: ${event.intent}\n`);
+					return;
+				}
+				process.stdout.write(`Completed ${event.commandId} with exit code ${event.exitCode}\n`);
+			}
+		});
+	} finally {
+		client.close();
+		process.removeListener("SIGINT", stop);
+		process.removeListener("SIGTERM", stop);
+	}
+}
+function registerDeviceCommand(program) {
+	const device = program.command("device").description("Pair and run this computer as a device");
+	device.command("pair").description("Pair this computer with Standards").requiredOption("--name <name>", "device name").action(async (options, command) => pairDevice(options.name, command));
+	device.command("status").description("Show the paired device status").action(async (_options, command) => showDeviceStatus(command));
+	device.command("revoke").description("Revoke this computer's device credential").action(async (_options, command) => revokeDevice(command));
+	device.command("serve").description("Run the foreground device worker").action(async (_options, command) => serveDevice(command));
+}
+//#endregion
+//#region src/drift/shared-state.ts
+async function readSchemaState(client) {
+	const state = parseSchemaState(await client.schemaState.get({}));
+	if (createHash("sha256").update(canonicalStringify(schemaStateSourcePayload(state.entries))).digest("hex") !== state.sourceFingerprint) throw new ValidationError("Invalid schema state: sourceFingerprint does not match deployed source", []);
+	return state;
+}
+function prettyCanonical(value) {
+	return JSON.stringify(JSON.parse(canonicalStringify(value)), null, 2);
+}
+//#endregion
+//#region src/commands/diff.ts
+async function runDiffCommand(client) {
+	try {
+		const diff = diffSchemaState(await readSchemaState(client));
+		return {
+			exitCode: diff.changes.length ? 1 : 0,
+			diff
+		};
+	} catch (error) {
+		return {
+			exitCode: 2,
+			errorMessage: messageOf(error)
+		};
+	}
+}
+function renderDiff(diff) {
+	return ["Deployed source vs shared runtime", ...diff.changes.length ? diff.changes.map((entry) => `${entry.change} ${JSON.stringify(entry.address)}`) : ["No differences."]].join("\n");
+}
+function registerDiffCommand(program) {
+	program.command("diff").description("Compare deployed source vs shared runtime; excludes unbuilt local TypeScript (exit 0 equal, 1 differences, 2 error)").option("--json", "Emit canonical machine-readable differences").action(async (opts, cmd) => {
+		let result;
+		try {
+			result = await runDiffCommand(getAppClientFromCommand(cmd));
+		} catch (error) {
+			result = {
+				exitCode: 2,
+				errorMessage: messageOf(error)
+			};
+		}
+		if (result.exitCode === 2) console.error(styleText("red", `✗ ${result.errorMessage}`));
+		else console.info(opts.json ? prettyCanonical(result.diff) : renderDiff(result.diff));
+		process.exit(result.exitCode);
+	});
+}
+//#endregion
+//#region src/commands/documents.ts
+/**
+* Human-readable table row for a pack file. `id` is kept (unlike other
+* dropped fields) because `remove-file <documentId> <fileId>` requires it —
+* this table is the only interactive way to discover it. Files are otherwise
+* anonymous: position is the display identity, never the (provenance-only)
+* filename.
+*/
+function toFileRow(file) {
+	return {
+		id: file.id,
+		position: file.position,
+		type: file.mimeType,
+		size: formatByteSize(file.size),
+		ocrStatus: file.ocrStatus
+	};
+}
+function registerDocumentsCommand(program) {
+	const documents = program.command("documents").description("Manage documents");
+	documents.command("list").description("List documents").option("--limit <n>", "max documents to return").option("--offset <n>", "number of documents to skip").action(async (opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).documents.list({
+			limit: opts.limit,
+			offset: opts.offset
+		}), getFormat(cmd));
+	});
+	documents.command("get").description("Get a document by ID").argument("<id>", "document ID").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).documents.get({ id }), getFormat(cmd));
+	});
+	documents.command("create").description("Create a new document on a record attribute").requiredOption("--title <title>", "document title").requiredOption("--object <name>", "object of the record the document is created on").requiredOption("--record <id>", "record the document is created on").requiredOption("--attribute <name>", "document attribute of that record").action(async (opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).documents.create({
+			title: opts.title,
+			objectName: opts.object,
+			sourceRecordId: opts.record,
+			attributeName: opts.attribute
+		}), getFormat(cmd));
+	});
+	documents.command("update").description("Rename a document").argument("<id>", "document ID").requiredOption("--title <title>", "new title").action(async (id, opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).documents.rename({
+			id,
+			name: opts.title
+		}), getFormat(cmd));
+	});
+	documents.command("delete").description("Delete a document").argument("<id>", "document ID").action(async (id, _opts, cmd) => {
+		await getAppClientFromCommand(cmd).documents.delete({ id });
+		process.stdout.write(`Document ${id} deleted.\n`);
+	});
+	documents.command("preview").description("Get preview file for a document").argument("<id>", "document ID").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).documents.preview({ id }), getFormat(cmd));
+	});
+	documents.command("files").description("List files in a document's pack (position-ordered)").argument("<id>", "document ID").action(async (id, _opts, cmd) => {
+		const sorted = [...await getAppClientFromCommand(cmd).documents.files({ id })].sort((a, b) => a.position - b.position);
+		const format = getFormat(cmd);
+		formatOutput(format === "table" ? sorted.map(toFileRow) : sorted, format);
+	});
+	documents.command("add-file").description("Append a file to a document's pack").argument("<id>", "document ID").requiredOption("--file-id <fileId>", "file ID").action(async (id, opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).documents.addFile({
+			id,
+			fileId: opts.fileId
+		}), getFormat(cmd));
+	});
+	documents.command("remove-file").description("Remove a file from a document's pack").argument("<id>", "document ID").argument("<fileId>", "file ID").action(async (id, fileId, _opts, cmd) => {
+		await getAppClientFromCommand(cmd).documents.removeFile({
+			id,
+			fileId
+		});
+		process.stdout.write(`File ${fileId} removed.\n`);
+	});
+	documents.command("content").description("Print a document's aggregated OCR text (every pack file, position order)").argument("<id>", "document ID").action(async (id, _opts, cmd) => {
+		const { blob } = await getAppClientFromCommand(cmd).documents.content({ id });
+		const text = await blob.text();
+		process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+	});
+}
+//#endregion
+//#region src/commands/embeddings.ts
+function registerEmbeddingsCommand(program) {
+	program.command("embeddings").description("Maintain record embeddings").command("drain").description("Embed every pending memory and skill record of the tenant").action(async (_opts, cmd) => {
+		const tenant = requireTenant(cmd, "An embedding drain names its tenant explicitly. Pass \"--tenant <id>\".");
+		await getAppClientFromCommand(cmd).embeddingsAdmin.drain({ tenantId: tenant });
+		process.stdout.write(`${styleText("green", "✓")} Embedding drain accepted for tenant ${tenant}.\n`);
+	});
+}
+//#endregion
+//#region src/commands/folders.ts
+function registerFoldersCommand(program) {
+	program.command("folders").description("Manage record drive folders").command("reconcile-paths").description("Create a folder tree on a record drive from paths").argument("<object>", "object name (e.g. contacts)").argument("<recordId>", "record ID owning the drive").option("--path <path>", "folder path to create (repeatable)", (val, acc) => {
+		acc.push(val);
+		return acc;
+	}, []).option("--paths-file <file>", "file containing one path per line").option("--mode <mode>", "reconcile mode: repair or dryRun", "repair").action(async (objectName, recordId, opts, cmd) => {
+		const paths = [...opts.path];
+		if (opts.pathsFile) {
+			const filePaths = (await readFile(opts.pathsFile, "utf-8")).split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+			paths.push(...filePaths);
+		}
+		if (paths.length === 0) throw new Error("No paths provided. Pass at least one --path or a non-empty --paths-file.");
+		formatOutput(await getAppClientFromCommand(cmd).folders.reconcilePaths({
+			recordId,
+			objectName,
+			paths,
+			mode: opts.mode
+		}), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/invitations.ts
+/** Invitation ids are `randomUUID` server-side, so anything else is a caller mistake. */
+const INVITATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* Refuses a malformed id before any request, with a message naming it. The
+* contract already keeps any id inside its own route segment (#4218); this is
+* the friendlier answer to a typo.
+*/
+function requireInvitationId(id) {
+	if (!INVITATION_ID.test(id)) throw new ValidationError(`"${id}" is not a valid invitation ID.`, []);
+	return id;
+}
+/**
+* Tenant invitations — the explicit lifecycle behind adding people to a workspace.
+* Acceptance is not exposed: it needs the invitee's own verified bearer, never an API key.
+*/
+function registerInvitationsCommand(program) {
+	const invitations = program.command("invitations").description("Invite people to the current tenant and manage pending invitations");
+	invitations.command("list").description("List tenant invitations").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).tenantInvitations.list({}), getFormat(cmd));
+	});
+	invitations.command("create").description("Invite an email address with a role; an email already in the tenant is refused").requiredOption("--email <email>", "email address to invite").requiredOption("--role <roleId>", "role id granted on acceptance").option("--yes", "send without confirmation").action(async (opts, cmd) => {
+		requireConfirmation(opts.yes, "Sending an invitation is explicit. Re-run with \"--yes\" to confirm.");
+		formatOutput(await getAppClientFromCommand(cmd).tenantInvitations.create({
+			email: opts.email,
+			roleId: opts.role
+		}), getFormat(cmd));
+	});
+	invitations.command("resend").description("Resend a pending invitation email").argument("<id>", "invitation ID").action(async (id, _opts, cmd) => {
+		const invitationId = requireInvitationId(id);
+		formatOutput(await getAppClientFromCommand(cmd).tenantInvitations.resend({ id: invitationId }), getFormat(cmd));
+	});
+	invitations.command("revoke").description("Revoke a pending invitation").argument("<id>", "invitation ID").option("--yes", "revoke without confirmation").action(async (id, opts, cmd) => {
+		requireConfirmation(opts.yes, "Revoking an invitation is explicit. Re-run with \"--yes\" to confirm.");
+		const invitationId = requireInvitationId(id);
+		formatOutput(await getAppClientFromCommand(cmd).tenantInvitations.revoke({ id: invitationId }), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/keys.ts
+async function resolveRoleId(client, name) {
+	const match = (await client.permissions.listRoles({})).find((role) => role.name === name);
+	if (!match) throw new Error(`Unknown role "${name}". Roles are listed in the app's People settings.`);
+	return match.id;
+}
+function registerKeysCommand(program) {
+	const keys = program.command("keys").description("Manage Standards API keys");
+	keys.command("list").description("List API keys").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).apiKeys.list({}), getFormat(cmd));
+	});
+	keys.command("create").description("Create a personal API key (acts with your access); --workspace for an integration key").requiredOption("--name <name>", "name for the API key").option("--role <name>", "role the key holds (default: member)").option("--workspace", "create a workspace key that acts with its own roles, not yours").option("--expires <date>", "expiration date (ISO 8601)").option("--yes", "create without confirmation").action(async (opts, cmd) => {
+		if (!opts.yes) throw new Error("Creating API keys is explicit. Re-run with \"--yes\" to confirm.");
+		const client = getAppClientFromCommand(cmd);
+		const body = { name: opts.name };
+		if (!opts.workspace) body.personal = true;
+		if (opts.expires) body.expiresAt = opts.expires;
+		if (opts.role) body.roleId = await resolveRoleId(client, opts.role);
+		formatOutput(await client.apiKeys.create(body), getFormat(cmd));
+	});
+	keys.command("detach").description("Make a workspace key act with its own roles, independent of its creator").argument("<id>", "API key ID").option("--yes", "detach without confirmation").action(async (id, opts, cmd) => {
+		if (!opts.yes) throw new Error("Detaching an API key is explicit. Re-run with \"--yes\" to confirm.");
+		formatOutput(await getAppClientFromCommand(cmd).apiKeys.detach({ id }), getFormat(cmd));
+	});
+	keys.command("revoke").description("Revoke an API key").argument("<id>", "API key ID").option("--yes", "revoke without confirmation").action(async (id, opts, cmd) => {
+		if (!opts.yes) throw new Error("Revoking API keys is explicit. Re-run with \"--yes\" to confirm.");
+		await getAppClientFromCommand(cmd).apiKeys.revoke({ id });
+		process.stdout.write(`${styleText("green", "✓")} API key ${id} revoked.\n`);
+	});
+}
+//#endregion
+//#region src/commands/mcp.ts
+/** The auth types `POST /mcp-servers` accepts today — `oauth` is rejected by the API. */
+const AUTH_TYPES = ["none", "header"];
+/** Build the `auth` block the API expects, failing before the request when a header auth is incomplete. */
+function buildAuth(opts) {
+	const type = opts.authType ?? "none";
+	if (!AUTH_TYPES.includes(type)) throw new ValidationError(`--auth-type must be one of: ${AUTH_TYPES.join(", ")}`, []);
+	if (type === "none") return { type: "none" };
+	if (!(opts.headerName && opts.secret)) throw new ValidationError("--auth-type \"header\" requires both --header-name and --secret.", []);
+	return {
+		type: "header",
+		headerName: opts.headerName,
+		secret: opts.secret
+	};
+}
+function resolveVisibility(visibility) {
+	if (visibility === void 0) return "workspace";
+	if (!RESOURCE_VISIBILITIES.includes(visibility)) throw new ValidationError(`--visibility must be one of: ${RESOURCE_VISIBILITIES.join(", ")}`, []);
+	return visibility;
+}
+function registerMcpCommand(program) {
+	const mcp = program.command("mcp").description("Manage the MCP servers your workspace's agents can be granted");
+	mcp.command("list").description("List connected MCP servers").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).mcpServers.list({}), getFormat(cmd));
+	});
+	mcp.command("catalog").description("List the vendored MCP catalog entries available to connect").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).mcpServers.catalog({}), getFormat(cmd));
+	});
+	mcp.command("connect").description("Connect a remote MCP server and mount its tools").requiredOption("--slug <slug>", "unique slug for the server").requiredOption("--name <name>", "display name").requiredOption("--url <url>", "remote MCP endpoint URL").option("--visibility <visibility>", "workspace or private", "workspace").option("--catalog-entry <id>", "catalog entry ID this server instantiates").option("--auth-type <type>", "none or header", "none").option("--header-name <name>", "header name when --auth-type is \"header\"").option("--secret <secret>", "header value when --auth-type is \"header\"").action(async (opts, cmd) => {
+		const auth = buildAuth(opts);
+		const visibility = resolveVisibility(opts.visibility);
+		formatOutput(await getAppClientFromCommand(cmd).mcpServers.connect({
+			slug: opts.slug,
+			name: opts.name,
+			url: opts.url,
+			visibility,
+			catalogEntryId: opts.catalogEntry ?? null,
+			auth
+		}), getFormat(cmd));
+	});
+	mcp.command("refresh").description("Re-discover a server's tools and refresh its status").argument("<id>", "MCP server ID").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).mcpServers.refresh({ id }), getFormat(cmd));
+	});
+	mcp.command("rename").description("Rename a server's display name (its slug, the tool-name prefix, never changes)").argument("<id>", "MCP server ID").argument("<name>", "new display name").action(async (id, name, _opts, cmd) => {
+		if (name.trim() === "") throw new ValidationError("The new name cannot be empty.", []);
+		formatOutput(await getAppClientFromCommand(cmd).mcpServers.rename({
+			id,
+			name
+		}), getFormat(cmd));
+	});
+	mcp.command("trust").description("Mark a server trusted so its tools run without per-call approval").argument("<id>", "MCP server ID").option("--revoke", "revoke trust instead of granting it").action(async (id, opts, cmd) => {
+		const trusted = !opts.revoke;
+		await getAppClientFromCommand(cmd).mcpServers.setTrusted({
+			id,
+			trusted
+		});
+		process.stdout.write(`${styleText("green", "✓")} MCP server ${id} ${trusted ? "trusted" : "untrusted"}.\n`);
+	});
+	mcp.command("disconnect").description("Disconnect (delete) an MCP server").argument("<id>", "MCP server ID").option("--yes", "disconnect without confirmation").action(async (id, opts, cmd) => {
+		if (!opts.yes) throw new ValidationError("Disconnecting an MCP server is explicit. Re-run with \"--yes\" to confirm.", []);
+		await getAppClientFromCommand(cmd).mcpServers.delete({ id });
+		process.stdout.write(`${styleText("green", "✓")} MCP server ${id} disconnected.\n`);
+	});
+}
+//#endregion
+//#region src/commands/meetings.ts
+const ORDERS = ["asc", "desc"];
+/** Reject a typo instead of letting it fall back to the API default silently. */
+function parseOrder(order) {
+	if (ORDERS.includes(order)) return order;
+	throw new ValidationError(`--order must be one of: ${ORDERS.join(", ")}`, []);
+}
+/**
+* A bound the API reads as a number: `Number("soon")` is `NaN`, which serializes
+* to `null` in JSON and would reach the server as an absent bound rather than as
+* the mistake it is.
+*/
+function parseCount(flag, value) {
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed) || parsed < 0) throw new ValidationError(`${flag} must be a non-negative integer`, []);
+	return parsed;
+}
+/** Build the `MeetingsQuery` body every meetings route accepts. Absent flags stay absent. */
+function buildQuery(opts) {
+	const query = {};
+	if (opts.search !== void 0) query.search = opts.search;
+	if (opts.since !== void 0) query.since = opts.since;
+	if (opts.before !== void 0) query.before = opts.before;
+	if (opts.addresses !== void 0) query.addresses = parseCsvList(opts.addresses);
+	if (opts.order !== void 0) query.order = parseOrder(opts.order);
+	if (opts.limit !== void 0) query.limit = parseCount("--limit", opts.limit);
+	if (opts.offset !== void 0) query.offset = parseCount("--offset", opts.offset);
+	return query;
+}
+/** `--auto` clears the override; `--force` / `--skip` set it. Exactly one flag. */
+function parseOverride(opts) {
+	const chosen = RECORDING_OVERRIDES.filter((override) => opts[override]);
+	if (opts.auto) chosen.push(null);
+	if (chosen.length !== 1) throw new ValidationError("record needs exactly one of --force, --skip or --auto", []);
+	return chosen[0] ?? null;
+}
+/** The query flags `list` and `for-record` share — both take the same body shape. */
+function withQueryOptions(command) {
+	return command.option("--search <text>", "match title, description and location").option("--since <iso>", "inclusive ISO lower bound on the start").option("--before <iso>", "exclusive ISO upper bound on the start").option("--addresses <emails>", "comma-separated participant addresses to restrict to").option("--order <order>", "asc for what is coming next, desc to read history").option("--limit <n>", "max meetings to return").option("--offset <n>", "number of meetings to skip");
+}
+function registerMeetingsCommand(program) {
+	const meetings = program.command("meetings").description("Read calendar meetings and the records each one concerns");
+	withQueryOptions(meetings.command("list").description("List meetings, newest window first by default")).action(async (opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).meetings.search(buildQuery(opts)), getFormat(cmd));
+	});
+	meetings.command("get").description("Get one meeting, with its participants and linked records").argument("<id>", "meeting ID").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).meetings.get({ meetingId: id }), getFormat(cmd));
+	});
+	withQueryOptions(meetings.command("for-record").description("List the meetings a record's email addresses appear in").argument("<recordId>", "record ID").option("--email-attributes <ids>", "comma-separated email attribute IDs to match participants on")).action(async (recordId, opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).meetings.forRecord({
+			recordId,
+			...opts.emailAttributes !== void 0 && { emailAttributeIds: parseCsvList(opts.emailAttributes) },
+			query: buildQuery(opts)
+		}), getFormat(cmd));
+	});
+	meetings.command("transcript").description("Read a meeting's completed transcript").argument("<id>", "meeting ID").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).meetings.transcript({ meetingId: id }), getFormat(cmd));
+	});
+	meetings.command("record").description("Force, skip, or hand back to the workspace policy the recording of a meeting").argument("<id>", "meeting ID").option("--force", "record this meeting whatever the workspace policy says").option("--skip", "never record this meeting").option("--auto", "clear the override and follow the workspace policy").action(async (id, opts, cmd) => {
+		const override = parseOverride(opts);
+		formatOutput(await getAppClientFromCommand(cmd).meetings.setRecording({
+			meetingId: id,
+			override
+		}), getFormat(cmd));
+	});
+	meetings.command("grants-recompute").description("Recompute the attendee grants of every private meeting of the tenant").action(async (_opts, cmd) => {
+		const tenant = requireTenant(cmd, "A meeting grants recompute names its tenant explicitly. Pass \"--tenant <id>\".");
+		await getAppClientFromCommand(cmd).meetingsAdmin.recomputeGrants({ tenantId: tenant });
+		process.stdout.write(`${styleText("green", "✓")} Meeting grants recompute accepted for tenant ${tenant}.\n`);
+	});
+}
+//#endregion
+//#region src/commands/memory.ts
+function registerMemoryCommand(program) {
+	const memory = program.command("memory").description("Maintain agent memory");
+	memory.command("backfill").description("Rebuild agent memory from the tenant's last 30 days of sessions and meetings").option("--yes", "backfill without confirmation").action(async (opts, cmd) => {
+		if (!opts.yes) throw new ValidationError("A memory backfill spends model calls on the last 30 days of evidence. Re-run with \"--yes\" to confirm.", []);
+		const tenant = requireTenant(cmd, "A memory backfill names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
+		await getAppClientFromCommand(cmd).memoryAdmin.backfill({ tenantId: tenant });
+		process.stdout.write(`${styleText("green", "✓")} Memory backfill queued for tenant ${tenant}. It runs in the background — follow the server logs for progress.\n`);
+	});
+	memory.command("activity").description("Compute the tenant's weekly activity digest now (observed practices)").option("--yes", "run without confirmation").action(async (opts, cmd) => {
+		if (!opts.yes) throw new ValidationError("The activity digest reads the last 30 days of the workspace's activity and spends one model call per active person. Re-run with \"--yes\" to confirm.", []);
+		const tenant = requireTenant(cmd, "The activity digest names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
+		await getAppClientFromCommand(cmd).memoryAdmin.activity({ tenantId: tenant });
+		process.stdout.write(`${styleText("green", "✓")} Activity digest queued for tenant ${tenant}. The digest runs in the background.\n`);
+	});
+}
+//#endregion
+//#region src/drift/reconciliation-prompt.ts
+function renderReconciliationPrompt(state) {
+	const lines = [
+		"# Standards schema reconciliation",
+		"",
+		"Compare deployed source with shared runtime. This excludes unbuilt local TypeScript and personal preferences.",
+		"Review the shared changes, update the fluent declarations, then deploy. Copies stay retained after a deploy: reset them in architect mode to return to the source.",
+		"Use content with detailView/listView and .tab or .aside for view contents. Reading this prompt changes no files or workspace state.",
+		""
+	];
+	const { changes } = diffSchemaState(state);
+	if (changes.length === 0) lines.push("No differences.");
+	for (const entry of changes) lines.push(`## ${entry.change} ${JSON.stringify(entry.address)}`, `Status: ${entry.status}${entry.status === "copy" ? " (retained)" : ""}`, "```json", prettyCanonical(entry.effective ?? entry.source), "```", "");
+	return `${lines.join("\n").trimEnd()}\n`;
+}
+//#endregion
+//#region src/commands/pull.ts
+function registerPullCommand(program) {
+	program.command("pull").description("Read deployed source vs shared runtime; excludes unbuilt local TypeScript").option("--json", "Emit canonical shared state JSON instead of guidance").action(async (opts, cmd) => {
+		let code = 0;
+		try {
+			const state = await readSchemaState(getAppClientFromCommand(cmd));
+			console.info(opts.json ? prettyCanonical(state) : renderReconciliationPrompt(state).trimEnd());
+		} catch (error) {
+			console.error(styleText("red", `✗ ${messageOf(error)}`));
+			code = 2;
+		}
+		process.exit(code);
+	});
+}
+//#endregion
+//#region src/commands/quotas.ts
+function registerQuotasCommand(program) {
+	program.command("quotas").description("Inspect the tenant's remaining capacity").command("list").description("List one state per quota key (limit is null when nothing is enforced)").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).quotas.list({}), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/records.ts
+function parseSortFlag(sort) {
+	const [attribute, direction = "asc"] = sort.split(":");
+	return [{
+		attribute,
+		direction
+	}];
+}
+const COUNT_MODES = [
+	"none",
+	"estimated",
+	"exact"
+];
+/**
+* The API opts out of totals by default: an absent or unrecognized `countMode`
+* yields `page.total: null`. Reject unknown modes here so a typo surfaces as an
+* error instead of a silently missing total.
+*/
+function parseCountFlag(count) {
+	if (COUNT_MODES.includes(count)) return count;
+	throw new Error(`Invalid --count value "${count}". Expected one of: ${COUNT_MODES.join(", ")}.`);
+}
+/** Build the shared list/search request body from common query flags. */
+function buildQueryBody(opts) {
+	const body = {};
+	if (opts.limit) body.limit = Number(opts.limit);
+	if (opts.offset) body.offset = Number(opts.offset);
+	if (opts.sort) body.sorts = parseSortFlag(opts.sort);
+	if (opts.filter) body.filters = JSON.parse(opts.filter);
+	if (opts.fields !== void 0) body.fields = parseCsvList(opts.fields);
+	if (opts.count) body.countMode = parseCountFlag(opts.count);
+	return body;
+}
+const COUNT_OPTION_DESCRIPTION = "total count mode (none, estimated, exact); omit for no total in page.total";
+function registerRecordsCommand(program) {
+	const records = program.command("records").description("Manage records (CRUD + search)");
+	records.command("list").description("List records for an object").argument("<object>", "object name (e.g. contacts)").option("--limit <n>", "max records to return").option("--offset <n>", "number of records to skip").option("--sort <sort>", "sort rule as \"attribute:direction\"").option("--filter <json>", "filter state as JSON string").option("--fields <names>", "comma-separated reference attributes to hydrate (empty for none, omit for all)").option("--count <mode>", COUNT_OPTION_DESCRIPTION).action(async (objectName, opts, cmd) => {
+		const body = buildQueryBody(opts);
+		formatOutput(await getAppClientFromCommand(cmd).records.list({
+			objectName,
+			...body
+		}), getFormat(cmd));
+	});
+	records.command("get").description("Get a record by ID").argument("<object>", "object name").argument("<id>", "record ID").action(async (objectName, id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).records.get({
+			objectName,
+			id
+		}), getFormat(cmd));
+	});
+	records.command("create").description("Create a new record").argument("<object>", "object name").option("--data <json>", "record data as JSON string").action(async (objectName, opts, cmd) => {
+		const data = opts.data ? JSON.parse(opts.data) : {};
+		formatOutput(await getAppClientFromCommand(cmd).records.create({
+			objectName,
+			data
+		}), getFormat(cmd));
+	});
+	records.command("update").description("Update a record").argument("<object>", "object name").argument("<id>", "record ID").option("--data <json>", "fields to update as JSON string").action(async (objectName, id, opts, cmd) => {
+		const data = opts.data ? JSON.parse(opts.data) : {};
+		formatOutput(await getAppClientFromCommand(cmd).records.update({
+			objectName,
+			id,
+			values: data
+		}), getFormat(cmd));
+	});
+	records.command("delete").description("Delete a record").argument("<object>", "object name").argument("<id>", "record ID").action(async (objectName, id, _opts, cmd) => {
+		await getAppClientFromCommand(cmd).records.delete({
+			objectName,
+			id
+		});
+		process.stdout.write(`Record ${id} deleted.\n`);
+	});
+	records.command("search").description("Full-text search records").argument("<object>", "object name").requiredOption("--query <q>", "search query string").option("--limit <n>", "max records to return").option("--offset <n>", "number of records to skip").option("--sort <sort>", "sort rule as \"attribute:direction\"").option("--filter <json>", "filter state as JSON string").option("--fields <names>", "comma-separated reference attributes to hydrate (empty for none, omit for all)").option("--count <mode>", COUNT_OPTION_DESCRIPTION).action(async (objectName, opts, cmd) => {
+		const body = {
+			q: opts.query,
+			...buildQueryBody(opts)
+		};
+		formatOutput(await getAppClientFromCommand(cmd).records.search({
+			objectName,
+			...body
+		}), getFormat(cmd));
+	});
+	records.command("export").description("Export records as CSV (filters, sort and columns like the app)").argument("<object>", "object name").requiredOption("--columns <list>", "comma-separated attribute names, in order").option("--query <q>", "full-text query").option("--filter <json>", "filter state as JSON string").option("--sort <attr:dir>", "sort, e.g. name:asc").option("--timezone <zone>", "IANA time zone dates are written in (default: this machine's)").option("-o, --output <file>", "write to a file instead of stdout").action(async (objectName, opts, cmd) => {
+		const client = getClientFromCommand(cmd);
+		const { filters, sorts } = buildQueryBody({
+			filter: opts.filter,
+			sort: opts.sort
+		});
+		const response = await client.postRaw(buildOperationPath(recordsOperations.export, { objectName }), {
+			q: opts.query ?? "",
+			columns: parseCsvList(opts.columns),
+			...filters ? { filters } : {},
+			...sorts ? { sorts } : {},
+			timezone: opts.timezone ?? Intl.DateTimeFormat().resolvedOptions().timeZone
+		});
+		if (!response.body) throw new StandardsRequestError(response.status, "The export response had no body");
+		const source = Readable.fromWeb(response.body);
+		if (!opts.output) return await pipeline(source, process.stdout);
+		try {
+			await pipeline(source, createWriteStream(opts.output));
+		} catch (error) {
+			await unlink(opts.output).catch(() => void 0);
+			throw error;
+		}
+	});
+	records.command("attach-document").description("Upload and attach a local file to a record").argument("<object>", "object name (e.g. contacts)").argument("<recordId>", "record ID").requiredOption("--file <path>", "local file path to upload").option("--attribute <attr>", "attribute name to attach the document to").option("--parent-id <folderId>", "parent folder ID").option("--title <title>", "document title (defaults to filename)").action(async (objectName, recordId, opts, cmd) => {
+		const fileContent = await readFile(opts.file);
+		const fileName = basename(opts.file);
+		formatOutput(await getAppClientFromCommand(cmd).records.attachDocument({
+			objectName,
+			id: recordId,
+			title: opts.title ?? fileName,
+			...opts.attribute ? { attributeName: opts.attribute } : {},
+			...opts.parentId ? { parentId: opts.parentId } : {},
+			files: new File([fileContent], fileName)
+		}), getFormat(cmd));
+	});
+	const access = records.command("access").description("Share a private record with other actors (readers and editors)");
+	access.command("list").description("Show who can reach a private record beyond its owner").argument("<object>", "object name").argument("<id>", "record ID").action(async (objectName, id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).recordAccess.list({
+			objectName,
+			recordId: id
+		}), getFormat(cmd));
+	});
+	access.command("grant").description("Share a private record you own or edit with an actor").argument("<object>", "object name").argument("<id>", "record ID").argument("<actorId>", "actor ID to share with").requiredOption("--role <role>", `access role (${RECORD_ACCESS_ROLES.join(", ")})`).action(async (objectName, id, actorId, opts, cmd) => {
+		const role = parseRecordAccessRole(opts.role);
+		formatOutput(await getAppClientFromCommand(cmd).recordAccess.grant({
+			objectName,
+			recordId: id,
+			actorId,
+			role
+		}), getFormat(cmd));
+	});
+	access.command("revoke").description("Remove your manual share of a private record").argument("<object>", "object name").argument("<id>", "record ID").argument("<actorId>", "actor ID to stop sharing with").action(async (objectName, id, actorId, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).recordAccess.revoke({
+			objectName,
+			recordId: id,
+			actorId
+		}), getFormat(cmd));
+	});
+	access.command("clear").description("Make a shared record private again: remove every manual share").argument("<object>", "object name").argument("<id>", "record ID").action(async (objectName, id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).recordAccess.clear({
+			objectName,
+			recordId: id
+		}), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/root.ts
+async function promptForMissingValue(label) {
+	const rl = createInterface({
+		input: stdin,
+		output: stdout
+	});
+	try {
+		return (await rl.question(`${label}: `)).trim();
+	} finally {
+		rl.close();
+	}
+}
+function registerRootCommands(program) {
+	program.command("login").description("Connect the CLI to a Standards instance").option("--url <url>", "Standards API URL", getDefaultApiUrl()).option("--key <key>", "API key to store for this instance").option("--name <name>", "local instance name", "local").action(async (opts) => {
+		const apiKey = opts.key ?? await promptForMissingValue("API key");
+		if (!apiKey) throw new Error("API key is required");
+		await createAppClient(createClient({
+			apiUrl: opts.url,
+			apiKey
+		})).apiKeys.list({});
+		await upsertProfile({
+			name: opts.name,
+			apiUrl: opts.url,
+			apiKey
+		});
+		process.stdout.write(`${styleText("green", "✓")} Standards instance "${opts.name}" saved and selected.\n`);
+		process.stdout.write(`  API URL: ${opts.url}\n`);
+		process.stdout.write(`  API Key: ${apiKey.slice(0, 8)}...\n`);
+		process.stdout.write(`  Use it with: standards --instance ${opts.name} <command>\n`);
+	});
+	program.command("use").description("Select the active Standards instance").argument("<name>", "instance name").action(async (name) => {
+		await setCurrentProfile(name);
+		process.stdout.write(`${styleText("green", "✓")} Standards instance "${name}" selected.\n`);
+	});
+	program.command("instances").description("List configured Standards instances").action(async (_opts, cmd) => {
+		formatOutput(await listProfiles(), getFormat(cmd));
+	});
+	program.command("current").description("Show the active Standards instance").action(async () => {
+		const profile = await getActiveProfile();
+		if (!profile) {
+			process.stdout.write(`No Standards instance selected. Run "standards login".\n`);
+			return;
+		}
+		process.stdout.write(`${profile.name} ${profile.apiUrl}\n`);
+	});
+	program.command("logout").description("Remove a Standards instance from local CLI config").argument("[name]", "instance name, defaults to current").action(async (name) => {
+		await removeProfile(name);
+		process.stdout.write(`${styleText("green", "✓")} Standards instance removed.\n`);
+	});
+}
+//#endregion
+//#region src/commands/schema.ts
+function registerSchemaCommand(program) {
+	const schema = program.command("schema").description("Inspect schema objects and attributes");
+	schema.command("list").description("List all schema objects").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).schemaObjects.list({}), getFormat(cmd));
+	});
+	schema.command("inspect").description("Inspect an object (attributes, types, views)").argument("<object>", "object name or ID").action(async (objectName, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).schemaObjects.get({ objectIdOrName: objectName }), getFormat(cmd));
+	});
+	schema.command("groups").description("List the bundles and schema sources that own objects, with label and icon").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).schemaGroups.list({}), getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/commands/search.ts
+function registerSearchCommand(program) {
+	program.command("search").description("Maintain the Standards search index").command("reindex").description("Rebuild the tenant search index beside the live one, then switch").option("--yes", "reindex without confirmation").option("--emails", "hand the tenant's stored emails back to the email indexer instead (nothing is cleared)").option("--after-id <emailId>", "with --emails, resume after the last email id a failed run reported").option("--rebuild", "with --emails and --yes, rebuild the mail search index from the stored mail instead (lifts a quarantine)").action(async (opts, cmd) => {
+		if (opts.afterId !== void 0 && !opts.emails) throw new ValidationError("\"--after-id\" resumes an email reindex. Pass it with \"--emails\".", []);
+		if (opts.rebuild && !opts.emails) throw new ValidationError("\"--rebuild\" rebuilds the mail search index. Pass it with \"--emails\".", []);
+		if (opts.rebuild && opts.afterId !== void 0) throw new ValidationError("\"--after-id\" resumes a requeue; a mail rebuild reads every stored email. Pass one of them.", []);
+		if (opts.emails) {
+			const tenant = requireTenant(cmd, "An email reindex names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
+			if (opts.rebuild && !opts.yes) throw new ValidationError("A mail rebuild re-reads every stored email. Re-run with \"--yes\" to confirm.", []);
+			await getAppClientFromCommand(cmd).searchAdmin.emailReindex({
+				tenantId: tenant,
+				...opts.afterId !== void 0 && { afterId: opts.afterId },
+				...opts.rebuild && { rebuild: true }
+			});
+			process.stdout.write(opts.rebuild ? `${styleText("green", "✓")} Mail index rebuild accepted. Mail search keeps answering from the current index until the rebuilt one replaces it — follow the server logs for progress.\n` : `${styleText("green", "✓")} Email reindex accepted for tenant ${tenant}. It runs in the background — follow the server logs for progress.\n`);
+			return;
+		}
+		if (!opts.yes) throw new ValidationError("A rebuild re-reads every record of the tenant. Re-run with \"--yes\" to confirm.", []);
+		const tenant = requireTenant(cmd, "A rebuild names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
+		await getAppClientFromCommand(cmd).searchAdmin.fullReindex({ tenantId: tenant });
+		process.stdout.write(`${styleText("green", "✓")} Index rebuild accepted for tenant ${tenant}. Search keeps answering from the current index until the rebuilt one replaces it — follow the server logs for progress.\n`);
+	});
+}
+//#endregion
+//#region src/commands/sources.ts
+/** Remote schema sources — definitions pushed by an external codebase through @standards/client. */
+function registerSourcesCommand(program) {
+	const sources = program.command("sources").description("Inspect and remove remote schema sources on the current tenant");
+	sources.command("list").description("List remote schema sources: id, hash, last apply, object names").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).schemaSources.list({}), getFormat(cmd));
+	});
+	sources.command("remove").description("Remove a remote schema source: its objects are demoted to custom, records are kept").argument("<sourceId>", "source id declared in code").option("--yes", "remove without confirmation").action(async (sourceId, opts, cmd) => {
+		if (!opts.yes) throw new Error("Removing a schema source is explicit. Re-run with \"--yes\" to confirm.");
+		await getAppClientFromCommand(cmd).schemaSources.remove({ sourceId });
+		formatOutput({ removed: sourceId }, getFormat(cmd));
+	});
+}
+//#endregion
+//#region src/version.ts
+/**
+* The installed package's version, read from its own manifest: `src/` and the
+* built `dist/` both sit one level under it, and npm always ships
+* `package.json`. A version literal in `program.ts` went stale for 209
+* releases (#4314).
+*
+* No try/catch, unlike `adapter-posthog`'s `packageVersion()`: a missing
+* manifest here is a packaging bug, and failing loudly keeps it visible to the
+* sandbox e2e that runs `dist/bin.mjs`. An `"unknown"` would hide it.
+*/
+function cliVersion() {
+	const manifest = createRequire(import.meta.url)("../package.json");
+	return typeof manifest === "object" && manifest !== null && "version" in manifest && typeof manifest.version === "string" ? manifest.version : "unknown";
+}
+//#endregion
+//#region src/program.ts
+const PUBLIC_COMMANDS = /* @__PURE__ */ new Set([
+	"login",
+	"use",
+	"instances",
+	"current",
+	"logout",
+	"help"
+]);
+function isPublicCommand(actionCommand) {
+	if (PUBLIC_COMMANDS.has(actionCommand.name())) return true;
+	return actionCommand.parent?.name() === "auth" && actionCommand.name() === "help";
+}
+function createProgram() {
+	const program = new Command();
+	program.name("standards").description("CLI to interact with Standards API").version(cliVersion()).option("--format <format>", "output format (json, table, csv)", "json").option("--api-url <url>", "API base URL").option("--api-key <key>", "API key for authentication").option("--instance <name>", "Standards instance profile to use").option("--tenant <id>", "Tenant ID (multi-tenant setups, defaults to primary tenant)");
+	registerRootCommands(program);
+	registerRecordsCommand(program);
+	registerSchemaCommand(program);
+	registerPullCommand(program);
+	registerDiffCommand(program);
+	registerDocumentsCommand(program);
+	registerDeviceCommand(program);
+	registerFoldersCommand(program);
+	registerKeysCommand(program);
+	registerInvitationsCommand(program);
+	registerAuthCommand(program);
+	registerBundlesCommand(program);
+	registerSourcesCommand(program);
+	registerCodemodCommand(program);
+	registerConnectorsCommand(program);
+	registerMcpCommand(program);
+	registerMeetingsCommand(program);
+	registerMemoryCommand(program);
+	registerSearchCommand(program);
+	registerEmbeddingsCommand(program);
+	registerAiCommand(program);
+	registerQuotasCommand(program);
+	program.hook("preAction", async (_thisCommand, actionCommand) => {
+		const raw = program.opts();
+		const resolved = await resolveCliConfig({
+			apiUrl: raw.apiUrl,
+			apiKey: raw.apiKey,
+			instance: raw.instance
+		});
+		program.setOptionValue("apiUrl", resolved.apiUrl);
+		program.setOptionValue("apiKey", resolved.apiKey);
+		program.setOptionValue("profileName", resolved.profileName);
+		program.setOptionValue("tenant", raw.tenant);
+		if (!(resolved.apiKey || isPublicCommand(actionCommand))) {
+			console.error(styleText("red", `✗ Error: No Standards instance configured. Run "standards login" or pass --api-key.`));
+			process.exit(2);
+		}
+	});
+	return program;
+}
+async function runProgram(argv = process.argv) {
+	await createProgram().parseAsync(argv).catch((error) => {
+		if (error instanceof StandardsRequestError) {
+			if (error.status > 0) console.error(styleText("red", `✗ Error (${error.status}): ${error.message}`));
+			else console.error(styleText("red", `✗ Error: ${error.message}`));
+		} else if (error instanceof Error) console.error(styleText("red", `✗ Error: ${error.message}`));
+		process.exit(1);
+	});
+}
+//#endregion
+//#region src/bin.ts
+await runProgram();
+//#endregion
+export {};