@standards/cli 1.0.0-alpha.419 → 1.0.0-alpha.421

package/dist/bin.mjs

@@ -4,30 +4,57 @@ import { t as discoverBundles } from "./discover-bundles-DPpEZVv0.mjs";
 import { createRequire } from "node:module";
 import { styleText } from "node:util";
 import { BundleConflictError, StandardsRequestError, createTransport, syncBundle } from "@standards/client";
-import { Command } from "commander";
-import { BUNDLE_LOCALES, COUNT_MODES, MEETING_RESPONSES, RECORDING_OVERRIDES, RECORD_ACCESS_ROLES, RESOURCE_VISIBILITIES, ValidationError, canonicalStringify, diffSchemaState, formatByteSize, parseRecordAccessRole, parseSchemaState, parseSkillSource, schemaStateSourcePayload } from "@standards/schema";
-import Table from "cli-table3";
-import { createAppClient } from "@standards/client/app";
+import { Command, Option } from "commander";
+import { BUNDLE_LOCALES, COUNT_MODES, DECISION_TYPE_AGENT_SETUP, DECISION_TYPE_BUNDLE_SETUP, ENVIRONMENT_HARNESSES, ENVIRONMENT_IMAGES, ENVIRONMENT_SIZES, LINK_MAX_MS, NotFoundError, PROVIDER_NAMES, RECORD_ACCESS_ROLES, RESOURCE_VISIBILITIES, SchemaError, SchemaErrorCode, ValidationError, canonicalStringify, diffSchemaState, environmentHarness, formatByteSize, formatDecisionLink, isEnvironmentHarnessId, isPlainRecord, parseRecordAccessRole, parseSchemaState, parseSkillSource, schemaStateSourcePayload } from "@standards/schema";
 import { createWriteStream } from "node:fs";
-import { chmod, mkdir, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, readdir, readlink, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
-import { createHash } from "node:crypto";
+import Table from "cli-table3";
+import { StandardsRequestError as StandardsRequestError$1, TURN_END_TYPES, createAppClient, openAgentStream } from "@standards/client/app";
+import { homedir, hostname } from "node:os";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { buildOperationPath, recordsOperations } from "@standards/schema/api";
-import { stdin, stdout } from "node:process";
+import { stdin } from "node:process";
 import { createInterface } from "node:readline/promises";
-import { homedir } from "node:os";
-import { isSafeSkillFilePath, skillFileText } from "@standards/constants";
+import { CLI_CLIENT_ID, CLI_DEVICE_LABEL_MAX, CLI_LOGIN_SCOPE, isSafeSkillFilePath, skillFileText, slugify } from "@standards/constants";
+import * as oauth from "oauth4webapi";
+import { createHash, randomUUID } from "node:crypto";
+// src/discovery/order-bundles.ts
+/**
+* Orders discovered bundles so each comes after the bundles it `uses`.
+* Bundles a `uses` names that were not discovered are already the host's concern.
+*/
+async function orderByUses(discovered) {
+	const byName = new Map(discovered.map((entry) => [entry.bundle.name, entry]));
+	const ordered = [];
+	const visited = /* @__PURE__ */ new Set();
+	async function visit(entry) {
+		if (visited.has(entry.bundle.name)) return;
+		visited.add(entry.bundle.name);
+		for (const used of (await entry.bundle.build()).uses) {
+			const dependency = byName.get(used);
+			if (dependency) await visit(dependency);
+		}
+		ordered.push(entry);
+	}
+	for (const entry of discovered) await visit(entry);
+	return ordered;
+}
 // src/output.ts
 const MAX_CELL_WIDTH = 50;
 function truncate(value, maxLength) {
 	if (value.length <= maxLength) return value;
 	return `${value.slice(0, maxLength - 1)}…`;
 }
-function escapeCsvValue(value) {
+/** A cell's text: a decoded `Date` as the ISO string the server sent, an object as JSON. */
+function cellText(value) {
 	if (value === null || value === void 0) return "";
-	const str = typeof value === "object" ? JSON.stringify(value) : String(value);
+	if (value instanceof Date) return value.toISOString();
+	return typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+function escapeCsvValue(value) {
+	const str = cellText(value);
 	if (str.includes(",") || str.includes("\"") || str.includes("\n")) return `"${str.replace(/"/g, "\"\"")}"`;
 	return str;
 }
@@ -50,11 +77,7 @@ function formatTable(items) {
 		}
 	});
 	for (const item of items) {
-		const row = headers.map((h) => {
-			const val = item[h];
-			if (val === null || val === void 0) return "";
-			return truncate(typeof val === "object" ? JSON.stringify(val) : String(val), MAX_CELL_WIDTH);
-		});
+		const row = headers.map((h) => truncate(cellText(item[h]), MAX_CELL_WIDTH));
 		table.push(row);
 	}
 	return table.toString();
@@ -110,9 +133,41 @@ function parseCount(flag, value) {
 	if (!Number.isInteger(parsed) || parsed < 0) throw new ValidationError(`${flag} must be a non-negative integer`, []);
 	return parsed;
 }
+/** A `<n><unit>` duration in milliseconds; an unknown unit or one outside `[min, max]` is refused. */
+function parseDuration(flag, value, rules) {
+	const { units, min = 1, max = Number.POSITIVE_INFINITY } = rules;
+	const match = new RegExp(`^(\\d+)(${Object.keys(units).join("|")})$`).exec(value.trim());
+	const unit = match?.[2] === void 0 ? void 0 : units[match[2]];
+	const ms = match && unit !== void 0 ? Number(match[1]) * unit : NaN;
+	if (!(ms >= min && ms <= max)) throw new ValidationError(`${flag} takes a duration such as ${rules.example}, ${rules.limit}: got "${value}"`, []);
+	return ms;
+}
+/** The `--harness` value that names the built-in agent: no harness at all. */
+const STANDARDS_HARNESS = "standards";
+/** `--harness` ids: catalogue ids, or `standards` alone (the built-in agent), which is `null`. */
+function parseHarnessIds(ids) {
+	if (ids.length === 1 && ids[0] === "standards") return null;
+	const unknown = ids.filter((id) => !isEnvironmentHarnessId(id));
+	if (ids.length === 0 || unknown.length > 0) {
+		const known = [...ENVIRONMENT_HARNESSES.map((harness) => harness.id), STANDARDS_HARNESS];
+		throw new ValidationError(`--harness takes ${known.join(", ")}${unknown.length > 0 ? `: got "${unknown.join(", ")}"` : ""}`, []);
+	}
+	return ids.filter(isEnvironmentHarnessId);
+}
+/** Every item of a cursor-paged read, following `nextCursor` to the end. */
+async function readAllPages(read) {
+	const items = [];
+	let cursor;
+	do {
+		const page = await read(cursor);
+		items.push(...page.items);
+		cursor = page.nextCursor ?? void 0;
+	} while (cursor);
+	return items;
+}
 function getClientFromCommand(cmd) {
 	const root = getGlobalOptions(cmd);
-	if (!(root.apiUrl && root.apiKey)) throw new Error("No Standards instance configured. Run \"standards login\" or pass --api-key.");
+	if (!(root.apiUrl && root.apiKey)) throw new ValidationError("No Standards instance configured. Run \"standards login\" or pass --api-key.", []);
 	return createClient({
 		apiUrl: root.apiUrl,
 		apiKey: root.apiKey,
@@ -124,99 +179,80 @@ function getAppClientFromCommand(cmd) {
 	return createAppClient(getClientFromCommand(cmd));
 }
 /**
-* The `--tenant` guard every admin command shares. The API takes the tenant in
-* the body as a confirmation of intent, never as a target selector: it refuses
-* any value other than the authenticated tenant. The CLI cannot invent it, so
-* it asks for it rather than guessing the primary tenant.
-*
-* `message` is passed whole rather than composed: each command's exact wording
-* is what its users (and its tests) read.
-*/
-function requireTenant(cmd, message) {
-	const { tenant } = getGlobalOptions(cmd);
-	if (!tenant) throw new Error(message);
-	return tenant;
-}
-/**
 * The `--yes` guard for a destructive or outbound command: shared rather than
 * inlined so the refusal is a typed `ValidationError`, not a raw `Error`. The
 * commands that still inline their own check belong here when they move.
 *
-* Like `requireTenant`, `message` is passed whole rather than composed: each
-* command's exact wording is what its users (and its tests) read.
+* `message` is passed whole rather than composed: each command's exact
+* wording is what its users (and its tests) read.
 */
 function requireConfirmation(yes, message) {
 	if (!yes) throw new ValidationError(message, []);
 }
+/**
+* A page of the web app, on the API's origin: a profile's API URL is
+* `https://<host>/v1`, and the app is served at `https://<host>`.
+*/
+function appUrl(cmd, path = "/") {
+	const { apiUrl } = getGlobalOptions(cmd);
+	if (!apiUrl) throw new ValidationError("No Standards instance configured. Run \"standards login\" or pass --api-url.", []);
+	return new URL(path, new URL(apiUrl).origin).toString();
+}
+/** A conversation's page in the app: the chat router's `/chat/<id>`. */
+function conversationUrl(cmd, sessionId) {
+	return appUrl(cmd, `/chat/${encodeURIComponent(sessionId)}`);
+}
+/** A command's success line on stdout: a green check, then `message`. */
+function printDone(message) {
+	process.stdout.write(`${styleText("green", "✓")} ${message}\n`);
+}
 /** Renders any caught value as a message string — shared by every command's top-level `catch`. */
 function messageOf(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-// src/commands/ai.ts
-const SCOPES = ["me", "workspace"];
-/** `GET /ai/usage` reads inclusive UTC days; anything else reaches the API as a 400. */
-const ISO_DAY = /^\d{4}-\d{2}-\d{2}$/u;
-function parseDay(flag, value) {
-	if (!ISO_DAY.test(value)) throw new ValidationError(`${flag} must be a YYYY-MM-DD date`, []);
-	return value;
-}
 /**
-* The window's own rules (maximum span, ordering) belong to the server, which
-* owns the calendar; the CLI only rejects what it can judge on its own.
+* The one name lookup of the CLI: the single item whose `field` equals `name`.
+* None → `NotFoundError` (`No <noun> named "x"`); several → `ValidationError`
+* listing them, so the caller passes an id instead of the CLI guessing.
 */
-function parseScope(scope) {
-	if (SCOPES.includes(scope)) return scope;
-	throw new ValidationError(`--scope must be one of: ${SCOPES.join(", ")}`, []);
-}
-function registerAiCommand(program) {
-	const ai = program.command("ai").description("Inspect AI usage and credit state");
-	ai.command("usage").description("Aggregate the AI journal over an inclusive UTC day window").requiredOption("--from <day>", "first day of the window (YYYY-MM-DD)").requiredOption("--to <day>", "last day of the window, inclusive (YYYY-MM-DD)").option("--scope <scope>", "me or workspace", "me").action(async (opts, cmd) => {
-		const params = {
-			from: parseDay("--from", opts.from),
-			to: parseDay("--to", opts.to),
-			scope: parseScope(opts.scope ?? "me")
-		};
-		formatOutput(await getAppClientFromCommand(cmd).ai.usage(params), getFormat(cmd));
-	});
-	ai.command("wallet").description("Show the tenant's billing mode and AI credit state").action(async (_opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).ai.wallet({}), getFormat(cmd));
-	});
+function findNamed(items, field, name, noun, describe = (item) => item.id) {
+	const matches = items.filter((item) => item[field] === name);
+	const [match] = matches;
+	if (!match) throw new NotFoundError(noun, name, void 0, `No ${noun} named "${name}"`);
+	if (matches.length > 1) throw new ValidationError(`${matches.length} ${noun}s are named "${name}": ${matches.map(describe).join(", ")}. Pass the id.`, []);
+	return match;
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** An environment's id from its id or its name (`findNamed` over `environments.list`). */
+async function resolveEnvironmentId(client, nameOrId) {
+	if (UUID.test(nameOrId)) return nameOrId;
+	const { environments } = await client.environments.list({});
+	return findNamed(environments, "name", nameOrId, "environment", (env) => `${env.id} (${env.ownedBy})`).id;
 }
-// src/commands/auth.ts
-function registerAuthCommand(program) {
-	program.command("auth").description("Inspect CLI authentication").command("whoami").description("Show current configuration and validate API key").action(async (_opts, cmd) => {
-		const root = getGlobalOptions(cmd);
-		const client = getAppClientFromCommand(cmd);
-		const write = (msg) => process.stdout.write(`${msg}\n`);
-		write(styleText("bold", "Standards CLI Configuration"));
-		write(`  API URL:  ${root.apiUrl}`);
-		write(`  API Key:  ${root.apiKey ? `${root.apiKey.slice(0, 8)}...` : styleText("red", "not set")}`);
-		write("");
-		const keys = await client.apiKeys.list({});
-		write(styleText("green", "✓ API key is valid"));
-		if (Array.isArray(keys) && keys.length > 0) write(`  Active keys: ${keys.filter((key) => !key.revokedAt).length}`);
-	});
+/**
+* Whether a streaming or overview command writes for a person: `--format` was
+* left at its default. An explicit `--format json` asks for machine output.
+*/
+function isHumanOutput(cmd) {
+	let root = cmd;
+	while (root.parent) root = root.parent;
+	return root.getOptionValueSource("format") === "default";
 }
-// src/discovery/order-bundles.ts
 /**
-* Orders discovered bundles so each comes after the bundles it `uses`.
-* Bundles a `uses` names that were not discovered are already the host's concern.
+* A secret's value, from piped stdin only: a TTY is refused (no masked prompt
+* exists, and a visible one would leak to scrollback), argv is never read.
 */
-async function orderByUses(discovered) {
-	const byName = new Map(discovered.map((entry) => [entry.bundle.name, entry]));
-	const ordered = [];
-	const visited = /* @__PURE__ */ new Set();
-	async function visit(entry) {
-		if (visited.has(entry.bundle.name)) return;
-		visited.add(entry.bundle.name);
-		for (const used of (await entry.bundle.build()).uses) {
-			const dependency = byName.get(used);
-			if (dependency) await visit(dependency);
-		}
-		ordered.push(entry);
-	}
-	for (const entry of discovered) await visit(entry);
-	return ordered;
+async function readPipedValue(command) {
+	if (process.stdin.isTTY) throw new ValidationError(`Pipe the value: printf %s "$VALUE" | standards ${command}`, []);
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+	const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+	if (!value) throw new ValidationError("The piped value is empty", []);
+	return value;
+}
+/** Whether a person sits at this terminal: both stdin and stdout are TTYs. Agents and CI are not. */
+function isInteractive() {
+	return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }
 // src/commands/bundles.ts
 const HASH_PREFIX_LENGTH = 7;
@@ -270,6 +306,15 @@ function collectDecision(value, decisions) {
 function collectPieceId(value, pieceIds) {
 	return [...pieceIds, value];
 }
+/**
+* An add or update applies exactly the plan a `--dry-run` printed: its
+* fingerprint is required, checked here so the refusal is typed and nothing
+* reaches the API.
+*/
+function requireFingerprint(fingerprint, dryRun) {
+	if (fingerprint) return fingerprint;
+	throw new ValidationError(`Pass the fingerprint of the plan to apply: run "${dryRun}" first, then "--fingerprint <fingerprint>".`, []);
+}
 /** The input `preview` and `add` share: whole bundles, in one locale. */
 function addInput(names, opts) {
 	return {
@@ -285,8 +330,8 @@ function withAddOptions(command) {
 /**
 * The workspace's bundles: sync the ones the project declares, list what is
 * installed and where each stands, remove one, add a bundle the workspace may
-* add as a copy it owns (`preview`, then `add` with the preview's fingerprint)
-* and update such a copy (`update-preview`, then `update` with its fingerprint).
+* add as a copy it owns (`add --dry-run`, then `add` with the plan's fingerprint)
+* and update such a copy (`update --dry-run`, then `update` with its fingerprint).
 */
 function registerBundlesCommand(program) {
 	const bundles = program.command("bundles").description("Sync and manage the workspace's bundles");
@@ -308,29 +353,35 @@ function registerBundlesCommand(program) {
 		const { available } = await getAppClientFromCommand(cmd).bundles.list({ locale: parseLocale(opts.locale) });
 		formatOutput(available, getFormat(cmd));
 	}));
-	withAddOptions(bundles.command("preview").description("Plan an add: what is new, what collides, and the plan's fingerprint")).action((names, opts, cmd) => run(async () => {
-		formatOutput(await getAppClientFromCommand(cmd).bundles.preview(addInput(names, opts)), getFormat(cmd));
-	}));
-	withAddOptions(bundles.command("add").description("Add previewed bundles as copies the workspace owns").requiredOption("--fingerprint <fingerprint>", "the fingerprint `bundles preview` returned").option("--decision <pieceId=choice>", "how to settle a collision: bind, skip or rename:<name> (repeatable)", collectDecision, {})).action((names, opts, cmd) => run(async () => {
-		formatOutput(await getAppClientFromCommand(cmd).bundles.add({
-			...addInput(names, opts),
-			decisions: opts.decision,
-			fingerprint: opts.fingerprint
-		}), getFormat(cmd));
-	}));
-	bundles.command("update-preview").description("Plan an added bundle's update, piece by piece, and the plan's fingerprint").argument("<name>", "bundle name").action((name, _opts, cmd) => run(async () => {
-		formatOutput(await getAppClientFromCommand(cmd).bundles.updatePreview({ name }), getFormat(cmd));
-	}));
-	bundles.command("update").description("Update an added bundle as its preview showed; nothing is removed").argument("<name>", "bundle name").requiredOption("--fingerprint <fingerprint>", "the fingerprint `bundles update-preview` returned").option("--take <pieceId>", "take the new version of a piece you changed (repeatable)", collectPieceId, []).option("--skip-missing <pieceId>", "do not reinstall a missing piece (repeatable)", collectPieceId, []).option("--decision <pieceId=choice>", "how to settle a collision: bind, skip or rename:<name> (repeatable)", collectDecision, {}).action((name, opts, cmd) => run(async () => {
-		const { applied } = await getAppClientFromCommand(cmd).bundles.update({
-			name,
-			fingerprint: opts.fingerprint,
-			take: opts.take,
-			skipMissing: opts.skipMissing,
-			decisions: opts.decision
+	withAddOptions(bundles.command("add").description("Add bundles as copies the workspace owns (--dry-run prints the plan)").option("--dry-run", "print what is new, what collides, and the plan's fingerprint").option("--fingerprint <fingerprint>", "the fingerprint `bundles add --dry-run` printed").option("--decision <pieceId=choice>", "how to settle a collision: bind, skip or rename:<name> (repeatable)", collectDecision, {})).action((names, opts, cmd) => {
+		const fingerprint = opts.dryRun ? void 0 : requireFingerprint(opts.fingerprint, "bundles add --dry-run");
+		return run(async () => {
+			const client = getAppClientFromCommand(cmd);
+			formatOutput(fingerprint === void 0 ? await client.bundles.preview(addInput(names, opts)) : await client.bundles.add({
+				...addInput(names, opts),
+				decisions: opts.decision,
+				fingerprint
+			}), getFormat(cmd));
 		});
-		console.info(`${name} updated, ${applied} applied`);
-	}));
+	});
+	bundles.command("update").description("Update an added bundle as its plan showed; nothing is removed (--dry-run prints the plan)").argument("<name>", "bundle name").option("--dry-run", "print the update plan, piece by piece, and its fingerprint").option("--fingerprint <fingerprint>", "the fingerprint `bundles update --dry-run` printed").option("--take <pieceId>", "take the new version of a piece you changed (repeatable)", collectPieceId, []).option("--skip-missing <pieceId>", "do not reinstall a missing piece (repeatable)", collectPieceId, []).option("--decision <pieceId=choice>", "how to settle a collision: bind, skip or rename:<name> (repeatable)", collectDecision, {}).action((name, opts, cmd) => {
+		const fingerprint = opts.dryRun ? void 0 : requireFingerprint(opts.fingerprint, `bundles update ${name} --dry-run`);
+		return run(async () => {
+			const client = getAppClientFromCommand(cmd);
+			if (fingerprint === void 0) {
+				formatOutput(await client.bundles.updatePreview({ name }), getFormat(cmd));
+				return;
+			}
+			const { applied } = await client.bundles.update({
+				name,
+				fingerprint,
+				take: opts.take,
+				skipMissing: opts.skipMissing,
+				decisions: opts.decision
+			});
+			console.info(`${name} updated, ${applied} applied`);
+		});
+	});
 	bundles.command("remove").description("Remove a synced bundle; its pieces are demoted, never deleted. An added bundle is refused: uninstall it from the Bundles window").argument("<name>", "bundle name").option("--yes", "remove without confirmation").action((name, opts, cmd) => run(async () => {
 		requireConfirmation(opts.yes, `Removing bundle "${name}" demotes its objects to workspace-owned. Re-run with "--yes" to confirm.`);
 		await getAppClientFromCommand(cmd).bundles.remove({ name });
@@ -405,50 +456,210 @@ function registerConnectorsCommand(program) {
 			id,
 			...opts.removeImported ? { removeImported: "true" } : {}
 		});
-		process.stdout.write(`${styleText("green", "✓")} Connector connection ${id} disconnected.\n`);
+		printDone(`Connector connection ${id} disconnected.`);
+	});
+}
+// src/commands/decisions.ts
+function isOption(value) {
+	return isPlainRecord(value) && typeof value.value === "string" && typeof value.label === "string";
+}
+function questionsOf(decision) {
+	const raw = decision.questions?.questions;
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((entry) => {
+		if (!(isPlainRecord(entry) && typeof entry.id === "string")) return [];
+		return [{
+			id: entry.id,
+			question: typeof entry.question === "string" ? entry.question : "",
+			multiSelect: entry.multiSelect === true,
+			options: Array.isArray(entry.options) ? entry.options.filter(isOption) : []
+		}];
+	});
+}
+function setupVariablesOf(decision) {
+	if (decision.type !== DECISION_TYPE_AGENT_SETUP) return [];
+	const raw = decision.questions?.items;
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((item) => {
+		if (!(isPlainRecord(item) && item.kind === "env_var" && typeof item.key === "string")) return [];
+		const scope = item.scope === "agent" || item.scope === "workspace" ? item.scope : void 0;
+		return [{
+			key: item.key,
+			label: typeof item.label === "string" ? item.label : item.key,
+			scope
+		}];
 	});
 }
-// src/drift/shared-state.ts
-async function readSchemaState(client) {
-	const state = parseSchemaState(await client.schemaState.get({}));
-	if (createHash("sha256").update(canonicalStringify(schemaStateSourcePayload(state.entries))).digest("hex") !== state.sourceFingerprint) throw new ValidationError("Invalid schema state: sourceFingerprint does not match deployed source", []);
-	return state;
+/**
+* The command that sets one variable a setup decision asks for: a workspace
+* variable reaches every environment, any other is the caller's own.
+*/
+function secretCommand(variable) {
+	const scope = variable.scope === "workspace" ? "--environments all" : "--private";
+	return `printf %s "$VALUE" | standards secrets set ${variable.key} ${scope}`;
+}
+function numberedOptions(question) {
+	return question.options.map((option, index) => `${index + 1}. ${option.label}`);
+}
+/** The session a decision is about, when it is one's. */
+function sessionIdOf(decision) {
+	return decision.links.find((link) => link.targetType === "session")?.targetId;
+}
+/** Where the app shows a decision: its conversation, or the app's home (the decisions inbox). */
+function decisionUrl(cmd, decision) {
+	const sessionId = sessionIdOf(decision);
+	return sessionId ? conversationUrl(cmd, sessionId) : appUrl(cmd);
+}
+/** A decision as one block of text: title, why, change, numbered options, setup commands. */
+function renderDecision(decision) {
+	const lines = [`${decision.title}  (${decision.type}, ${decision.id})`];
+	if (decision.why) lines.push(`  why: ${decision.why}`);
+	if (decision.change) lines.push(`  change: ${decision.change}`);
+	for (const [index, question] of questionsOf(decision).entries()) {
+		const multi = question.multiSelect ? " (several: 1,3)" : "";
+		lines.push(`  Q${index + 1}. ${question.question}${multi}`);
+		for (const option of numberedOptions(question)) lines.push(`      ${option}`);
+	}
+	for (const variable of setupVariablesOf(decision)) lines.push(`  ${variable.label}: ${secretCommand(variable)}`);
+	if (decision.links.length > 0) lines.push(`  links: ${decision.links.map(formatDecisionLink).join(", ")}`);
+	lines.push(`  answer: standards decisions answer ${decision.id} …`);
+	return `${lines.join("\n")}\n`;
 }
-function prettyCanonical(value) {
-	return JSON.stringify(JSON.parse(canonicalStringify(value)), null, 2);
+function summarizeDecision$1(decision) {
+	return {
+		id: decision.id,
+		type: decision.type,
+		kind: decision.kind,
+		title: decision.title,
+		sender: decision.sender?.label ?? null,
+		questions: questionsOf(decision).map((question) => ({
+			id: question.id,
+			question: question.question,
+			...question.multiSelect && { multiSelect: true },
+			options: numberedOptions(question)
+		}))
+	};
 }
-// src/commands/diff.ts
-async function runDiffCommand(client) {
-	try {
-		const diff = diffSchemaState(await readSchemaState(client));
-		return {
-			exitCode: diff.changes.length ? 1 : 0,
-			diff
-		};
-	} catch (error) {
+function describeDecision(cmd, decision) {
+	return {
+		...summarizeDecision$1(decision),
+		why: decision.why ?? null,
+		change: decision.change ?? null,
+		links: decision.links.map(formatDecisionLink),
+		setup: setupVariablesOf(decision).map((variable) => ({
+			key: variable.key,
+			label: variable.label,
+			command: secretCommand(variable)
+		})),
+		url: decisionUrl(cmd, decision)
+	};
+}
+/** The decisions of one `decisions.list` state, every page; `undefined` is everything not archived. */
+async function readDecisions(client, state, link) {
+	return (await readAllPages((cursor) => client.decisions.list({
+		...state && { state },
+		...link && { link },
+		...cursor && { cursor }
+	}))).map((item) => item.decision);
+}
+/** The caller's open decisions, every page; with `link` (`session:<id>`), only those about it. */
+function readOpenDecisions(client, link) {
+	return readDecisions(client, "open", link);
+}
+/** No `decisions.get` route: the open decisions first, then every state, until the id shows. */
+async function findDecision(client, id) {
+	for (const state of ["open", void 0]) {
+		const found = (await readDecisions(client, state)).find((decision) => decision.id === id);
+		if (found) return found;
+	}
+	throw new NotFoundError("decision", id, void 0, `No decision "${id}"`);
+}
+/** An option number or label (case-insensitive) as the option's value; anything else is free text. */
+function optionValue(question, raw) {
+	const trimmed = raw.trim();
+	if (/^\d+$/.test(trimmed)) {
+		const option = question.options[Number(trimmed) - 1];
+		if (option) return option.value;
+	}
+	const lower = trimmed.toLowerCase();
+	return question.options.find((option) => option.label.toLowerCase() === lower || option.value.toLowerCase() === lower)?.value ?? raw;
+}
+function plural(count, noun) {
+	return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function oneWord(args, words) {
+	const [word, ...rest] = args;
+	if (word === void 0 || rest.length > 0 || !words.includes(word)) throw new ValidationError(`Answer with one of: ${words.join(", ")}`, []);
+	return word;
+}
+function questionAnswer(decision, args, flags) {
+	if (flags.skip) {
+		if (args.length > 0) throw new ValidationError("--skip takes no answer", []);
 		return {
-			exitCode: 2,
-			errorMessage: messageOf(error)
+			kind: "answers",
+			skipped: true,
+			answers: {}
 		};
 	}
+	const questions = questionsOf(decision);
+	if (args.length !== questions.length) throw new ValidationError(`${plural(questions.length, "question")}, ${plural(args.length, "answer")}: pass one answer per question, in order`, []);
+	return {
+		kind: "answers",
+		skipped: false,
+		answers: Object.fromEntries(questions.map((question, index) => {
+			const raw = args[index] ?? "";
+			const value = question.multiSelect ? parseCsvList(raw).map((part) => optionValue(question, part)) : optionValue(question, raw);
+			return [question.id, value];
+		}))
+	};
 }
-function renderDiff(diff) {
-	return ["Deployed source vs shared runtime", ...diff.changes.length ? diff.changes.map((entry) => `${entry.change} ${JSON.stringify(entry.address)}`) : ["No differences."]].join("\n");
-}
-function registerDiffCommand(program) {
-	program.command("diff").description("Compare deployed source vs shared runtime; excludes unbuilt local TypeScript (exit 0 equal, 1 differences, 2 error)").option("--json", "Emit canonical machine-readable differences").action(async (opts, cmd) => {
-		let result;
-		try {
-			result = await runDiffCommand(getAppClientFromCommand(cmd));
-		} catch (error) {
-			result = {
-				exitCode: 2,
-				errorMessage: messageOf(error)
+/**
+* The answer body by the decision's kind, as the app's card builds it. Kinds
+* the CLI cannot answer (fyi, report, a connector to reconnect) are refused
+* before any call, with where the app answers them.
+*/
+function answerFor(cmd, decision, args, flags) {
+	switch (decision.kind) {
+		case "approval": return {
+			kind: "approval",
+			approved: oneWord(args, ["yes", "no"]) === "yes",
+			...flags.reason && { reason: flags.reason }
+		};
+		case "question": return questionAnswer(decision, args, flags);
+		case "review": return {
+			kind: "review",
+			outcome: oneWord(args, ["yes", "changes"]) === "yes" ? "approved" : "changes",
+			...flags.feedback && { feedback: flags.feedback }
+		};
+		case "handoff":
+			if (decision.type === DECISION_TYPE_AGENT_SETUP) return {
+				kind: "setup",
+				action: oneWord(args, ["continue", "skip"]) === "continue" ? "continue" : "skip"
 			};
-		}
-		if (result.exitCode === 2) console.error(styleText("red", `✗ ${result.errorMessage}`));
-		else console.info(opts.json ? prettyCanonical(result.diff) : renderDiff(result.diff));
-		process.exit(result.exitCode);
+			if (decision.type === DECISION_TYPE_BUNDLE_SETUP) {
+				oneWord(args, ["configure"]);
+				return { kind: "configure" };
+			}
+	}
+	throw new ValidationError(`This decision is answered in the app: ${decisionUrl(cmd, decision)}`, []);
+}
+function registerDecisionsCommand(program) {
+	const decisions = program.command("decisions").description("List, read and answer the decisions agents wait on");
+	decisions.command("list").description("List open decisions, options numbered from 1").option("--all", "every decision not archived, answered ones included").action(async (opts, cmd) => {
+		formatOutput((await readDecisions(getAppClientFromCommand(cmd), opts.all ? void 0 : "open")).map(summarizeDecision$1), getFormat(cmd));
+	});
+	decisions.command("show").description("Show a decision: why, change, numbered options, links, setup commands").argument("<id>", "decision id").action(async (id, _opts, cmd) => {
+		formatOutput(describeDecision(cmd, await findDecision(getAppClientFromCommand(cmd), id)), getFormat(cmd));
+	});
+	decisions.command("answer").description("Answer a decision: yes/no, an option number or label per question, changes, continue/skip, configure").argument("<id>", "decision id").argument("[answer...]", "the answer, one per question for a question").option("--reason <reason>", "why, with an approval").option("--feedback <feedback>", "what to change, with a review's changes").option("--skip", "skip every question").action(async (id, args, flags, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const decision = await findDecision(client, id);
+		const answer = answerFor(cmd, decision, args, flags);
+		await client.decisions.answer({
+			decisionId: decision.id,
+			answer
+		});
+		printDone(`Decision ${decision.id} answered.`);
 	});
 }
 // src/commands/documents.ts
@@ -524,33 +735,237 @@ function registerDocumentsCommand(program) {
 		process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
 	});
 }
-// src/commands/embeddings.ts
-function registerEmbeddingsCommand(program) {
-	program.command("embeddings").description("Maintain record and email embeddings").command("drain").description("Embed every pending record and email of the tenant").action(async (_opts, cmd) => {
-		const tenant = requireTenant(cmd, "An embedding drain names its tenant explicitly. Pass \"--tenant <id>\".");
-		await getAppClientFromCommand(cmd).embeddingsAdmin.drain({ tenantId: tenant });
-		process.stdout.write(`${styleText("green", "✓")} Embedding drain accepted for tenant ${tenant}.\n`);
-	});
-}
-// src/commands/folders.ts
-function registerFoldersCommand(program) {
-	program.command("folders").description("Manage record drive folders").command("reconcile-paths").description("Create a folder tree on a record drive from paths").argument("<object>", "object name (e.g. contacts)").argument("<recordId>", "record ID owning the drive").option("--path <path>", "folder path to create (repeatable)", (val, acc) => {
-		acc.push(val);
-		return acc;
-	}, []).option("--paths-file <file>", "file containing one path per line").option("--mode <mode>", "reconcile mode: repair or dryRun", "repair").action(async (objectName, recordId, opts, cmd) => {
-		const paths = [...opts.path];
-		if (opts.pathsFile) {
-			const filePaths = (await readFile(opts.pathsFile, "utf-8")).split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
-			paths.push(...filePaths);
-		}
-		if (paths.length === 0) throw new Error("No paths provided. Pass at least one --path or a non-empty --paths-file.");
-		formatOutput(await getAppClientFromCommand(cmd).folders.reconcilePaths({
-			recordId,
-			objectName,
-			paths,
-			mode: opts.mode
+// src/commands/environments.ts
+/** `--harness`: catalogue ids, or `standards` (no harness), which is `null`. */
+function parseHarnesses(value) {
+	return parseHarnessIds(parseCsvList(value));
+}
+function collect(value, previous = []) {
+	return [...previous, value];
+}
+/** The body fields `create` and `update` share, from the same flags. */
+function sharedFields(opts) {
+	if (opts.visibility === "workspace" && !opts.confirmShared) throw new ValidationError("A workspace environment shares its machines with every member: add --confirm-shared", []);
+	return {
+		...opts.name !== void 0 && { name: opts.name },
+		...opts.repo && { repositories: opts.repo.map((fullName) => ({ fullName })) },
+		...opts.size && { size: opts.size },
+		...opts.maxSize && { maxSize: opts.maxSize },
+		...opts.image && { image: opts.image },
+		...opts.visibility && { visibility: opts.visibility },
+		...opts.visibility === "workspace" && { confirmSharedMachine: true }
+	};
+}
+/** The flags `create` and `update` share. */
+function withEnvironmentFlags(command) {
+	return command.option("--repo <owner/name>", "a repository it clones (repeatable)", collect).addOption(new Option("--size <size>", "the size its machines start at").choices(ENVIRONMENT_SIZES)).addOption(new Option("--max-size <size>", "the largest size a run may ask for").choices(ENVIRONMENT_SIZES)).addOption(new Option("--image <image>", "its base image").choices(ENVIRONMENT_IMAGES)).addOption(new Option("--visibility <visibility>", "who may use it").choices(["private", "workspace"])).option("--confirm-shared", "confirm a workspace environment shares its machines");
+}
+function registerEnvironmentsCommand(program) {
+	const environments = program.command("environments").description("Manage the environments agent machines run in");
+	environments.command("list").description("List the defaults and the environments you can use").action(async (_opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).environments.list({}), getFormat(cmd));
+	});
+	environments.command("get").description("Show an environment with its scripts and last build log").argument("<env>", "environment name or id").action(async (env, _opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const id = await resolveEnvironmentId(client, env);
+		formatOutput(await client.environments.get({ id }), getFormat(cmd));
+	});
+	environments.command("harnesses").description("List the harnesses an environment can accept, with their models").action(async (_opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		formatOutput(await Promise.all(ENVIRONMENT_HARNESSES.map(async (harness) => ({
+			id: harness.id,
+			label: harness.label,
+			models: (await client.environments.harnessModels({ harness: harness.id })).models
+		}))), getFormat(cmd));
+	});
+	withEnvironmentFlags(environments.command("create").description("Create an environment").requiredOption("--name <name>", "its name").requiredOption("--harness <id,…|standards>", "the harnesses it accepts, or standards")).action(async (opts, cmd) => {
+		const body = {
+			...sharedFields(opts),
+			name: opts.name,
+			acceptedHarnesses: parseHarnesses(opts.harness)
+		};
+		formatOutput(await getAppClientFromCommand(cmd).environments.create(body), getFormat(cmd));
+	});
+	withEnvironmentFlags(environments.command("update").description("Update an environment").argument("<env>", "environment name or id").option("--name <name>", "its new name").option("--harness <id,…>", "the harnesses it accepts")).action(async (env, opts, cmd) => {
+		const acceptedHarnesses = opts.harness === void 0 ? void 0 : parseHarnesses(opts.harness);
+		if (acceptedHarnesses === null) throw new ValidationError("A Standards environment is chosen at creation only", []);
+		const client = getAppClientFromCommand(cmd);
+		const id = await resolveEnvironmentId(client, env);
+		formatOutput(await client.environments.update({
+			id,
+			...sharedFields(opts),
+			...acceptedHarnesses && { acceptedHarnesses }
+		}), getFormat(cmd));
+	});
+	environments.command("build").description("Start building an environment's image").argument("<env>", "environment name or id").action(async (env, _opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const id = await resolveEnvironmentId(client, env);
+		await client.environments.build({ id });
+		printDone(`Build started for environment ${id}.`);
+	});
+	environments.command("archive").description("Archive an environment").argument("<env>", "environment name or id").option("--yes", "archive without confirmation").action(async (env, opts, cmd) => {
+		requireConfirmation(opts.yes, "Archiving an environment is explicit. Re-run with \"--yes\" to confirm.");
+		const client = getAppClientFromCommand(cmd);
+		const id = await resolveEnvironmentId(client, env);
+		await client.environments.archive({ id });
+		printDone(`Environment ${id} archived.`);
+	});
+}
+// src/commands/files.ts
+function registerFilesCommand(program) {
+	const files = program.command("files").description("Upload, list, download and delete files");
+	files.command("list").description("List files (with --ids: exactly those, in that order)").option("--ids <ids>", "comma-separated file IDs; the other filters and the page do not apply").option("--limit <n>", "max files to return").option("--offset <n>", "number of files to skip").option("--folder <path>", "only files in this folder path").option("--mime-type <type>", "only files of this MIME type").action(async (opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).files.list({
+			...opts.ids !== void 0 ? { ids: parseCsvList(opts.ids).join(",") } : {},
+			...opts.limit !== void 0 ? { limit: parseCount("--limit", opts.limit) } : {},
+			...opts.offset !== void 0 ? { offset: parseCount("--offset", opts.offset) } : {},
+			...opts.folder ? { folderPath: opts.folder } : {},
+			...opts.mimeType ? { mimeType: opts.mimeType } : {}
 		}), getFormat(cmd));
 	});
+	files.command("get").description("Get a file by ID").argument("<id>", "file ID").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).files.get({ id }), getFormat(cmd));
+	});
+	files.command("upload").description("Upload local files (private); prints the stored files and their IDs").argument("<paths...>", "local file paths (at most 10)").action(async (paths, _opts, cmd) => {
+		const uploads = await Promise.all(paths.map(async (path) => new File([await readFile(path)], basename(path))));
+		formatOutput(await getAppClientFromCommand(cmd).files.upload({ files: uploads }), getFormat(cmd));
+	});
+	files.command("content").description("Download a file's bytes (to stdout, or -o <file>)").argument("<id>", "file ID").option("-o, --output <file>", "write to a file instead of stdout").action(async (id, opts, cmd) => {
+		const { blob } = await getAppClientFromCommand(cmd).files.content({ id });
+		const bytes = new Uint8Array(await blob.arrayBuffer());
+		if (opts.output) return await writeFile(opts.output, bytes);
+		process.stdout.write(bytes);
+	});
+	files.command("delete").description("Delete a file you uploaded and its stored bytes (not a file in a document pack)").argument("<id>", "file ID").option("--yes", "delete without confirmation").action(async (id, opts, cmd) => {
+		requireConfirmation(opts.yes, "Deleting a file purges its bytes. Re-run with \"--yes\" to confirm.");
+		await getAppClientFromCommand(cmd).files.delete({ id });
+		printDone(`File ${id} deleted.`);
+	});
+}
+// src/commands/guide.ts
+const PACKAGE_NAME = "@standards/cli";
+const DEFAULT_TOPIC = "core";
+/**
+* The `guide/` directory shipped next to the package's `package.json`, found
+* through the package's own export of its manifest: it resolves the same from
+* `src/commands/` (tests), from `dist/bin.mjs` and from any `dist/` chunk.
+*/
+function guideDirectory() {
+	const manifest = createRequire(import.meta.url).resolve(`${PACKAGE_NAME}/package.json`);
+	return join(dirname(manifest), "guide");
+}
+/** The topic names, from the guide directory's `*.md` files, sorted. */
+async function guideTopics(dir) {
+	return (await readdir(dir)).filter((file) => file.endsWith(".md")).map((file) => file.slice(0, -3)).sort();
+}
+/** `standards guide [topic]`: the usage guide matching the installed version. */
+function registerGuideCommand(program) {
+	program.command("guide").description("Print the usage guide for this version of the CLI (core by default)").argument("[topic]", "guide topic", DEFAULT_TOPIC).option("--list", "list the topics, one per line").action(async (topic, opts) => {
+		const dir = guideDirectory();
+		const topics = await guideTopics(dir);
+		if (opts.list) {
+			process.stdout.write(topics.map((name) => `${name}\n`).join(""));
+			return;
+		}
+		if (!topics.includes(topic)) throw new ValidationError(`Unknown guide topic "${topic}". Topics: ${topics.join(", ")}`, []);
+		process.stdout.write(await readFile(join(dir, `${topic}.md`)));
+	});
+}
+// src/commands/init.ts
+/** The line that marks a `SKILL.md` as this command's own, the only one it overwrites. */
+const SKILL_STUB_MARKER = "<!-- standards-cli-stub -->";
+const SKILL_DIR = join(".agents", "skills", "standards");
+const LINK_PATH = join(".claude", "skills", "standards");
+/** Relative, so the link survives a moved or mounted home or project. */
+const LINK_TARGET = join("..", "..", SKILL_DIR);
+const SKILL_STUB = `---
+name: standards
+description: Drive a Standards workspace from the shell with the \`standards\` CLI. It covers records and documents, schema and bundles, skills, MCP servers and connectors, and Standards agents (environments and their secrets, machines and their links, sessions on the claude-code, codex or cursor harnesses, the decisions they stop on, monitoring with status and watch). Use it whenever a task reads or changes Standards data, configures or starts an agent session, answers an agent's decision, or follows running sessions.
+---
+
+${SKILL_STUB_MARKER}
+
+# standards
+
+This file is a discovery stub, not the usage guide. Before running any \`standards\` command, load the guide from the CLI:
+
+\`\`\`bash
+standards guide core        # start here: login, global flags, output, exit codes, the agent loop
+standards guide --list      # every topic
+\`\`\`
+
+For agent work (environments, secrets, sessions, decisions, machines, links, watch), also load:
+
+\`\`\`bash
+standards guide agents
+\`\`\`
+
+The CLI serves the guide matching its installed version, so it never goes stale. This stub cannot change between releases, which is why it only points at \`standards guide\`.
+
+Re-run \`standards init\` (or \`standards init --global\`) to refresh it.
+`;
+async function lstatOrNull(path) {
+	try {
+		return await lstat(path);
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function isOwnStub(file) {
+	if (!(await lstatOrNull(file))?.isFile()) return false;
+	return (await readFile(file, "utf8")).includes(SKILL_STUB_MARKER);
+}
+function refuse(path, reason) {
+	throw new ValidationError(`${path} ${reason}: "standards init" does not overwrite it. Move it away and re-run.`, []);
+}
+/** What already sits at the link path: nothing, our link, our copy, or something to refuse. */
+async function linkState(link) {
+	const stats = await lstatOrNull(link);
+	if (!stats) return "missing";
+	if (stats.isSymbolicLink()) {
+		const target = await readlink(link);
+		if (target === LINK_TARGET) return "linked";
+		refuse(link, `is a symbolic link to ${target}`);
+	}
+	if (stats.isDirectory() && await isOwnStub(join(link, "SKILL.md"))) return "copied";
+	return refuse(link, "already exists");
+}
+/**
+* Writes the stub under `root` and links `.claude/skills/standards` to it. Every
+* check runs before the first write, so a refusal leaves the disk untouched.
+* Returns the lines to print.
+*/
+async function installSkillStub(root) {
+	const skillDir = join(root, SKILL_DIR);
+	const skillFile = join(skillDir, "SKILL.md");
+	const link = join(root, LINK_PATH);
+	const dirStats = await lstatOrNull(skillDir);
+	if (dirStats && !dirStats.isDirectory()) refuse(skillDir, "is not a directory");
+	if (await lstatOrNull(skillFile) && !await isOwnStub(skillFile)) refuse(skillFile, "was not written by standards init");
+	const state = await linkState(link);
+	await mkdir(skillDir, { recursive: true });
+	await writeFile(skillFile, SKILL_STUB);
+	const lines = [`Wrote ${skillFile}`];
+	if (state === "linked") return [...lines, `Kept ${link} -> ${LINK_TARGET}`];
+	if (state === "missing") {
+		await mkdir(dirname(link), { recursive: true });
+		try {
+			await symlink(LINK_TARGET, link, "dir");
+			return [...lines, `Linked ${link} -> ${LINK_TARGET}`];
+		} catch {
+			await mkdir(link, { recursive: true });
+		}
+	}
+	await writeFile(join(link, "SKILL.md"), SKILL_STUB);
+	return [...lines, `Copied the stub to ${join(link, "SKILL.md")}`];
+}
+/** `standards init [--global]`: installs the skill stub coding agents discover. */
+function registerInitCommand(program) {
+	program.command("init").description("Install the standards skill stub for coding agents (.agents/skills and .claude/skills)").option("--global", "install under your home directory instead of the current one").action(async (opts) => {
+		const lines = await installSkillStub(opts.global ? homedir() : process.cwd());
+		process.stdout.write(lines.map((line) => `${line}\n`).join(""));
+	});
 }
 // src/commands/invitations.ts
 /** Invitation ids are `randomUUID` server-side, so anything else is a caller mistake. */
@@ -592,12 +1007,10 @@ function registerInvitationsCommand(program) {
 }
 // src/commands/keys.ts
 async function resolveRoleId(client, name) {
-	const match = (await client.permissions.listRoles({})).find((role) => role.name === name);
-	if (!match) throw new Error(`Unknown role "${name}". Roles are listed in the app's People settings.`);
-	return match.id;
+	return findNamed(await client.permissions.listRoles({}), "name", name, "role").id;
 }
 function registerKeysCommand(program) {
-	const keys = program.command("keys").description("Manage Standards API keys");
+	const keys = program.command("keys").description("Manage Standards API keys").addHelpText("after", "\nA browser-login profile cannot create keys nor revoke another key: log in with --key, or manage keys in Settings → API keys.");
 	keys.command("list").description("List API keys").action(async (_opts, cmd) => {
 		formatOutput(await getAppClientFromCommand(cmd).apiKeys.list({}), getFormat(cmd));
 	});
@@ -617,7 +1030,66 @@ function registerKeysCommand(program) {
 	keys.command("revoke").description("Revoke an API key").argument("<id>", "API key ID").option("--yes", "revoke without confirmation").action(async (id, opts, cmd) => {
 		if (!opts.yes) throw new Error("Revoking API keys is explicit. Re-run with \"--yes\" to confirm.");
 		await getAppClientFromCommand(cmd).apiKeys.revoke({ id });
-		process.stdout.write(`${styleText("green", "✓")} API key ${id} revoked.\n`);
+		printDone(`API key ${id} revoked.`);
+	});
+}
+// src/commands/links.ts
+const UNIT_MS$1 = {
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+/** `30m`, `2h`, `1d` in milliseconds; anything else, zero or past `LINK_MAX_MS` is refused. */
+function parseLinkDuration(value) {
+	return parseDuration("--for", value, {
+		units: UNIT_MS$1,
+		example: "30m, 2h or 1d",
+		limit: `at most ${LINK_MAX_MS / UNIT_MS$1.h}h`,
+		max: LINK_MAX_MS
+	});
+}
+function registerLinksCommand(program) {
+	const links = program.command("links").description("Open and manage the links machines publish");
+	links.command("open").description("Print the link's URL with a single-use, 60-second token: open it, never share it").argument("<linkId>", "link id").action(async (id, _opts, cmd) => {
+		const { url } = await getAppClientFromCommand(cmd).links.open({ id });
+		process.stdout.write(`${url}\n`);
+	});
+	links.command("relaunch").description("Rerun the link's command, its machine woken first").argument("<linkId>", "link id").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).links.relaunch({ id }), getFormat(cmd));
+	});
+	links.command("extend").description("Make the link expire a duration from now").argument("<linkId>", "link id").requiredOption("--for <duration>", "30m, 2h, 1d…").action(async (id, opts, cmd) => {
+		const durationMs = parseLinkDuration(opts.for);
+		formatOutput(await getAppClientFromCommand(cmd).links.setDuration({
+			id,
+			durationMs
+		}), getFormat(cmd));
+	});
+}
+// src/commands/machines.ts
+function registerMachinesCommand(program) {
+	const machines = program.command("machines").description("Inspect and destroy agent machines");
+	machines.command("list").description("List the machines you can read, every page").option("--env <env>", "only one environment's machines (name or id)").action(async (opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const environmentId = opts.env ? await resolveEnvironmentId(client, opts.env) : void 0;
+		formatOutput(await readAllPages((cursor) => client.machines.list({
+			...environmentId && { environmentId },
+			...cursor && { cursor }
+		})), getFormat(cmd));
+	});
+	machines.command("get").description("Show a machine: its lease, pilot and links").argument("<id>", "machine id").action(async (id, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).machines.get({ id }), getFormat(cmd));
+	});
+	machines.command("runs").description("List the runs and conversation turns of a machine, every page").argument("<id>", "machine id").action(async (id, _opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		formatOutput(await readAllPages((cursor) => client.machines.runs({
+			id,
+			...cursor && { cursor }
+		})), getFormat(cmd));
+	});
+	machines.command("destroy").description("Destroy a machine").argument("<id>", "machine id").option("--yes", "destroy without confirmation").action(async (id, opts, cmd) => {
+		requireConfirmation(opts.yes, "Destroying a machine is explicit. Re-run with \"--yes\" to confirm.");
+		await getAppClientFromCommand(cmd).machines.destroy({ id });
+		printDone(`Machine ${id} destroyed.`);
 	});
 }
 // src/commands/mcp.ts
@@ -676,12 +1148,12 @@ function registerMcpCommand(program) {
 			id,
 			trusted
 		});
-		process.stdout.write(`${styleText("green", "✓")} MCP server ${id} ${trusted ? "trusted" : "untrusted"}.\n`);
+		printDone(`MCP server ${id} ${trusted ? "trusted" : "untrusted"}.`);
 	});
 	mcp.command("disconnect").description("Disconnect (delete) an MCP server").argument("<id>", "MCP server ID").option("--yes", "disconnect without confirmation").action(async (id, opts, cmd) => {
 		if (!opts.yes) throw new ValidationError("Disconnecting an MCP server is explicit. Re-run with \"--yes\" to confirm.", []);
 		await getAppClientFromCommand(cmd).mcpServers.delete({ id });
-		process.stdout.write(`${styleText("green", "✓")} MCP server ${id} disconnected.\n`);
+		printDone(`MCP server ${id} disconnected.`);
 	});
 }
 // src/commands/meetings.ts
@@ -703,18 +1175,6 @@ function buildQuery(opts) {
 	if (opts.offset !== void 0) query.offset = parseCount("--offset", opts.offset);
 	return query;
 }
-/** "needs_action" is no answer, so the API takes only the schema's answers. */
-function parseResponse(response) {
-	if (MEETING_RESPONSES.includes(response)) return response;
-	throw new ValidationError(`response must be one of: ${MEETING_RESPONSES.join(", ")}`, []);
-}
-/** `--auto` clears the override; `--force` / `--skip` set it. Exactly one flag. */
-function parseOverride(opts) {
-	const chosen = RECORDING_OVERRIDES.filter((override) => opts[override]);
-	if (opts.auto) chosen.push(null);
-	if (chosen.length !== 1) throw new ValidationError("record needs exactly one of --force, --skip or --auto", []);
-	return chosen[0] ?? null;
-}
 /** The query flags `list` and `for-record` share — both take the same body shape. */
 function withQueryOptions(command) {
 	return command.option("--search <text>", "match title, description and location").option("--since <iso>", "inclusive ISO lower bound on the start").option("--before <iso>", "exclusive ISO upper bound on the start").option("--addresses <emails>", "comma-separated participant addresses to restrict to").option("--order <order>", "asc for what is coming next, desc to read history").option("--limit <n>", "max meetings to return").option("--offset <n>", "number of meetings to skip");
@@ -738,72 +1198,6 @@ function registerMeetingsCommand(program) {
 	meetings.command("transcript").description("Read a meeting's completed transcript").argument("<id>", "meeting ID").action(async (id, _opts, cmd) => {
 		formatOutput(await getAppClientFromCommand(cmd).meetings.transcript({ meetingId: id }), getFormat(cmd));
 	});
-	meetings.command("record").description("Force, skip, or hand back to the workspace policy the recording of a meeting").argument("<id>", "meeting ID").option("--force", "record this meeting whatever the workspace policy says").option("--skip", "never record this meeting").option("--auto", "clear the override and follow the workspace policy").action(async (id, opts, cmd) => {
-		const override = parseOverride(opts);
-		formatOutput(await getAppClientFromCommand(cmd).meetings.setRecording({
-			meetingId: id,
-			override
-		}), getFormat(cmd));
-	});
-	meetings.command("respond").description("Answer a meeting invitation").argument("<id>", "meeting ID").argument("<response>", `one of: ${MEETING_RESPONSES.join(", ")}`).option("--notify-organizer", "send the answer to the organizer").action(async (id, response, opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).meetings.respond({
-			meetingId: id,
-			response: parseResponse(response),
-			notifyOrganizer: opts.notifyOrganizer === true
-		}), getFormat(cmd));
-	});
-	meetings.command("stop-recording").description("Stop the recording of a meeting in progress").argument("<id>", "meeting ID").action(async (id, _opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).meetings.stopRecording({ meetingId: id }), getFormat(cmd));
-	});
-	meetings.command("grants-recompute").description("Recompute the attendee grants of every private meeting of the tenant").action(async (_opts, cmd) => {
-		const tenant = requireTenant(cmd, "A meeting grants recompute names its tenant explicitly. Pass \"--tenant <id>\".");
-		await getAppClientFromCommand(cmd).meetingsAdmin.recomputeGrants({ tenantId: tenant });
-		process.stdout.write(`${styleText("green", "✓")} Meeting grants recompute accepted for tenant ${tenant}.\n`);
-	});
-}
-// src/commands/memory.ts
-function registerMemoryCommand(program) {
-	program.command("memory").description("Maintain agent memory").command("backfill").description("Rebuild agent memory from the tenant's last 30 days of sessions and meetings").option("--yes", "backfill without confirmation").action(async (opts, cmd) => {
-		if (!opts.yes) throw new ValidationError("A memory backfill spends model calls on the last 30 days of evidence. Re-run with \"--yes\" to confirm.", []);
-		const tenant = requireTenant(cmd, "A memory backfill names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
-		await getAppClientFromCommand(cmd).memoryAdmin.backfill({ tenantId: tenant });
-		process.stdout.write(`${styleText("green", "✓")} Memory backfill queued for tenant ${tenant}. It runs in the background — follow the server logs for progress.\n`);
-	});
-}
-// src/drift/reconciliation-prompt.ts
-function renderReconciliationPrompt(state) {
-	const lines = [
-		"# Standards schema reconciliation",
-		"",
-		"Compare deployed source with shared runtime. This excludes unbuilt local TypeScript and personal preferences.",
-		"Review the shared changes, update the fluent declarations, then deploy. Copies stay retained after a deploy: reset them in architect mode to return to the source.",
-		"Use content with detailView/listView and .tab or .aside for view contents. Reading this prompt changes no files or workspace state.",
-		""
-	];
-	const { changes } = diffSchemaState(state);
-	if (changes.length === 0) lines.push("No differences.");
-	for (const entry of changes) lines.push(`## ${entry.change} ${JSON.stringify(entry.address)}`, `Status: ${entry.status}${entry.status === "copy" ? " (retained)" : ""}`, "```json", prettyCanonical(entry.effective ?? entry.source), "```", "");
-	return `${lines.join("\n").trimEnd()}\n`;
-}
-// src/commands/pull.ts
-function registerPullCommand(program) {
-	program.command("pull").description("Read deployed source vs shared runtime; excludes unbuilt local TypeScript").option("--json", "Emit canonical shared state JSON instead of guidance").action(async (opts, cmd) => {
-		let code = 0;
-		try {
-			const state = await readSchemaState(getAppClientFromCommand(cmd));
-			console.info(opts.json ? prettyCanonical(state) : renderReconciliationPrompt(state).trimEnd());
-		} catch (error) {
-			console.error(styleText("red", `✗ ${messageOf(error)}`));
-			code = 2;
-		}
-		process.exit(code);
-	});
-}
-// src/commands/quotas.ts
-function registerQuotasCommand(program) {
-	program.command("quotas").description("Inspect the tenant's remaining capacity").command("list").description("List one state per quota key (limit is null when nothing is enforced)").action(async (_opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).quotas.list({}), getFormat(cmd));
-	});
 }
 // src/commands/records.ts
 function parseSortFlag(sort) {
@@ -845,12 +1239,16 @@ function registerRecordsCommand(program) {
 			id
 		}), getFormat(cmd));
 	});
-	records.command("create").description("Create a new record").argument("<object>", "object name").option("--data <json>", "record data as JSON string").option("--parent <id>", "parent record ID (hierarchical objects only)").action(async (objectName, opts, cmd) => {
+	records.command("create").description("Create a new record").argument("<object>", "object name").option("--data <json>", "record data as JSON string").option("--parent <id>", "parent record ID (hierarchical objects only)").option("--metadata <json>", "record metadata as a JSON object (application state beside its values)").action(async (objectName, opts, cmd) => {
 		const data = opts.data ? JSON.parse(opts.data) : {};
+		const options = {
+			...opts.parent ? { parentId: opts.parent } : {},
+			...opts.metadata !== void 0 ? { metadata: JSON.parse(opts.metadata) } : {}
+		};
 		formatOutput(await getAppClientFromCommand(cmd).records.create({
 			objectName,
 			data,
-			...opts.parent ? { options: { parentId: opts.parent } } : {}
+			...Object.keys(options).length > 0 ? { options } : {}
 		}), getFormat(cmd));
 	});
 	records.command("update").description("Update a record").argument("<object>", "object name").argument("<id>", "record ID").option("--data <json>", "fields to update as JSON string").action(async (objectName, id, opts, cmd) => {
@@ -861,32 +1259,37 @@ function registerRecordsCommand(program) {
 			values: data
 		}), getFormat(cmd));
 	});
-	records.command("delete").description("Delete a record").argument("<object>", "object name").argument("<id>", "record ID").action(async (objectName, id, _opts, cmd) => {
-		await getAppClientFromCommand(cmd).records.delete({
-			objectName,
-			id
-		});
-		process.stdout.write(`Record ${id} deleted.\n`);
-	});
-	records.command("deletion-count").description("Count what deleting records would take: broken links and descendants").argument("<object>", "object name").argument("<ids...>", "record IDs").action(async (objectName, ids, _opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).records.deletionCount({
+	records.command("delete").description("Delete records (--dry-run counts what the delete would take)").argument("<object>", "object name").argument("<ids...>", "record IDs").option("--dry-run", "count the broken links and descendants, delete nothing").action(async (objectName, ids, opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		if (opts.dryRun) {
+			formatOutput(await client.records.deletionCount({
+				objectName,
+				ids
+			}), getFormat(cmd));
+			return;
+		}
+		const [id] = ids;
+		if (id !== void 0 && ids.length === 1) {
+			await client.records.delete({
+				objectName,
+				id
+			});
+			process.stdout.write(`Record ${id} deleted.\n`);
+			return;
+		}
+		formatOutput(await client.records.bulkDelete({
 			objectName,
 			ids
 		}), getFormat(cmd));
 	});
-	records.command("move-impact").description("Show who would gain and lose access if a record moved").argument("<object>", "object name").argument("<id>", "record ID").option("--parent <id>", "new parent record ID").option("--top-level", "move to the top level").action(async (objectName, id, opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).records.moveImpact({
+	records.command("move").description("Move a record and its descendants under a parent (--dry-run shows the access impact)").argument("<object>", "object name").argument("<id>", "record ID").option("--parent <id>", "new parent record ID").option("--top-level", "move to the top level").option("--dry-run", "show who would gain and lose access, move nothing").action(async (objectName, id, opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const body = {
 			objectName,
 			recordId: id,
 			parentId: parseMoveTarget(opts)
-		}), getFormat(cmd));
-	});
-	records.command("move").description("Move a record and its descendants under a parent (preview with move-impact)").argument("<object>", "object name").argument("<id>", "record ID").option("--parent <id>", "new parent record ID").option("--top-level", "move to the top level").action(async (objectName, id, opts, cmd) => {
-		formatOutput(await getAppClientFromCommand(cmd).records.move({
-			objectName,
-			recordId: id,
-			parentId: parseMoveTarget(opts)
-		}), getFormat(cmd));
+		};
+		formatOutput(opts.dryRun ? await client.records.moveImpact(body) : await client.records.move(body), getFormat(cmd));
 	});
 	records.command("search").description("Full-text search records").argument("<object>", "object name").requiredOption("--query <q>", "search query string").option("--limit <n>", "max records to return").option("--offset <n>", "number of records to skip").option("--sort <sort>", "sort rule as \"attribute:direction\"").option("--filter <json>", "filter state as JSON string").option("--fields <names>", "comma-separated reference attributes to hydrate (empty for none, omit for all)").option("--count <mode>", COUNT_OPTION_DESCRIPTION).action(async (objectName, opts, cmd) => {
 		const body = {
@@ -940,6 +1343,16 @@ function registerRecordsCommand(program) {
 			files: new File([fileContent], fileName)
 		}), getFormat(cmd));
 	});
+	records.command("attach-file").description("Attach an already uploaded file to a record").argument("<object>", "object name (e.g. contacts)").argument("<recordId>", "record ID").requiredOption("--file-id <fileId>", "ID of a private uploaded file").option("--attribute <attr>", "document attribute (defaults to the record's attachments)").option("--document-id <documentId>", "append to this document's pack instead of creating one").option("--title <title>", "title of a new document (defaults to the file name without its extension)").action(async (objectName, recordId, opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).records.attachFile({
+			objectName,
+			id: recordId,
+			fileId: opts.fileId,
+			...opts.attribute ? { attributeName: opts.attribute } : {},
+			...opts.documentId ? { documentId: opts.documentId } : {},
+			...opts.title ? { title: opts.title } : {}
+		}), getFormat(cmd));
+	});
 	const access = records.command("access").description("Share a private record with other actors (readers and editors)");
 	access.command("list").description("Show who can reach a private record beyond its owner").argument("<object>", "object name").argument("<id>", "record ID").action(async (objectName, id, _opts, cmd) => {
 		formatOutput(await getAppClientFromCommand(cmd).recordAccess.list({
@@ -973,9 +1386,6 @@ function registerRecordsCommand(program) {
 // src/config.ts
 const DEFAULT_API_URL = "http://localhost:4100/v1";
 const ENV_PROFILE_NAME = "sandbox";
-function getDefaultApiUrl() {
-	return DEFAULT_API_URL;
-}
 function getConfigPath() {
 	const configDir = process.env.STANDARDS_CONFIG_DIR ?? join(homedir(), ".standards");
 	return join(configDir, "config.json");
@@ -1008,7 +1418,9 @@ async function upsertProfile(input) {
 	const config = await readConfig();
 	config.profiles[input.name] = {
 		apiUrl: input.apiUrl,
-		apiKey: input.apiKey
+		apiKey: input.apiKey,
+		...input.keyId ? { keyId: input.keyId } : {},
+		...input.keyName ? { keyName: input.keyName } : {}
 	};
 	config.currentProfile = input.name;
 	await writeConfig(config);
@@ -1019,6 +1431,7 @@ async function setCurrentProfile(name) {
 	config.currentProfile = name;
 	await writeConfig(config);
 }
+/** Removes a profile, the current one by default. */
 async function removeProfile(name) {
 	const config = await readConfig();
 	const profileName = name ?? config.currentProfile;
@@ -1043,22 +1456,6 @@ async function listProfiles() {
 	});
 	return profiles;
 }
-async function getActiveProfile() {
-	const config = await readConfig();
-	if (!config.currentProfile) {
-		const envProfile = getEnvProfile();
-		return envProfile ? {
-			name: ENV_PROFILE_NAME,
-			...envProfile
-		} : null;
-	}
-	const profile = config.profiles[config.currentProfile];
-	if (!profile) return null;
-	return {
-		name: config.currentProfile,
-		...profile
-	};
-}
 function getEnvProfile() {
 	if (!process.env.STANDARDS_API_KEY) return null;
 	return {
@@ -1087,57 +1484,297 @@ async function resolveCliConfig(options) {
 		apiKey: process.env.STANDARDS_API_KEY
 	};
 }
+// src/commands/device-login.ts
+/** The pre-registered public client of the CLI on every Standards instance. */
+const CLIENT = {
+	client_id: CLI_CLIENT_ID,
+	token_endpoint_auth_method: "none"
+};
+/** RFC 8628 §3.5: a `slow_down` adds five seconds to the polling interval. */
+const SLOW_DOWN_SECONDS = 5;
+const DEFAULT_INTERVAL_SECONDS = 5;
+/** The server refuses more `replaces` ids than this (`cliLoginBody`). */
+const MAX_REPLACES = 20;
+/** A login that ends without a profile: the line to print and the exit code (spec, Terminal). */
+var LoginFailure = class extends Error {
+	constructor(message, exitCode) {
+		super(message);
+		this.exitCode = exitCode;
+		this.name = "LoginFailure";
+	}
+};
+/** This machine's name as the server accepts a device label: 1-64 printable ASCII characters. */
+function deviceLabel() {
+	return hostname().replace(/[^\x20-\x7E]/g, "").trim().slice(0, CLI_DEVICE_LABEL_MAX).trim() || "unknown device";
+}
+/**
+* `standards login` through the browser (RFC 8628): discovers the instance's `cli`
+* resource, shows the code, polls until the person approves, then mints the CLI's
+* personal key once with the access token and stores it as a profile.
+*/
+async function deviceLogin(options) {
+	const { signal } = options;
+	try {
+		const resource = new URL(`${options.apiUrl.replace(/\/+$/, "")}/cli`);
+		const http = {
+			signal,
+			[oauth.allowInsecureRequests]: resource.protocol === "http:"
+		};
+		const as = await discoverAuthorizationServer(resource, options.apiUrl, http);
+		const authorization = await oauth.processDeviceAuthorizationResponse(as, CLIENT, await oauth.deviceAuthorizationRequest(as, CLIENT, oauth.None(), {
+			scope: CLI_LOGIN_SCOPE,
+			resource: resource.href,
+			device: options.device
+		}, http));
+		print(`To connect, open ${authorization.verification_uri} and enter the code:\n\n`);
+		print(`    ${authorization.user_code}\n\n`);
+		print("Press Enter to open the browser…\n");
+		options.waitForEnter().then(() => options.openBrowser(authorization.verification_uri).catch(() => print("Open the link above on any device.\n"))).catch(() => void 0);
+		print("Waiting for you to approve… (Ctrl-C to cancel)\n");
+		return await storeKey(options, await pollForToken(as, authorization, http));
+	} catch (error) {
+		if (signal.aborted && !(error instanceof LoginFailure)) throw new LoginFailure("Login cancelled. Nothing was saved.", 130);
+		throw error;
+	}
+}
+/** RFC 9728 metadata of the `cli` resource, then RFC 8414 metadata of its authorization server. */
+async function discoverAuthorizationServer(resource, apiUrl, http) {
+	const response = await oauth.resourceDiscoveryRequest(resource, http);
+	if (response.status === 404) throw new LoginFailure(`This instance does not offer browser login. Create a personal key in Settings → API keys, then run standards login --url ${apiUrl} --key <key>.`, 1);
+	const issuerUrl = (await oauth.processResourceDiscoveryResponse(resource, response)).authorization_servers?.[0];
+	if (!issuerUrl) throw new Error(`The ${resource.href} metadata names no authorization server.`);
+	const issuer = new URL(issuerUrl);
+	return oauth.processDiscoveryResponse(issuer, await oauth.discoveryRequest(issuer, {
+		...http,
+		algorithm: "oauth2"
+	}));
+}
+/** Polls the token endpoint at the server's interval, slower after each `slow_down`. */
+async function pollForToken(as, authorization, http) {
+	let interval = authorization.interval ?? DEFAULT_INTERVAL_SECONDS;
+	for (;;) {
+		await sleep$2(interval * 1e3, http.signal);
+		try {
+			const response = await oauth.deviceCodeGrantRequest(as, CLIENT, oauth.None(), authorization.device_code, http);
+			return (await oauth.processDeviceCodeResponse(as, CLIENT, response)).access_token;
+		} catch (error) {
+			if (!(error instanceof oauth.ResponseBodyError)) throw error;
+			switch (error.error) {
+				case "authorization_pending": continue;
+				case "slow_down":
+					interval += SLOW_DOWN_SECONDS;
+					continue;
+				case "access_denied": throw new LoginFailure("✗ Login was declined in the browser. Run standards login to try again.", 1);
+				case "expired_token": throw new LoginFailure("✗ The code expired. Run standards login to get a new one.", 1);
+				default: throw error;
+			}
+		}
+	}
+}
+/**
+* Mints the key once with the access token (sent as the transport's bearer), then
+* writes the profile. `replaces` names the keys of every profile on the same instance
+* (D8); a profile whose key the server revoked goes with it. The access token is not kept.
+*/
+async function storeKey(options, accessToken) {
+	const config = await readConfig();
+	const replaces = Object.values(config.profiles).filter((profile) => profile.apiUrl === options.apiUrl && profile.keyId).map((profile) => profile.keyId).slice(0, MAX_REPLACES);
+	let minted;
+	try {
+		minted = await createAppClient(createClient({
+			apiUrl: options.apiUrl,
+			apiKey: accessToken
+		})).cliLogin.createKey({
+			device: options.device,
+			...replaces.length ? { replaces } : {}
+		}, { signal: options.signal });
+	} catch (error) {
+		if (options.signal.aborted) throw new LoginFailure(`Login cancelled. A key may have been created; revoke "Standards CLI - ${options.device}" in Settings → API keys if so.`, 130);
+		throw new LoginFailure(`✗ Approved, but the key could not be created (${error instanceof StandardsRequestError && error.status > 0 ? String(error.status) : "network error"}). Run standards login again.`, 1);
+	}
+	const profileName = options.name ?? (slugify(minted.workspace.name) || "standards");
+	await upsertProfile({
+		name: profileName,
+		apiUrl: options.apiUrl,
+		apiKey: minted.apiKey.secret,
+		keyId: minted.apiKey.id,
+		keyName: minted.apiKey.name
+	});
+	const replaced = new Set(minted.replaced);
+	const removedProfiles = Object.entries(config.profiles).filter(([name, { keyId }]) => name !== profileName && keyId !== void 0 && replaced.has(keyId)).map(([name]) => name);
+	for (const name of removedProfiles) await removeProfile(name);
+	return {
+		profileName,
+		workspace: minted.workspace.name,
+		replacedProfile: profileName in config.profiles,
+		removedProfiles
+	};
+}
+/** A wait that Ctrl-C cuts short. */
+function sleep$2(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) return reject(signal.reason);
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		function onAbort() {
+			clearTimeout(timer);
+			reject(signal.reason);
+		}
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+function print(line) {
+	process.stdout.write(line);
+}
 // src/commands/root.ts
-async function promptForMissingValue(label) {
-	const rl = createInterface({
+/** `login` targets hosted Standards unless `--url` says otherwise (D3); other commands keep `DEFAULT_API_URL`. */
+const HOSTED_API_URL = "https://api.standards.new/v1";
+/** Over SSH the browser `open` would start is on the wrong machine: the person opens the link themselves. */
+async function openBrowser(url) {
+	if (process.env.SSH_CONNECTION || process.env.SSH_TTY) throw new Error("No local browser");
+	const { default: open } = await import("open");
+	await open(url);
+}
+/** Runs the browser login with Ctrl-C and Enter wired to this terminal, and exits with the spec's code on failure. */
+async function loginThroughBrowser(apiUrl, name) {
+	if (!isInteractive()) {
+		console.error(styleText("red", "✗ Non-interactive: set STANDARDS_API_KEY or run standards login --key <key>."));
+		process.exit(2);
+	}
+	const controller = new AbortController();
+	const cancel = () => controller.abort();
+	process.once("SIGINT", cancel);
+	const enter = createInterface({
 		input: stdin,
-		output: stdout
+		terminal: false
 	});
 	try {
-		return (await rl.question(`${label}: `)).trim();
+		const result = await deviceLogin({
+			apiUrl,
+			name,
+			device: deviceLabel(),
+			openBrowser,
+			waitForEnter: () => new Promise((resolve) => enter.once("line", () => resolve())),
+			signal: controller.signal
+		});
+		printDone(`Connected to ${result.workspace}. Profile "${result.profileName}" selected.`);
+		if (result.replacedProfile) process.stdout.write(`  Replaced the previous profile "${result.profileName}".\n`);
+		for (const name of result.removedProfiles) process.stdout.write(`  Removed profile "${name}": its key was replaced.\n`);
+	} catch (error) {
+		if (!(error instanceof LoginFailure)) throw error;
+		console.error(error.exitCode === 130 ? error.message : styleText("red", error.message));
+		process.exit(error.exitCode);
 	} finally {
-		rl.close();
+		process.off("SIGINT", cancel);
+		enter.close();
 	}
 }
-function registerRootCommands(program) {
-	program.command("login").description("Connect the CLI to a Standards instance").option("--url <url>", "Standards API URL", getDefaultApiUrl()).option("--key <key>", "API key to store for this instance").option("--name <name>", "local instance name", "local").action(async (opts) => {
-		const apiKey = opts.key ?? await promptForMissingValue("API key");
-		if (!apiKey) throw new Error("API key is required");
+/** `--key`: validate the pasted key against the instance, then store it (no `keyId`: logout cannot revoke it). */
+async function loginWithKey(apiUrl, apiKey, name) {
+	await createAppClient(createClient({
+		apiUrl,
+		apiKey
+	})).apiKeys.list({});
+	await upsertProfile({
+		name,
+		apiUrl,
+		apiKey
+	});
+	printDone(`Standards instance "${name}" saved and selected.`);
+	process.stdout.write(`  API URL: ${apiUrl}\n`);
+	process.stdout.write(`  API Key: ${apiKey.slice(0, 8)}...\n`);
+	process.stdout.write(`  Use it with: standards --instance ${name} <command>\n`);
+}
+/** How long `logout` waits on the revocation before warning and removing the profile anyway. */
+const REVOKE_TIMEOUT_MS = 1e4;
+/** D11: revoke the profile's key with that key itself, best effort: a failure only warns. */
+async function revokeKey(profile) {
+	if (!profile?.keyId) return;
+	try {
 		await createAppClient(createClient({
-			apiUrl: opts.url,
-			apiKey
-		})).apiKeys.list({});
-		await upsertProfile({
-			name: opts.name,
-			apiUrl: opts.url,
-			apiKey
-		});
-		process.stdout.write(`${styleText("green", "✓")} Standards instance "${opts.name}" saved and selected.\n`);
-		process.stdout.write(`  API URL: ${opts.url}\n`);
-		process.stdout.write(`  API Key: ${apiKey.slice(0, 8)}...\n`);
-		process.stdout.write(`  Use it with: standards --instance ${opts.name} <command>\n`);
+			apiUrl: profile.apiUrl,
+			apiKey: profile.apiKey
+		})).apiKeys.revoke({ id: profile.keyId }, { signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS) });
+	} catch {
+		const keyName = profile.keyName ?? `Standards CLI - ${deviceLabel()}`;
+		console.error(styleText("yellow", `! The key could not be revoked on the server. Revoke "${keyName}" in Settings → API keys.`));
+	}
+}
+function registerRootCommands(program) {
+	program.command("login").description("Connect the CLI to a Standards instance through the browser, or with --key").option("--url <url>", "Standards API URL", HOSTED_API_URL).option("--key <key>", "API key to store for this instance (self-hosted instances, scripts)").option("--name <name>", "profile name (defaults to the workspace name, or \"local\" with --key)").action(async (opts) => {
+		if (opts.key) {
+			await loginWithKey(opts.url, opts.key, opts.name ?? "local");
+			return;
+		}
+		await loginThroughBrowser(opts.url, opts.name);
 	});
 	program.command("use").description("Select the active Standards instance").argument("<name>", "instance name").action(async (name) => {
 		await setCurrentProfile(name);
-		process.stdout.write(`${styleText("green", "✓")} Standards instance "${name}" selected.\n`);
+		printDone(`Standards instance "${name}" selected.`);
 	});
 	program.command("instances").description("List configured Standards instances").action(async (_opts, cmd) => {
 		formatOutput(await listProfiles(), getFormat(cmd));
 	});
-	program.command("current").description("Show the active Standards instance").action(async () => {
-		const profile = await getActiveProfile();
-		if (!profile) {
-			process.stdout.write(`No Standards instance selected. Run "standards login".\n`);
-			return;
-		}
-		process.stdout.write(`${profile.name} ${profile.apiUrl}\n`);
+	program.command("whoami").description("Show the active profile, API URL and key prefix, and validate the key").action(async (_opts, cmd) => {
+		const { profileName, apiUrl, apiKey } = getGlobalOptions(cmd);
+		process.stdout.write(`Profile:  ${profileName ?? "none (--api-key)"}\n`);
+		process.stdout.write(`API URL:  ${apiUrl}\n`);
+		process.stdout.write(`API Key:  ${apiKey?.slice(0, 8)}...\n`);
+		await getAppClientFromCommand(cmd).apiKeys.list({});
+		printDone("API key is valid");
 	});
-	program.command("logout").description("Remove a Standards instance from local CLI config").argument("[name]", "instance name, defaults to current").action(async (name) => {
-		await removeProfile(name);
-		process.stdout.write(`${styleText("green", "✓")} Standards instance removed.\n`);
+	program.command("logout").description("Remove a Standards instance from local CLI config and revoke its key").argument("[name]", "instance name, defaults to current").action(async (name) => {
+		const config = await readConfig();
+		const profileName = name ?? config.currentProfile;
+		await revokeKey(profileName ? config.profiles[profileName] : void 0);
+		await removeProfile(profileName);
+		printDone("Standards instance removed.");
 	});
 }
+// src/drift/shared-state.ts
+async function readSchemaState(client) {
+	const state = parseSchemaState(await client.schemaState.get({}));
+	if (createHash("sha256").update(canonicalStringify(schemaStateSourcePayload(state.entries))).digest("hex") !== state.sourceFingerprint) throw new ValidationError("Invalid schema state: sourceFingerprint does not match deployed source", []);
+	return state;
+}
+function prettyCanonical(value) {
+	return JSON.stringify(JSON.parse(canonicalStringify(value)), null, 2);
+}
+// src/drift/reconciliation-prompt.ts
+function renderReconciliationPrompt(state) {
+	const lines = [
+		"# Standards schema reconciliation",
+		"",
+		"Compare deployed source with shared runtime. This excludes unbuilt local TypeScript and personal preferences.",
+		"Review the shared changes, update the fluent declarations, then deploy. Copies stay retained after a deploy: reset them in architect mode to return to the source.",
+		"Use content with detailView/listView and .tab or .aside for view contents. Reading this prompt changes no files or workspace state.",
+		""
+	];
+	const { changes } = diffSchemaState(state);
+	if (changes.length === 0) lines.push("No differences.");
+	for (const entry of changes) lines.push(`## ${entry.change} ${JSON.stringify(entry.address)}`, `Status: ${entry.status}${entry.status === "copy" ? " (retained)" : ""}`, "```json", prettyCanonical(entry.effective ?? entry.source), "```", "");
+	return `${lines.join("\n").trimEnd()}\n`;
+}
 // src/commands/schema.ts
+async function runDiffCommand(client) {
+	try {
+		const diff = diffSchemaState(await readSchemaState(client));
+		return {
+			exitCode: diff.changes.length ? 1 : 0,
+			diff
+		};
+	} catch (error) {
+		return {
+			exitCode: 2,
+			errorMessage: messageOf(error)
+		};
+	}
+}
+function renderDiff(diff) {
+	return ["Deployed source vs shared runtime", ...diff.changes.length ? diff.changes.map((entry) => `${entry.change} ${JSON.stringify(entry.address)}`) : ["No differences."]].join("\n");
+}
 function registerSchemaCommand(program) {
 	const schema = program.command("schema").description("Inspect schema objects and attributes");
 	schema.command("list").description("List all schema objects").action(async (_opts, cmd) => {
@@ -1149,28 +1786,598 @@ function registerSchemaCommand(program) {
 	schema.command("groups").description("List the bundles that own objects, with their label").action(async (_opts, cmd) => {
 		formatOutput(await getAppClientFromCommand(cmd).schemaGroups.list({}), getFormat(cmd));
 	});
+	schema.command("pull").description("Read deployed source vs shared runtime; excludes unbuilt local TypeScript (--format json for the canonical state)").action(async (_opts, cmd) => {
+		let code = 0;
+		try {
+			const state = await readSchemaState(getAppClientFromCommand(cmd));
+			console.info(isHumanOutput(cmd) ? renderReconciliationPrompt(state).trimEnd() : prettyCanonical(state));
+		} catch (error) {
+			console.error(styleText("red", `✗ ${messageOf(error)}`));
+			code = 2;
+		}
+		process.exit(code);
+	});
+	schema.command("diff").description("Compare deployed source vs shared runtime; excludes unbuilt local TypeScript (exit 0 equal, 1 differences, 2 error)").action(async (_opts, cmd) => {
+		let result;
+		try {
+			result = await runDiffCommand(getAppClientFromCommand(cmd));
+		} catch (error) {
+			result = {
+				exitCode: 2,
+				errorMessage: messageOf(error)
+			};
+		}
+		if (result.exitCode === 2) console.error(styleText("red", `✗ ${result.errorMessage}`));
+		else console.info(isHumanOutput(cmd) ? renderDiff(result.diff) : prettyCanonical(result.diff));
+		process.exit(result.exitCode);
+	});
 }
-// src/commands/search.ts
-function registerSearchCommand(program) {
-	program.command("search").description("Maintain the Standards search index").command("reindex").description("Rebuild the tenant search index beside the live one, then switch").option("--yes", "reindex without confirmation").option("--emails", "hand the tenant's stored emails back to the email indexer instead (nothing is cleared)").option("--after-id <emailId>", "with --emails, resume after the last email id a failed run reported").option("--rebuild", "with --emails and --yes, rebuild the mail search index from the stored mail instead (lifts a quarantine)").action(async (opts, cmd) => {
-		if (opts.afterId !== void 0 && !opts.emails) throw new ValidationError("\"--after-id\" resumes an email reindex. Pass it with \"--emails\".", []);
-		if (opts.rebuild && !opts.emails) throw new ValidationError("\"--rebuild\" rebuilds the mail search index. Pass it with \"--emails\".", []);
-		if (opts.rebuild && opts.afterId !== void 0) throw new ValidationError("\"--after-id\" resumes a requeue; a mail rebuild reads every stored email. Pass one of them.", []);
-		if (opts.emails) {
-			const tenant = requireTenant(cmd, "An email reindex names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
-			if (opts.rebuild && !opts.yes) throw new ValidationError("A mail rebuild re-reads every stored email. Re-run with \"--yes\" to confirm.", []);
-			await getAppClientFromCommand(cmd).searchAdmin.emailReindex({
-				tenantId: tenant,
-				...opts.afterId !== void 0 && { afterId: opts.afterId },
-				...opts.rebuild && { rebuild: true }
-			});
-			process.stdout.write(opts.rebuild ? `${styleText("green", "✓")} Mail index rebuild accepted. Mail search keeps answering from the current index until the rebuilt one replaces it — follow the server logs for progress.\n` : `${styleText("green", "✓")} Email reindex accepted for tenant ${tenant}. It runs in the background — follow the server logs for progress.\n`);
+// src/commands/secrets.ts
+/** The owner flags are judged before stdin or any call: `--private` and `--env` exclude each other. */
+function checkOwnerFlags(opts) {
+	if (opts.private && opts.env) throw new ValidationError("--private and --env name different owners: pass one", []);
+	if (opts.repository && !opts.env) throw new ValidationError("--repository is only accepted with --env <env>", []);
+}
+async function resolveOwner(client, opts) {
+	if (opts.private) return { kind: "private" };
+	if (!opts.env) return { kind: "workspace" };
+	const id = await resolveEnvironmentId(client, opts.env);
+	return opts.repository ? {
+		kind: "environment",
+		id,
+		repository: opts.repository
+	} : {
+		kind: "environment",
+		id
+	};
+}
+/** A listed secret without its `value`: the CLI never prints one, sensitive or not. */
+function withoutValue(entry) {
+	if (entry.kind !== "variable") return entry;
+	const { value: _omitted, ...rest } = entry;
+	return rest;
+}
+async function listOwnerSecrets(client, owner) {
+	switch (owner.kind) {
+		case "workspace": return await client.envVars.list({});
+		case "private": return await client.privateEnvVars.list({});
+		case "environment": return await client.environmentEnvVars.list({ id: owner.id });
+	}
+}
+/** What a new workspace secret reaches: `all`, or each named environment's id. */
+async function resolveReach(client, value) {
+	const names = parseCsvList(value);
+	if (names.length === 1 && names[0] === "all") return "all";
+	if (names.includes("all")) throw new ValidationError("--environments takes \"all\" alone or environment names", []);
+	return await Promise.all(names.map((name) => resolveEnvironmentId(client, name)));
+}
+async function setSecret(client, owner, entry, environments) {
+	switch (owner.kind) {
+		case "private": return await client.privateEnvVars.upsert(entry);
+		case "environment": return await client.environmentEnvVars.batch({
+			id: owner.id,
+			set: [owner.repository ? {
+				...entry,
+				repository: owner.repository
+			} : entry],
+			remove: []
+		});
+		case "workspace": return await client.envVars.upsert(environments === void 0 ? entry : {
+			...entry,
+			environments: await resolveReach(client, environments)
+		});
+	}
+}
+async function deleteSecret(client, owner, key) {
+	const variables = (await listOwnerSecrets(client, owner)).filter((entry) => entry.kind === "variable");
+	if (owner.kind === "environment") {
+		findNamed(variables.filter((entry) => entry.repository === owner.repository), "key", key, "secret");
+		await client.environmentEnvVars.batch({
+			id: owner.id,
+			set: [],
+			remove: [owner.repository ? {
+				key,
+				repository: owner.repository
+			} : key]
+		});
+		return;
+	}
+	const { id } = findNamed(variables, "key", key, "secret");
+	if (owner.kind === "private") await client.privateEnvVars.delete({ id });
+	else await client.envVars.delete({ id });
+}
+function stripped(result) {
+	return Array.isArray(result) ? result.map(withoutValue) : withoutValue(result);
+}
+/** A workspace secret that reaches no environment yet; an update keeps the key's reach. */
+function reachesNoEnvironment(result) {
+	if (Array.isArray(result)) return false;
+	const { environments } = result;
+	return environments === void 0 || Array.isArray(environments) && environments.length === 0;
+}
+function registerSecretsCommand(program) {
+	const secrets = program.command("secrets").description("Manage secrets: the workspace's, your own, or an environment's");
+	secrets.command("list").description("List secrets (never their values)").option("--private", "your own secrets").option("--env <env>", "an environment's secrets (name or id)").action(async (opts, cmd) => {
+		checkOwnerFlags(opts);
+		const client = getAppClientFromCommand(cmd);
+		formatOutput((await listOwnerSecrets(client, await resolveOwner(client, opts))).map(withoutValue), getFormat(cmd));
+	});
+	secrets.command("set").description("Set a secret from piped stdin: printf %s \"$VALUE\" | standards secrets set KEY").argument("<KEY>", "secret key").allowExcessArguments(false).option("--private", "your own secret").option("--env <env>", "an environment's secret (name or id)").option("--repository <owner/name>", "scope an environment's secret to one repository").option("--environments <env,…|all>", "the environments a new workspace secret reaches").option("--plain", "store it as non-sensitive").action(async (key, opts, cmd) => {
+		checkOwnerFlags(opts);
+		if (opts.environments !== void 0 && (opts.private || opts.env)) throw new ValidationError("--environments only applies to a workspace secret", []);
+		const value = await readPipedValue(`secrets set ${key}`);
+		const client = getAppClientFromCommand(cmd);
+		const owner = await resolveOwner(client, opts);
+		const result = await setSecret(client, owner, {
+			key,
+			value,
+			isSensitive: !opts.plain
+		}, opts.environments);
+		formatOutput(stripped(result), getFormat(cmd));
+		if (owner.kind === "workspace" && reachesNoEnvironment(result)) process.stderr.write("Reaches no environment yet: re-run with --environments <env,…|all>\n");
+	});
+	secrets.command("delete").description("Delete a secret").argument("<KEY>", "secret key").option("--private", "your own secret").option("--env <env>", "an environment's secret (name or id)").option("--repository <owner/name>", "the repository's value of an environment's secret").option("--yes", "delete without confirmation").action(async (key, opts, cmd) => {
+		checkOwnerFlags(opts);
+		requireConfirmation(opts.yes, "Deleting a secret is explicit. Re-run with \"--yes\" to confirm.");
+		const client = getAppClientFromCommand(cmd);
+		await deleteSecret(client, await resolveOwner(client, opts), key);
+		printDone(`Secret ${key} deleted.`);
+	});
+}
+// src/follow-turn.ts
+/** Exit codes of a followed turn: completed, failed or cancelled, parked on a decision. */
+const TURN_EXIT = {
+	completed: 0,
+	failed: 1,
+	decision: 3
+};
+/** The waits between reads of a parked turn's decisions, opened just after its commit. */
+const DECISION_RETRY_MS = [
+	200,
+	500,
+	1e3,
+	2e3
+];
+/**
+* Consecutive stream opens that may fail before a follow gives up (about 40 s
+* with the reader's back-off): a browser tab may wait out an outage, a shell
+* agent needs an exit. A deploy blip stays under it.
+*/
+const MAX_FAILED_OPENS = 10;
+/** The newest history page: its `committedSeq` is the cursor a stream opens after. */
+async function readHistoryPage(client, sessionId, limit) {
+	const page = await client.agentMessages.list({
+		id: sessionId,
+		history: "1",
+		...limit !== void 0 && { limit }
+	});
+	if (Array.isArray(page)) throw new SchemaError("The messages route did not answer a history window", SchemaErrorCode.INVARIANT_VIOLATION);
+	return page;
+}
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** The session's open decisions, read again until `wanted` exist or the retries run out. */
+async function waitForDecisions(client, sessionId, wanted) {
+	const link = `session:${sessionId}`;
+	let decisions = await readOpenDecisions(client, link);
+	for (const delay of DECISION_RETRY_MS) {
+		if (decisions.length >= wanted) break;
+		await sleep$1(delay);
+		decisions = await readOpenDecisions(client, link);
+	}
+	return decisions;
+}
+/**
+* Prints the decisions a parked session waits on and answers exit 3; when
+* none is open yet, says where to look.
+*/
+function reportDecisions(decisions, options) {
+	if (decisions.length === 0) {
+		process.stderr.write("decision not opened yet: run \"standards decisions list\"\n");
+		return TURN_EXIT.decision;
+	}
+	for (const decision of decisions) options.write(options.human ? `\n${renderDecision(decision)}` : `${JSON.stringify({
+		type: "decision",
+		decision
+	})}\n`);
+	return TURN_EXIT.decision;
+}
+/** A writer that knows whether the text so far ends a line, so markers start their own. */
+function createTurnWriter(options) {
+	let atLineStart = true;
+	return {
+		text(text) {
+			if (text === "") return;
+			if (options.human) {
+				options.write(text);
+				atLineStart = text.endsWith("\n");
+			} else options.write(`${JSON.stringify({
+				type: "text",
+				text
+			})}\n`);
+		},
+		/** A line of its own in human mode, an NDJSON object otherwise. */
+		marker(line, json) {
+			if (!options.human) {
+				options.write(`${JSON.stringify(json)}\n`);
+				return;
+			}
+			options.write(`${atLineStart ? "" : "\n"}${line}\n`);
+			atLineStart = true;
+		},
+		endLine() {
+			if (options.human && !atLineStart) options.write("\n");
+			atLineStart = true;
+		}
+	};
+}
+/**
+* The end a session's state records once no turn is running: what a follow
+* resolves with when a 410 skipped the end event. `undefined` while running.
+*/
+function endFromState(state, inputRequests) {
+	if (state.phase === "running") return void 0;
+	const outcome = state.outcome ?? "completed";
+	return {
+		type: state.phase === "parked" ? "turn.completed" : `turn.${outcome}`,
+		data: {
+			outcome,
+			phase: state.phase
+		},
+		inputRequests
+	};
+}
+function includes(ids, id) {
+	return id !== void 0 && (ids ?? []).includes(id);
+}
+/**
+* Streams one turn to its end: adopts the turn (the one carrying our
+* `clientMessageId`, the named `turnId`, or the next to start), writes its
+* text and tool calls, and resolves with its end event. The shared reader
+* reconnects at the cursor; a 410 reopens at the newest page's `committedSeq`,
+* unless the session no longer runs a turn: its state then says how ours ended.
+* A refused stream (401 included: the CLI never re-authenticates) rejects.
+*/
+function streamTurn(client, sessionId, options) {
+	const out = createTurnWriter(options);
+	let cursor = options.cursor;
+	let turnId = options.turnId;
+	let inputRequests = 0;
+	let failedOpens = 0;
+	const toolCalls = /* @__PURE__ */ new Set();
+	function adopt(event) {
+		if (event.turnId === void 0) return;
+		const ours = options.clientMessageId;
+		if (ours === void 0) {
+			if (event.type === "turn.started") turnId = event.turnId;
 			return;
 		}
-		if (!opts.yes) throw new ValidationError("A rebuild re-reads every record of the tenant. Re-run with \"--yes\" to confirm.", []);
-		const tenant = requireTenant(cmd, "A rebuild names its tenant explicitly. Pass \"--tenant <id>\" with the tenant you are authenticated in.");
-		await getAppClientFromCommand(cmd).searchAdmin.fullReindex({ tenantId: tenant });
-		process.stdout.write(`${styleText("green", "✓")} Index rebuild accepted for tenant ${tenant}. Search keeps answering from the current index until the rebuilt one replaces it — follow the server logs for progress.\n`);
+		if ((event.type === "turn.started" || event.type === "message.consumed") && includes(event.clientMessageIds, ours)) turnId = event.turnId;
+	}
+	function foldChunk(data) {
+		if (!isPlainRecord(data)) return;
+		if (data.type === "text-delta" && typeof data.delta === "string") {
+			out.text(data.delta);
+			return;
+		}
+		if ((data.type === "tool-input-start" || data.type === "tool-input-available") && typeof data.toolName === "string" && typeof data.toolCallId === "string" && !toolCalls.has(data.toolCallId)) {
+			toolCalls.add(data.toolCallId);
+			out.marker(`→ tool ${data.toolName}`, {
+				type: "tool",
+				name: data.toolName
+			});
+		}
+	}
+	return new Promise((resolve, reject) => {
+		function fail(error) {
+			handle.close();
+			reject(error);
+		}
+		function finish(end) {
+			handle.close();
+			out.endLine();
+			resolve(end);
+		}
+		const handle = openAgentStream({
+			open: async (id, after, signal, onRequest) => {
+				try {
+					const response = await client.agentSessions.stream({
+						id,
+						after
+					}, {
+						signal,
+						onRequest,
+						headers: { Accept: "text/event-stream" }
+					});
+					failedOpens = 0;
+					return response;
+				} catch (error) {
+					failedOpens += 1;
+					if (failedOpens >= MAX_FAILED_OPENS) fail(new ValidationError(`The session stream did not open after ${MAX_FAILED_OPENS} attempts`, []));
+					throw error;
+				}
+			},
+			sessionId,
+			cursor: () => cursor,
+			onEvent: (event) => {
+				cursor = event.seq;
+				if (turnId === void 0) adopt(event);
+				if (turnId === void 0 || event.turnId !== turnId) return;
+				if (TURN_END_TYPES.has(event.type)) {
+					finish({
+						type: event.type,
+						data: isPlainRecord(event.data) ? event.data : {},
+						inputRequests
+					});
+					return;
+				}
+				if (event.type === "chunk") foldChunk(event.data);
+				else if (event.type === "step.reset") out.marker("↺ retrying step", { type: "reset" });
+				else if (event.type === "input.requested") inputRequests += 1;
+			},
+			onControl: () => void 0,
+			onStatus: (status, error) => {
+				if (status !== "error" && status !== "auth-blocked") return;
+				fail(error ?? new ValidationError("The session stream was refused", []));
+			},
+			onExpired: async () => {
+				const page = await readHistoryPage(client, sessionId, 1);
+				cursor = page.committedSeq;
+				if (page.messages.some((message) => message.waiting)) return;
+				const end = endFromState(page.sessionState ?? (await client.agentSessions.get({ id: sessionId })).state, inputRequests);
+				if (end) finish(end);
+			}
+		});
+	});
+}
+function failureText(data) {
+	if (typeof data.error === "string") return `: ${data.error}`;
+	if (typeof data.code === "string") return `: ${data.code}`;
+	return "";
+}
+/**
+* Follows one turn of a session to its end (spec §3) and answers its exit
+* code: 0 completed, 1 failed or cancelled, 3 parked on a decision (printed).
+* Never exits the process: the command does.
+*/
+async function followTurn(client, sessionId, options) {
+	const end = await streamTurn(client, sessionId, options);
+	const parked = end.type === "turn.completed" && end.data.phase === "parked";
+	const outcome = typeof end.data.outcome === "string" ? end.data.outcome : end.type.replace("turn.", "");
+	if (!options.human) options.write(`${JSON.stringify({
+		type: "end",
+		outcome,
+		...parked && { phase: "parked" }
+	})}\n`);
+	if (end.type === "turn.cancelled") {
+		if (options.human) process.stderr.write("✗ cancelled\n");
+		return TURN_EXIT.failed;
+	}
+	if (end.type !== "turn.completed") {
+		if (options.human) process.stderr.write(`✗ turn failed${failureText(end.data)}\n`);
+		return TURN_EXIT.failed;
+	}
+	if (!parked) return TURN_EXIT.completed;
+	return reportDecisions(await waitForDecisions(client, sessionId, Math.max(1, end.inputRequests)), options);
+}
+// src/commands/sessions.ts
+/** A session as one line of a list: what a model reads to pick the next one. */
+function summarizeSession(session) {
+	return {
+		id: session.id,
+		name: session.name ?? null,
+		phase: session.state.phase,
+		outcome: session.state.outcome ?? null,
+		updatedAt: session.updatedAt
+	};
+}
+/** The caller's sessions running or parked on a decision, optionally narrowed by `q` and `limit`. */
+async function readActiveSessions(client, query = {}) {
+	return (await Promise.all(["running", "parked"].map((phase) => client.agentSessions.list({
+		...query,
+		phase
+	})))).flat();
+}
+/** `--harness`: a catalogue id, or `standards` (the built-in agent), which sends none. */
+function parseHarness(value) {
+	return value === void 0 ? void 0 : parseHarnessIds([value])?.[0];
+}
+function isProviderName(value) {
+	return PROVIDER_NAMES.includes(value);
+}
+/** `--model`: a model of the harness's catalogue, or `<provider>/<model>` without a harness. */
+function parseModel(harness, value) {
+	if (harness) return {
+		provider: environmentHarness(harness).provider,
+		model: value
+	};
+	const slash = value.indexOf("/");
+	const provider = slash > 0 ? value.slice(0, slash) : "";
+	const model = value.slice(slash + 1);
+	if (!(isProviderName(provider) && model)) throw new ValidationError(`--model takes <provider>/<model> without --harness (providers: ${PROVIDER_NAMES.join(", ")}): got "${value}"`, []);
+	return {
+		provider,
+		model
+	};
+}
+/** A shell word: the task as `sessions send` would take it back. */
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function write(text) {
+	process.stdout.write(text);
+}
+/** The cursor a follow opens after: the newest page's `committedSeq`, read before sending. */
+async function cursorBeforeSend(client, id) {
+	return (await readHistoryPage(client, id, 1)).committedSeq;
+}
+/** Sends `content` with a fresh `clientMessageId`, the id its turn is recognised by. */
+async function sendMessage(client, id, content) {
+	const clientMessageId = randomUUID();
+	await client.agentMessages.send({
+		id,
+		content,
+		clientMessageId
+	});
+	return clientMessageId;
+}
+/** After a send: `{ id, url }` when detached, else the turn followed to its end. */
+async function followOrDetach(cmd, client, id, sent, detach) {
+	const url = conversationUrl(cmd, id);
+	if (detach) {
+		formatOutput({
+			id,
+			url
+		}, getFormat(cmd));
+		return;
+	}
+	process.stderr.write(`session ${id} ${url}\n`);
+	const code = await followTurn(client, id, {
+		...sent,
+		human: isHumanOutput(cmd),
+		write
+	});
+	if (code !== 0) process.exitCode = code;
+}
+/** The last assistant text of a history page, or `null`. */
+function lastReplyOf(page) {
+	for (const message of [...page.messages].reverse()) {
+		if (message.role !== "assistant") continue;
+		const text = message.parts.flatMap((part) => part.type === "text" ? [part.text] : []).join("");
+		if (text) return text;
+	}
+	return null;
+}
+function hasWaitingMessage(page) {
+	return page.messages.some((message) => message.role === "user" && message.waiting === true);
+}
+/**
+* `sessions follow`: the running turn, or the next one to start; an idle
+* session with nothing waiting, or a parked one with its decisions open,
+* answers at once. The page is read before the session, so a turn that ends
+* between the two reads still has its end after the cursor.
+*/
+async function followSession(cmd, client, id) {
+	const human = isHumanOutput(cmd);
+	const page = await readHistoryPage(client, id, 10);
+	const { state } = await client.agentSessions.get({ id });
+	const follow = (turnId) => followTurn(client, id, {
+		cursor: page.committedSeq,
+		...turnId && { turnId },
+		human,
+		write
+	});
+	if (state.phase === "running") return follow(state.runningTurnId);
+	if (state.phase === "parked") {
+		const decisions = await waitForDecisions(client, id, 1);
+		return decisions.length > 0 ? reportDecisions(decisions, {
+			human,
+			write
+		}) : follow();
+	}
+	if (hasWaitingMessage(page)) return follow();
+	const outcome = state.outcome ?? "completed";
+	if (human) process.stderr.write(`session ${id} is idle (${outcome})\n`);
+	else write(`${JSON.stringify({
+		type: "end",
+		outcome
+	})}\n`);
+	return outcome === "completed" ? TURN_EXIT.completed : TURN_EXIT.failed;
+}
+function isNotFound(error) {
+	return error instanceof StandardsRequestError$1 && error.status === 404;
+}
+function registerSessionsCommand(program) {
+	const sessions = program.command("sessions").description("Start, follow and steer agent sessions (exit 0 done, 1 failed, 3 decision)");
+	sessions.command("start").description("Start a session on a task and follow its first turn").argument("<task>", "what the agent should do").option("--harness <id>", "claude-code, codex, cursor, or standards (the built-in agent)").option("--env <env>", "the environment it runs in (name or id)").addOption(new Option("--size <size>", "the machine size of its turns").choices(ENVIRONMENT_SIZES)).option("--model <id>", "a model of the harness (or <provider>/<model> without --harness)").option("--name <name>", "the conversation's title").option("--detach", "send and return { id, url } without following").action(async (task, opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const harness = parseHarness(opts.harness);
+		const model = opts.model === void 0 ? void 0 : parseModel(harness, opts.model);
+		const environmentId = opts.env ? await resolveEnvironmentId(client, opts.env) : void 0;
+		const id = randomUUID();
+		await client.agentSessions.create({
+			mode: "interactive",
+			id,
+			...harness && { harness },
+			...environmentId && { environmentId },
+			...opts.size && { size: opts.size },
+			...model && { inferenceOverrides: { model } },
+			...opts.name && { name: opts.name }
+		});
+		let clientMessageId;
+		try {
+			clientMessageId = await sendMessage(client, id, task);
+		} catch (error) {
+			process.stderr.write(`${JSON.stringify({
+				id,
+				url: conversationUrl(cmd, id)
+			})}\n`);
+			process.stderr.write(`Session created, message not sent: standards sessions send ${id} ${shellQuote(task)}\n`);
+			throw error;
+		}
+		await followOrDetach(cmd, client, id, {
+			cursor: 0,
+			clientMessageId
+		}, opts.detach);
+	});
+	sessions.command("send").description("Send a message to a session and follow the turn it starts").argument("<id>", "session id").argument("<message>", "the message").option("--detach", "send and return { id, url } without following").action(async (id, message, opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		await followOrDetach(cmd, client, id, {
+			cursor: await cursorBeforeSend(client, id),
+			clientMessageId: await sendMessage(client, id, message)
+		}, opts.detach);
+	});
+	sessions.command("follow").description("Follow the running or next turn; returns at once when idle or waiting on a decision").argument("<id>", "session id").action(async (id, _opts, cmd) => {
+		const code = await followSession(cmd, getAppClientFromCommand(cmd), id);
+		if (code !== 0) process.exitCode = code;
+	});
+	sessions.command("list").description("List your sessions").option("--running", "only sessions running or parked on a decision").option("--q <text>", "match the title").option("--limit <n>", "at most n sessions (per phase with --running)").action(async (opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const query = {
+			...opts.q && { q: opts.q },
+			...opts.limit !== void 0 && { limit: parseCount("--limit", opts.limit) }
+		};
+		formatOutput((opts.running ? await readActiveSessions(client, query) : await client.agentSessions.list(query)).map(summarizeSession), getFormat(cmd));
+	});
+	sessions.command("get").description("Show a session: phase, last reply, machine, links, open decisions").argument("<id>", "session id").action(async (id, _opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const [session, page, machine, decisions] = await Promise.all([
+			client.agentSessions.get({ id }),
+			readHistoryPage(client, id),
+			client.machines.forSession({ id }).catch((error) => {
+				if (isNotFound(error)) return null;
+				throw error;
+			}),
+			readOpenDecisions(client, `session:${id}`)
+		]);
+		formatOutput({
+			session,
+			phase: session.state.phase,
+			lastReply: lastReplyOf(page),
+			waiting: hasWaitingMessage(page),
+			machine,
+			links: machine?.links ?? [],
+			decisions
+		}, getFormat(cmd));
+	});
+	sessions.command("messages").description("The last messages of a session").argument("<id>", "session id").requiredOption("--last <n>", "how many, newest last (at most 100)").action(async (id, opts, cmd) => {
+		const last = parseCount("--last", opts.last);
+		if (last < 1) throw new ValidationError("--last must be at least 1", []);
+		formatOutput((await readHistoryPage(getAppClientFromCommand(cmd), id, last)).messages, getFormat(cmd));
+	});
+	sessions.command("cancel").description("Stop the running turn, or a parked session's waits").argument("<id>", "session id").action(async (id, _opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const { state } = await client.agentSessions.get({ id });
+		const turnId = state.runningTurnId ?? state.lastTurnId;
+		formatOutput(await client.agentSessions.cancel({
+			id,
+			...turnId && { turnId }
+		}), getFormat(cmd));
+	});
+	sessions.command("archive").description("Archive a session").argument("<id>", "session id").action(async (id, _opts, cmd) => {
+		await getAppClientFromCommand(cmd).agentSessions.archive({ id });
+		printDone(`Session ${id} archived.`);
 	});
 }
 // src/commands/skills.ts
@@ -1310,17 +2517,13 @@ function catalogRow(result) {
 		installs
 	};
 }
-/** `standards skills search`: our index, or skills.sh with `community`. */
+/**
+* `standards skills search`: with a query, our index or skills.sh with
+* `community`; with none, skills.sh's all-time leaderboard, or the last 24
+* hours with `trending`, keeping each row's weekly installs.
+*/
 async function runSkillsSearch(client, query, options = {}) {
-	return (await client.skillCatalog.search({
-		query,
-		scope: options.community === true ? "community" : "official",
-		limit: searchLimit(options.limit)
-	})).map(catalogRow);
-}
-/** `standards skills top`: skills.sh's all-time leaderboard, or the last 24 hours with `trending`. */
-async function runSkillsTop(client, options = {}) {
-	return (await client.skillCatalog.search({
+	if (!query) return (await client.skillCatalog.search({
 		query: "",
 		scope: options.trending === true ? "trending" : "top",
 		limit: searchLimit(options.limit)
@@ -1328,8 +2531,13 @@ async function runSkillsTop(client, options = {}) {
 		...catalogRow(result),
 		weeklyInstalls: result.weeklyInstalls
 	}));
+	return (await client.skillCatalog.search({
+		query,
+		scope: options.community === true ? "community" : "official",
+		limit: searchLimit(options.limit)
+	})).map(catalogRow);
 }
-/** `standards skills preview`: what a source would install, the source checked here first. */
+/** `standards skills add --dry-run`: what a source would install, the source checked here first. */
 async function runSkillsPreview(client, source) {
 	parseSkillSource(source);
 	return await client.skillCatalog.preview({ source });
@@ -1405,17 +2613,15 @@ function registerSkillsCommand(program) {
 		for (const warning of outcome.result.warnings) console.warn(styleText("yellow", `! ${warning}`));
 		formatOutput(outcome.result, getFormat(cmd));
 	});
-	skills.command("search").description("Find skills to add: the official catalogue, or skills.sh with --community").argument("<query>", "what the skill should do").option("--community", "search skills.sh instead of the official catalogue").option("--limit <n>", "max results to return (up to 50)").action(async (query, opts, cmd) => {
+	skills.command("search").description("Find skills to add: the official catalogue, skills.sh with --community, or with no query skills.sh's leaderboard").argument("[query]", "what the skill should do").option("--community", "search skills.sh instead of the official catalogue").option("--trending", "with no query, rank by the last 24 hours instead of all time").option("--limit <n>", "max results to return (up to 50)").action(async (query, opts, cmd) => {
+		if (!(query || opts.community)) throw new ValidationError("Pass a query, or \"--community\" to list skills.sh's leaderboard", []);
 		await printAnswer(cmd, () => runSkillsSearch(getAppClientFromCommand(cmd), query, opts));
 	});
-	skills.command("top").description("List skills.sh's most installed skills, or the last 24 hours with --trending").option("--trending", "rank by the last 24 hours instead of all time").option("--limit <n>", "max results to return (up to 50)").action(async (opts, cmd) => {
-		await printAnswer(cmd, () => runSkillsTop(getAppClientFromCommand(cmd), opts));
-	});
-	skills.command("preview").description("Show what a source would install, without installing it").argument("<source>", "owner/repo@skill or owner/repo@skill#ref").action(async (source, _opts, cmd) => {
-		await printAnswer(cmd, () => runSkillsPreview(getAppClientFromCommand(cmd), source));
-	});
-	skills.command("add").description("Install a skill from a GitHub repository: what its preview read lands, and an official skill then follows stable").argument("<source>", "owner/repo@skill or owner/repo@skill#ref").action(async (source, _opts, cmd) => {
-		await printAnswer(cmd, () => runSkillsAdd(getAppClientFromCommand(cmd), source));
+	skills.command("add").description("Install a skill from a GitHub repository: what its preview read lands, and an official skill then follows stable").argument("<source>", "owner/repo@skill or owner/repo@skill#ref").option("--dry-run", "show what the source would install, without installing it").action(async (source, opts, cmd) => {
+		await printAnswer(cmd, () => {
+			const client = getAppClientFromCommand(cmd);
+			return opts.dryRun ? runSkillsPreview(client, source) : runSkillsAdd(client, source);
+		});
 	});
 	skills.command("update").description("Bring an installed catalogue skill to the latest version of its source").argument("<name>", "name of the installed skill").option("--discard-changes", "overwrite the edits the workspace made to the skill").action(async (name, opts, cmd) => {
 		await printAnswer(cmd, () => runSkillsUpdate(getAppClientFromCommand(cmd), name, opts));
@@ -1424,6 +2630,261 @@ function registerSkillsCommand(program) {
 		await printAnswer(cmd, () => runSkillsRefresh(getAppClientFromCommand(cmd)));
 	});
 }
+// src/commands/status.ts
+function summarizeDecision(decision) {
+	return {
+		id: decision.id,
+		type: decision.type,
+		title: decision.title,
+		sessionId: sessionIdOf(decision) ?? null
+	};
+}
+function summarizeMachine(detail) {
+	return {
+		id: detail.machine.id,
+		owner: detail.owner.label,
+		pilot: detail.pilot,
+		links: detail.links.map((link) => ({
+			id: link.id,
+			slug: link.slug,
+			url: link.url
+		}))
+	};
+}
+/** Sessions running or parked, and open decisions: the database reads `watch` makes every poll. */
+async function readSessionsAndDecisions(client) {
+	const [sessions, decisions] = await Promise.all([readActiveSessions(client), readOpenDecisions(client)]);
+	return {
+		sessions: sessions.map(summarizeSession),
+		decisions: decisions.map(summarizeDecision)
+	};
+}
+/** The running machines with their links, every page (the provider's listing, read sparingly). */
+async function readRunningMachines(client) {
+	return (await readAllPages((cursor) => client.machines.list(cursor ? { cursor } : {}))).filter((item) => item.machine.status === "running").map(summarizeMachine);
+}
+function quoted(text) {
+	return JSON.stringify(text);
+}
+function sessionTransition(previous, next) {
+	if (previous === void 0) return next.phase === "idle" ? [] : [`session ${next.id} → ${next.phase}`];
+	if (previous.phase === next.phase) return [];
+	if (next.phase === "parked") return [`session ${next.id} → parked`];
+	if (next.phase === "idle" && next.outcome !== null && next.outcome !== "completed") return [`session ${next.id} ${next.outcome}`];
+	return [`session ${next.id} ${previous.phase}→${next.phase}`];
+}
+/** The session lines alone: a phase change is what makes `watch` read the machines. */
+function diffSessions(previous, next) {
+	const before = new Map(previous.map((session) => [session.id, session]));
+	return next.flatMap((session) => sessionTransition(before.get(session.id), session));
+}
+function linksOf(machines) {
+	return machines.flatMap((machine) => machine.links);
+}
+/**
+* The transitions from one snapshot to the next, one line each, in order:
+* sessions, decisions, links, machines. Equal snapshots answer `[]`.
+*/
+function diffStatus(previous, next) {
+	const decisionsBefore = new Set(previous.decisions.map((decision) => decision.id));
+	const decisionsAfter = new Set(next.decisions.map((decision) => decision.id));
+	const linksBefore = new Set(linksOf(previous.machines).map((link) => link.id));
+	const machinesAfter = new Set(next.machines.map((machine) => machine.id));
+	return [
+		...diffSessions(previous.sessions, next.sessions),
+		...next.decisions.filter((decision) => !decisionsBefore.has(decision.id)).map((decision) => `decision ${decision.id} opened ${quoted(decision.title)}`),
+		...previous.decisions.filter((decision) => !decisionsAfter.has(decision.id)).map((decision) => `decision ${decision.id} answered`),
+		...linksOf(next.machines).filter((link) => !linksBefore.has(link.id)).map((link) => `link ${link.slug} published ${link.url}`),
+		...previous.machines.filter((machine) => !machinesAfter.has(machine.id)).map((machine) => `machine ${machine.id} stopped`)
+	];
+}
+/** The current state as `snapshot` lines: what `watch` prints on its first poll. */
+function snapshotLines(snapshot) {
+	return [
+		...snapshot.sessions.map((session) => `snapshot session ${session.id} ${session.phase}`),
+		...snapshot.decisions.map((decision) => `snapshot decision ${decision.id} ${quoted(decision.title)}`),
+		...snapshot.machines.map((machine) => `snapshot machine ${machine.id} ${quoted(machine.owner)}`),
+		...linksOf(snapshot.machines).map((link) => `snapshot link ${link.slug} ${link.url}`)
+	];
+}
+function section(title, rows) {
+	return `${title} (${rows.length})\n${rows.length === 0 ? "  none\n" : rows.map((row) => `  ${row}\n`).join("")}`;
+}
+function renderStatus(snapshot) {
+	return [
+		section("Sessions", snapshot.sessions.map((session) => `${session.id}  ${session.phase}  ${session.name ?? ""}`)),
+		section("Decisions", snapshot.decisions.map((decision) => `${decision.id}  ${decision.type}  ${decision.title}`)),
+		section("Machines", snapshot.machines.map((machine) => [`${machine.id}  ${machine.owner}`, ...machine.links.map((link) => `  ${link.url}`)].join("\n  ")))
+	].join("\n");
+}
+function registerStatusCommand(program) {
+	program.command("status").description("Sessions running or parked, open decisions, running machines and their links").action(async (_opts, cmd) => {
+		const client = getAppClientFromCommand(cmd);
+		const [active, machines] = await Promise.all([readSessionsAndDecisions(client), readRunningMachines(client)]);
+		const snapshot = {
+			...active,
+			machines
+		};
+		if (isHumanOutput(cmd)) process.stdout.write(renderStatus(snapshot));
+		else formatOutput(snapshot, "json");
+	});
+}
+// src/commands/usage.ts
+const SCOPES = ["me", "workspace"];
+/** `GET /ai/usage` reads inclusive UTC days; anything else reaches the API as a 400. */
+const ISO_DAY = /^\d{4}-\d{2}-\d{2}$/u;
+/**
+* The window's own rules (maximum span, ordering) belong to the server, which
+* owns the calendar; the CLI only rejects what it can judge on its own.
+*/
+function parseDay(flag, value) {
+	if (!ISO_DAY.test(value)) throw new ValidationError(`${flag} must be a YYYY-MM-DD date`, []);
+	return value;
+}
+/** The current UTC month so far: its first day through today. */
+function currentMonth(now) {
+	const today = now.toISOString().slice(0, 10);
+	return {
+		from: `${today.slice(0, 8)}01`,
+		to: today
+	};
+}
+/**
+* A read the caller may be refused (no `billing:read`, say) is `null` with its
+* reason on stderr; the command fails only when every read does.
+*/
+function settled(name, result) {
+	if (result.status === "fulfilled") return result.value;
+	process.stderr.write(`${styleText("yellow", `! ${name}: ${messageOf(result.reason)}`)}\n`);
+	return null;
+}
+function registerUsageCommand(program) {
+	program.command("usage").description("Show AI usage over a UTC day window, the AI wallet and the quotas").option("--from <day>", "first day of the window (YYYY-MM-DD, default: first of the month)").option("--to <day>", "last day of the window, inclusive (YYYY-MM-DD, default: today)").addOption(new Option("--scope <scope>", "me or workspace").choices(SCOPES).default("me")).action(async (opts, cmd) => {
+		const month = currentMonth(/* @__PURE__ */ new Date());
+		const params = {
+			from: parseDay("--from", opts.from ?? month.from),
+			to: parseDay("--to", opts.to ?? month.to),
+			scope: opts.scope
+		};
+		const client = getAppClientFromCommand(cmd);
+		const [usage, wallet, quotas] = await Promise.allSettled([
+			client.ai.usage(params),
+			client.ai.wallet({}),
+			client.quotas.list({})
+		]);
+		if (usage.status === "rejected" && wallet.status === "rejected" && quotas.status === "rejected") throw usage.reason;
+		formatOutput({
+			usage: settled("usage", usage),
+			wallet: settled("wallet", wallet),
+			quotas: settled("quotas", quotas)
+		}, getFormat(cmd));
+	});
+}
+// src/commands/watch.ts
+/** The shortest interval between two polls. */
+const MIN_INTERVAL_MS = 2e3;
+/** Machines (the provider's listing) are read at most this often unless a session changed phase. */
+const MACHINES_EVERY_MS = 6e4;
+/** Consecutive failed polls after which `watch` gives up. */
+const MAX_FAILURES = 5;
+const UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4
+};
+/** `10s`, `2s`, `1m`, `500ms`; under `2s` is refused. */
+function parseInterval(value) {
+	return parseDuration("--interval", value, {
+		units: UNIT_MS,
+		example: "10s or 1m",
+		limit: "at least 2s",
+		min: MIN_INTERVAL_MS
+	});
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* The sessions that left the running and parked lists since the last poll,
+* read once more so their new phase (idle, failed) shows; one gone for good
+* (archived, deleted) is dropped.
+*/
+async function readLeftSessions(client, previous, current) {
+	const listed = new Set(current.map((session) => session.id));
+	const left = previous.filter((session) => session.phase !== "idle" && !listed.has(session.id));
+	return (await Promise.all(left.map((session) => client.agentSessions.get({ id: session.id }).then(summarizeSession, () => null)))).filter((session) => session !== null);
+}
+function isOpenedDecision(line) {
+	return line.startsWith("decision ") && line.includes(" opened ");
+}
+function isSnapshotDecision(line) {
+	return line.startsWith("snapshot decision ");
+}
+/** The decision lines last: the one a waiting agent acts on ends the output. */
+function decisionsLast(lines, isDecision) {
+	return [...lines.filter((line) => !isDecision(line)), ...lines.filter(isDecision)];
+}
+/**
+* Polls until a decision is open (`--until decision`, 3: one already open at
+* the first poll counts) or 5 polls fail in a row (1).
+*/
+async function watch(client, options) {
+	const emit = (type, line) => process.stdout.write(options.human ? `${line}\n` : `${JSON.stringify({
+		type,
+		line
+	})}\n`);
+	let previous;
+	let machinesReadAt = Number.NEGATIVE_INFINITY;
+	let failures = 0;
+	for (;;) {
+		try {
+			const active = await readSessionsAndDecisions(client);
+			const sessions = previous ? [...active.sessions, ...await readLeftSessions(client, previous.sessions, active.sessions)] : active.sessions;
+			const phaseChanged = previous === void 0 || diffSessions(previous.sessions, sessions).length > 0;
+			let machines = previous?.machines ?? [];
+			if (phaseChanged || Date.now() - machinesReadAt >= MACHINES_EVERY_MS) {
+				machines = await readRunningMachines(client).catch((error) => {
+					emit("machines-failed", `machines read failed: ${messageOf(error)}`);
+					return previous?.machines ?? [];
+				});
+				machinesReadAt = Date.now();
+			}
+			const next = {
+				sessions,
+				decisions: active.decisions,
+				machines
+			};
+			failures = 0;
+			if (previous === void 0) {
+				const waiting = options.untilDecision && next.decisions.length > 0;
+				const lines = snapshotLines(next);
+				for (const line of waiting ? decisionsLast(lines, isSnapshotDecision) : lines) emit("snapshot", line);
+				if (waiting) return TURN_EXIT.decision;
+			} else {
+				const lines = diffStatus(previous, next);
+				for (const line of decisionsLast(lines, isOpenedDecision)) emit("transition", line);
+				if (options.untilDecision && lines.some(isOpenedDecision)) return TURN_EXIT.decision;
+			}
+			previous = next;
+		} catch (error) {
+			failures += 1;
+			emit("poll-failed", `poll failed: ${messageOf(error)}`);
+			if (failures >= MAX_FAILURES) return TURN_EXIT.failed;
+		}
+		await sleep(options.intervalMs);
+	}
+}
+function registerWatchCommand(program) {
+	program.command("watch").description("One line per change of sessions, decisions, machines and links (exit 3 on --until decision)").option("--interval <duration>", "time between polls, at least 2s", "10s").addOption(new Option("--until <event>", "exit 3 when this happens").choices(["decision"])).action(async (opts, cmd) => {
+		const intervalMs = parseInterval(opts.interval);
+		const code = await watch(getAppClientFromCommand(cmd), {
+			intervalMs,
+			untilDecision: opts.until === "decision",
+			human: isHumanOutput(cmd)
+		});
+		if (code !== 0) process.exitCode = code;
+	});
+}
 // src/version.ts
 /**
 * The installed package's version, read from its own manifest: `src/` and the
@@ -1444,13 +2905,13 @@ const PUBLIC_COMMANDS = /* @__PURE__ */ new Set([
 	"login",
 	"use",
 	"instances",
-	"current",
 	"logout",
-	"help"
+	"help",
+	"init",
+	"guide"
 ]);
 function isPublicCommand(actionCommand) {
-	if (PUBLIC_COMMANDS.has(actionCommand.name())) return true;
-	return actionCommand.parent?.name() === "auth" && actionCommand.name() === "help";
+	return PUBLIC_COMMANDS.has(actionCommand.name());
 }
 function createProgram() {
 	const program = new Command();
@@ -1458,23 +2919,26 @@ function createProgram() {
 	registerRootCommands(program);
 	registerRecordsCommand(program);
 	registerSchemaCommand(program);
-	registerPullCommand(program);
-	registerDiffCommand(program);
 	registerDocumentsCommand(program);
-	registerFoldersCommand(program);
+	registerFilesCommand(program);
 	registerKeysCommand(program);
 	registerInvitationsCommand(program);
-	registerAuthCommand(program);
 	registerBundlesCommand(program);
 	registerConnectorsCommand(program);
 	registerMcpCommand(program);
 	registerMeetingsCommand(program);
-	registerMemoryCommand(program);
-	registerSearchCommand(program);
 	registerSkillsCommand(program);
-	registerEmbeddingsCommand(program);
-	registerAiCommand(program);
-	registerQuotasCommand(program);
+	registerUsageCommand(program);
+	registerEnvironmentsCommand(program);
+	registerSecretsCommand(program);
+	registerMachinesCommand(program);
+	registerLinksCommand(program);
+	registerSessionsCommand(program);
+	registerDecisionsCommand(program);
+	registerStatusCommand(program);
+	registerWatchCommand(program);
+	registerInitCommand(program);
+	registerGuideCommand(program);
 	program.hook("preAction", async (_thisCommand, actionCommand) => {
 		const raw = program.opts();
 		const resolved = await resolveCliConfig({