@staqon/cli 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,1134 @@
+// src/cli.ts
+import { Command } from "commander";
+
+// src/commands/auth.ts
+import { exec } from "child_process";
+import pc3 from "picocolors";
+
+// src/context.ts
+var ctx = { json: false, verbose: false, interactive: false };
+
+// src/errors.ts
+var Exit = {
+  OK: 0,
+  GENERAL: 1,
+  USAGE: 2,
+  AUTH: 3,
+  RATE_LIMIT: 4,
+  TEAM_OR_KEY: 5,
+  CONSENT: 6,
+  INTERRUPTED: 130
+};
+var CliError = class extends Error {
+  constructor(message, exitCode = Exit.GENERAL, details = {}) {
+    super(message);
+    this.exitCode = exitCode;
+    this.details = details;
+    this.name = "CliError";
+  }
+  exitCode;
+  details;
+};
+var ApiError = class extends CliError {
+  constructor(message, exitCode, status, body, traceId, details = {}) {
+    super(message, exitCode, details);
+    this.status = status;
+    this.body = body;
+    this.traceId = traceId;
+    this.name = "ApiError";
+  }
+  status;
+  body;
+  traceId;
+};
+
+// src/output.ts
+import pc from "picocolors";
+var TOKEN_RE = /stq_cli_[0-9a-fA-F]{6,}/g;
+function redact(s) {
+  return s.replace(TOKEN_RE, "stq_cli_***");
+}
+function out(line = "") {
+  process.stdout.write(redact(line) + "\n");
+}
+function err(line = "") {
+  process.stderr.write(redact(line) + "\n");
+}
+function debug(line) {
+  if (ctx.verbose) err(pc.dim(line));
+}
+function printData(body) {
+  if (typeof body === "string") return out(body);
+  out(JSON.stringify(body, null, ctx.json ? void 0 : 2));
+}
+function reportError(e) {
+  if (e instanceof CliError) {
+    if (ctx.json) {
+      err(
+        JSON.stringify({
+          error: e.message,
+          exit_code: e.exitCode,
+          ...e instanceof ApiError ? { status: e.status, trace_id: e.traceId, body: e.body } : {},
+          ...Object.fromEntries(Object.entries(e.details).filter(([k]) => k !== "showBody"))
+        })
+      );
+    } else {
+      err(pc.red("Error: ") + e.message);
+      if (e instanceof ApiError) {
+        if (e.traceId) err(pc.dim(`trace id: ${e.traceId}`));
+        if (e.details["showBody"] && e.body !== void 0 && e.body !== "")
+          err(typeof e.body === "string" ? e.body : JSON.stringify(e.body, null, 2));
+      }
+      const hint = e.details["hint"];
+      if (typeof hint === "string") err(pc.dim(hint));
+    }
+    return e.exitCode;
+  }
+  err(pc.red("Unexpected error: ") + (e instanceof Error ? e.stack ?? e.message : String(e)));
+  return 1;
+}
+
+// src/store/config.ts
+import fs from "fs";
+import path2 from "path";
+
+// src/store/paths.ts
+import os from "os";
+import path from "path";
+function configDir() {
+  if (process.platform === "win32")
+    return path.join(process.env["APPDATA"] ?? path.join(os.homedir(), "AppData", "Roaming"), "staqon");
+  return path.join(process.env["XDG_CONFIG_HOME"] ?? path.join(os.homedir(), ".config"), "staqon");
+}
+
+// src/store/config.ts
+var DEFAULT_BASE_URL = "https://staqon.one";
+var file = () => path2.join(configDir(), "config.json");
+function loadConfig() {
+  try {
+    return JSON.parse(fs.readFileSync(file(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveConfig(c) {
+  fs.mkdirSync(configDir(), { recursive: true });
+  fs.writeFileSync(file(), JSON.stringify(c, null, 2) + "\n");
+}
+
+// src/store/token.ts
+import fs2 from "fs";
+import path3 from "path";
+var SERVICE = "staqon-cli";
+var ACCOUNT = "default";
+var credFile = () => path3.join(configDir(), "credentials.json");
+async function entry() {
+  try {
+    const m = await import("@napi-rs/keyring");
+    return new m.Entry(SERVICE, ACCOUNT);
+  } catch {
+    return null;
+  }
+}
+async function saveSession(s) {
+  const json = JSON.stringify(s);
+  try {
+    const e = await entry();
+    if (e) {
+      e.setPassword(json);
+      if (e.getPassword() === json) {
+        fs2.rmSync(credFile(), { force: true });
+        return "keychain";
+      }
+    }
+  } catch {
+  }
+  fs2.mkdirSync(configDir(), { recursive: true, mode: 448 });
+  fs2.writeFileSync(credFile(), json, { mode: 384 });
+  if (process.platform !== "win32") fs2.chmodSync(credFile(), 384);
+  return "file";
+}
+async function loadSession() {
+  const envTok = process.env["STAQON_TOKEN"];
+  if (envTok)
+    return {
+      backend: "env",
+      session: {
+        token: envTok,
+        baseUrl: process.env["STAQON_BASE_URL"] ?? DEFAULT_BASE_URL,
+        savedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+  try {
+    const e = await entry();
+    const raw = e?.getPassword();
+    if (raw) return { backend: "keychain", session: JSON.parse(raw) };
+  } catch {
+  }
+  try {
+    return { backend: "file", session: JSON.parse(fs2.readFileSync(credFile(), "utf8")) };
+  } catch {
+    return null;
+  }
+}
+async function deleteSession() {
+  try {
+    const e = await entry();
+    if (e) (e.deletePassword ?? e.deleteCredential)?.call(e);
+  } catch {
+  }
+  fs2.rmSync(credFile(), { force: true });
+}
+
+// src/team.ts
+async function chooseTeam(teams, traceId) {
+  const list = teams.map((t) => `  ${t.team_slug ?? t.team_id}  (${t.team_name ?? ""} id=${t.team_id})`).join("\n");
+  if (!ctx.interactive || teams.length === 0)
+    throw new ApiError("This call is eligible for several teams; choose one.", Exit.TEAM_OR_KEY, 409, { teams }, traceId, {
+      teams,
+      hint: `Teams:
+${list}
+Use --team <team>, or save a default: staqon use <team>`
+    });
+  const { select, confirm } = await import("@inquirer/prompts");
+  const pick = await select(
+    {
+      message: "Which team should act?",
+      choices: teams.map((t) => ({
+        name: `${t.team_name ?? t.team_slug ?? t.team_id} (${t.team_slug ?? t.team_id})`,
+        value: String(t.team_slug ?? t.team_id)
+      }))
+    },
+    { output: process.stderr }
+  );
+  if (await confirm({ message: `Save "${pick}" as your default team?`, default: false }, { output: process.stderr })) {
+    saveConfig({ ...loadConfig(), defaultTeam: pick });
+    err(`Default team set to ${pick}.`);
+  }
+  return pick;
+}
+
+// src/version.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var VERSION = require2("../package.json").version;
+
+// src/api/client.ts
+function baseUrlFor(session) {
+  const url = ctx.baseUrl ?? process.env["STAQON_BASE_URL"] ?? session?.baseUrl ?? loadConfig().baseUrl ?? DEFAULT_BASE_URL;
+  return url.replace(/\/+$/, "");
+}
+var DEFAULT_TIMEOUT_MS = 3e4;
+var LIST_TIMEOUT_MS = 12e4;
+var MAX_LIST_LIMIT = 100;
+function requestTimeoutMs(perCall) {
+  const env = Number(process.env["STAQON_TIMEOUT_MS"]);
+  if (Number.isInteger(env) && env > 0) return env;
+  return perCall ?? DEFAULT_TIMEOUT_MS;
+}
+async function rawRequest(url, init = {}, timeoutMs) {
+  const headers = new Headers(init.headers);
+  headers.set("User-Agent", `staqon-cli/${VERSION}`);
+  headers.set("Accept", "application/json");
+  debug(`${init.method ?? "GET"} ${url}`);
+  let res;
+  try {
+    res = await fetch(url, { ...init, headers, redirect: "manual", signal: AbortSignal.timeout(requestTimeoutMs(timeoutMs)) });
+  } catch (e) {
+    const msg = e instanceof Error ? e.cause instanceof Error ? e.cause.message : e.message : String(e);
+    throw new CliError(`Network error: ${msg}`, Exit.GENERAL, { hint: `Could not reach ${new URL(url).origin}.` });
+  }
+  const text = await res.text();
+  let body = text === "" ? void 0 : text;
+  if (text !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+    }
+  }
+  const traceId = res.headers.get("x-staqon-trace-id") ?? void 0;
+  debug(`<- ${res.status} trace=${traceId ?? "-"}`);
+  return {
+    status: res.status,
+    headers: res.headers,
+    body,
+    traceId,
+    team: res.headers.get("x-staqon-cli-team") ?? void 0
+  };
+}
+async function requireSession() {
+  const s = await loadSession();
+  if (!s) throw new CliError("Not logged in.", Exit.AUTH, { hint: "Run: staqon login" });
+  return s.session;
+}
+function asObj(b) {
+  return b && typeof b === "object" ? b : {};
+}
+function msgOf(b, fallback) {
+  const o = asObj(b);
+  for (const k of ["error", "message"]) if (typeof o[k] === "string") return o[k];
+  return fallback;
+}
+function teamsOf(b) {
+  const t = asObj(b)["teams"];
+  return Array.isArray(t) ? t : [];
+}
+function authError(r) {
+  if (r.status === 401)
+    return new ApiError("Session missing, expired or revoked.", Exit.AUTH, 401, r.body, r.traceId, {
+      hint: "Run: staqon login"
+    });
+  return new ApiError(msgOf(r.body, "Access denied."), Exit.AUTH, r.status, r.body, r.traceId, {
+    hint: "CLI access may be switched off, the workspace owner changed, or the workspace is not active."
+  });
+}
+var chosenTeam;
+var CONSENT_RE = /not approved|no approved|approved|consent/i;
+async function proxy(opts) {
+  const session = await requireSession();
+  const base = baseUrlFor(session);
+  if (new URL(base).origin !== new URL(session.baseUrl).origin)
+    throw new CliError(`This token was issued by ${session.baseUrl}, not ${base}.`, Exit.USAGE, {
+      hint: "Run staqon login against that host, or drop --base-url."
+    });
+  const qs = new URLSearchParams({ _ep: opts.ep });
+  for (const [k, v] of Object.entries(opts.query ?? {})) qs.append(k, v);
+  const url = `${base}/api/v1/cli-proxy.php?${qs}`;
+  let team = opts.noTeam ? void 0 : opts.team ?? ctx.team ?? loadConfig().defaultTeam ?? chosenTeam;
+  for (let attempt = 0; ; attempt++) {
+    const headers = new Headers({ Authorization: `Bearer ${session.token}` });
+    if (team) headers.set("X-StaqOn-Team", team);
+    let body;
+    if (opts.form) body = opts.form;
+    else if (opts.json !== void 0) {
+      body = JSON.stringify(opts.json);
+      headers.set("Content-Type", "application/json");
+    }
+    const method = opts.method ?? (body ? "POST" : "GET");
+    const r = await rawRequest(url, { method, headers, body }, opts.timeoutMs);
+    if (r.status >= 200 && r.status < 300) return r;
+    if (r.status === 403 && CONSENT_RE.test(msgOf(r.body, ""))) {
+      const server = msgOf(r.body, "");
+      const friendly = /api messages/i.test(server) ? "This member hasn't approved API messages from this workspace." : "This member hasn't approved linking with this workspace.";
+      throw new ApiError(friendly, Exit.CONSENT, 403, r.body, r.traceId, {
+        hint: `Server said: ${server}
+The member has to approve the link in their app; the CLI can't do it for them.`
+      });
+    }
+    if (r.status === 401 || r.status === 403) throw authError(r);
+    if (r.status === 409) {
+      const code = asObj(r.body)["error"];
+      const teams = teamsOf(r.body);
+      if (code === "team_required") {
+        if (attempt > 0)
+          throw new ApiError("Team still required after retry.", Exit.TEAM_OR_KEY, 409, r.body, r.traceId);
+        team = chosenTeam = await chooseTeam(teams, r.traceId);
+        continue;
+      }
+      if (code === "team_not_eligible")
+        throw new ApiError(`Team "${team ?? "?"}" has no key for this call.`, Exit.TEAM_OR_KEY, 409, r.body, r.traceId, {
+          teams,
+          hint: "Eligible teams: " + (teams.map((t) => t.team_slug ?? t.team_id).join(", ") || "(none listed)") + "\nUse --team <team>, or staqon use <team> (staqon use --clear drops a stale default)."
+        });
+      if (code === "no_key")
+        throw new ApiError(
+          msgOf(r.body, "The workspace has no active key of that kind."),
+          Exit.TEAM_OR_KEY,
+          409,
+          r.body,
+          r.traceId,
+          { hint: "The workspace owner must create one in settings \u2192 API. The CLI cannot." }
+        );
+    }
+    if (r.status === 429) {
+      const limit = asObj(r.body)["limit"];
+      const ra = r.headers.get("retry-after");
+      const wait = ra ? ` Retry after ${ra}s.` : "";
+      let m;
+      switch (limit) {
+        case "cli_token":
+          m = "CLI session rate limit reached (30/min).";
+          break;
+        case "cli_token_day":
+          m = "CLI session daily limit reached (3,000/day).";
+          break;
+        case "key_ceiling":
+        case "key_ceiling_day":
+          m = "Your production API key is at its own limit right now; backing off so production traffic wins.";
+          break;
+        default:
+          m = msgOf(r.body, "Rate limited by the endpoint.");
+      }
+      throw new ApiError(m + wait, Exit.RATE_LIMIT, 429, r.body, r.traceId, {
+        limit,
+        retry_after: ra ? Number(ra) : void 0
+      });
+    }
+    throw new ApiError(msgOf(r.body, `HTTP ${r.status}`), Exit.GENERAL, r.status, r.body, r.traceId, {
+      showBody: true
+    });
+  }
+}
+
+// src/auth/pair.ts
+import os2 from "os";
+import pc2 from "picocolors";
+var obj = (b) => b && typeof b === "object" ? b : {};
+var sleep = (ms, signal) => new Promise((res) => {
+  const t = setTimeout(res, ms);
+  signal.addEventListener("abort", () => (clearTimeout(t), res()), { once: true });
+});
+async function codeRequest(base) {
+  const r = await rawRequest(`${base}/api/cli-pair.php?action=code_request`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      device_label: os2.hostname(),
+      os: `${process.platform}-${os2.arch()}`,
+      cli_version: VERSION
+    })
+  });
+  const b = obj(r.body);
+  if (r.status === 429)
+    throw new ApiError(
+      "Too many login attempts (limit: 5 per 10 minutes from this IP).",
+      Exit.RATE_LIMIT,
+      429,
+      r.body,
+      r.traceId,
+      { hint: "Wait a few minutes and try again." }
+    );
+  if (r.status < 200 || r.status >= 300 || !b["ok"] || typeof b["code"] !== "string")
+    throw new ApiError(
+      String(b["error"] ?? `Could not start login (HTTP ${r.status}).`),
+      Exit.GENERAL,
+      r.status,
+      r.body,
+      r.traceId
+    );
+  return b;
+}
+var TERMINAL = {
+  denied: "Login was denied by the workspace owner.",
+  expired: "The login code expired.",
+  consumed: "This login code was already used."
+};
+async function pollUntilApproved(base, p, signal) {
+  const deadline = Date.now() + p.expires_in * 1e3;
+  const interval = Math.max(1, p.interval || 3) * 1e3;
+  const tty = Boolean(process.stderr.isTTY) && !ctx.json;
+  const nl = () => tty && process.stderr.write("\n");
+  let failures = 0;
+  let lastLine = 0;
+  while (!signal.aborted) {
+    const left = Math.max(0, Math.round((deadline - Date.now()) / 1e3));
+    if (left === 0) {
+      nl();
+      throw new CliError("The login code expired before it was approved.", Exit.GENERAL, { hint: "Run: staqon login" });
+    }
+    const mm = `${Math.floor(left / 60)}:${String(left % 60).padStart(2, "0")}`;
+    if (tty) process.stderr.write(`\r${pc2.dim(`Waiting for approval\u2026 (expires in ${mm})`)}   `);
+    else if (Date.now() - lastLine >= 3e4) {
+      lastLine = Date.now();
+      err(`Waiting for approval\u2026 (expires in ${mm})`);
+    }
+    try {
+      const r = await rawRequest(`${base}/api/cli-pair.php?action=poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ pair_id: p.pair_id, poll_secret: p.poll_secret })
+      });
+      const b = obj(r.body);
+      if (r.status === 403) {
+        nl();
+        throw new ApiError(String(b["error"] ?? "Login refused by the server."), Exit.AUTH, 403, r.body, r.traceId, {
+          hint: "CLI access may have been switched off, or the workspace owner changed."
+        });
+      }
+      if (r.status >= 500 || r.status === 429) throw new Error(`HTTP ${r.status}`);
+      const status = b["status"];
+      if (status === "approved" && typeof b["token"] === "string") {
+        if (tty) process.stderr.write("\r" + " ".repeat(60) + "\r");
+        return b;
+      }
+      if (typeof status === "string" && TERMINAL[status]) {
+        nl();
+        throw new CliError(TERMINAL[status], Exit.AUTH, { hint: "Run: staqon login" });
+      }
+      if (status !== "pending") throw new Error(`unexpected poll response (HTTP ${r.status})`);
+      failures = 0;
+    } catch (e) {
+      if (e instanceof CliError) throw e;
+      if (++failures >= 5) {
+        nl();
+        throw new CliError(`Lost contact with the server while waiting: ${e instanceof Error ? e.message : e}`);
+      }
+    }
+    await sleep(interval * (failures ? 1 + failures : 1), signal);
+  }
+  nl();
+  throw new CliError("Login cancelled.", Exit.INTERRUPTED);
+}
+
+// src/commands/auth.ts
+function warnIfFile(b) {
+  if (b === "file")
+    err(
+      pc3.yellow("Note: OS keychain unavailable; token stored in a user-only file (") + pc3.yellow("credentials.json in the staqon config directory).")
+    );
+}
+function openBrowser(url) {
+  const cmd = process.platform === "win32" ? `start "" "${url}"` : process.platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+  exec(cmd, () => void 0);
+}
+async function confirmYes(q) {
+  if (!ctx.interactive) return false;
+  const { confirm } = await import("@inquirer/prompts");
+  return confirm({ message: q, default: false }, { output: process.stderr });
+}
+function registerAuth(program2) {
+  program2.command("login").description("Sign in via device code (the workspace owner approves in the browser)").option("--open", "open the verification URL in your browser").option("--force", "overwrite an existing login without asking").action(async (o) => {
+    const existing = await loadSession();
+    if (existing && existing.backend !== "env" && !o.force) {
+      const ws = existing.session.workspace?.name ?? "a workspace";
+      if (!await confirmYes(`Already logged in to ${ws}. Replace it?`))
+        throw new CliError(`Already logged in to ${ws}.`, Exit.USAGE, { hint: "Use --force to replace it." });
+    }
+    const base = baseUrlFor();
+    const pair = await codeRequest(base);
+    err("");
+    err(`  Open:  ${pc3.cyan(pair.verification_url)}`);
+    err(`  Code:  ${pc3.bold(pc3.green(pair.code))}`);
+    err(pc3.dim("  Only the workspace owner can approve (MPIN may be asked if your web session is old)."));
+    err("");
+    if (o.open) openBrowser(pair.verification_url);
+    const ac = new AbortController();
+    const onSigint = () => ac.abort();
+    process.once("SIGINT", onSigint);
+    let approved;
+    try {
+      approved = await pollUntilApproved(base, pair, ac.signal);
+    } finally {
+      process.off("SIGINT", onSigint);
+    }
+    const backend = await saveSession({
+      token: approved.token,
+      baseUrl: base,
+      workspace: approved.workspace,
+      expiresAt: approved.expires_at,
+      savedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const check = await loadSession();
+    if (check?.session.token !== approved.token)
+      throw new CliError("Approved, but the token could not be saved; this login is lost.", Exit.GENERAL, {
+        hint: "Run staqon login again."
+      });
+    warnIfFile(backend);
+    if (ctx.json)
+      out(JSON.stringify({ ok: true, workspace: approved.workspace, expires_at: approved.expires_at, storage: backend }));
+    else out(`${pc3.green("\u2714")} Logged in to ${pc3.bold(approved.workspace.name)} (${approved.workspace.slug})${approved.expires_at ? `, expires ${approved.expires_at}` : ""}`);
+  });
+  program2.command("logout").description("Forget the local token (revoking it is done by the owner in the web UI)").action(async () => {
+    await deleteSession();
+    if (ctx.json) out(JSON.stringify({ ok: true }));
+    else {
+      out("Local token removed.");
+      if (process.env["STAQON_TOKEN"]) err(pc3.yellow("STAQON_TOKEN is still set in your environment."));
+      err(pc3.dim("The session stays valid on the server until it expires; the owner can revoke it at /cli."));
+    }
+  });
+  program2.command("refresh").alias("reimport").description("Rotate the session token (old one works 5 more minutes)").action(async () => {
+    const cur = await loadSession();
+    if (!cur) throw new CliError("Not logged in.", Exit.AUTH, { hint: "Run: staqon login" });
+    if (cur.backend === "env")
+      throw new CliError("Token comes from STAQON_TOKEN; refresh would rotate it where the CLI cannot save it.", Exit.USAGE, {
+        hint: "Unset STAQON_TOKEN and use staqon login."
+      });
+    const base = baseUrlFor(cur.session);
+    const r = await rawRequest(`${base}/api/cli-pair.php?action=refresh`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${cur.session.token}` }
+    });
+    if (r.status === 401 || r.status === 403) throw authError(r);
+    const newTok = r.body?.token;
+    if (r.status < 200 || r.status >= 300 || typeof newTok !== "string")
+      throw new ApiError(`Refresh failed (HTTP ${r.status}).`, Exit.GENERAL, r.status, r.body, r.traceId, { showBody: true });
+    let backend;
+    try {
+      backend = await saveSession({ ...cur.session, token: newTok, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      const back = await loadSession();
+      if (back?.session.token !== newTok) throw new Error("read-back mismatch");
+    } catch (e) {
+      err(pc3.red("Could not save the new token. It is printed once below; the old token works for ~5 minutes:"));
+      process.stderr.write(newTok + "\n");
+      throw new CliError(`Saving the rotated token failed: ${e instanceof Error ? e.message : e}`);
+    }
+    warnIfFile(backend);
+    if (ctx.json) out(JSON.stringify({ ok: true, storage: backend }));
+    else out(`${pc3.green("\u2714")} Token rotated and saved.`);
+  });
+  program2.command("whoami").description("Show the workspace, session, limits and which teams can do what").action(async () => {
+    const r = await proxy({ ep: "whoami", method: "GET", noTeam: true });
+    if (ctx.json) return printData(r.body);
+    const b = r.body;
+    const ws = b["workspace"];
+    out(`${pc3.bold("Workspace")}  ${typeof ws === "object" && ws ? `${ws.name} (${ws.slug})` : String(ws)}`);
+    const s = b["session"] ?? {};
+    out(`${pc3.bold("Session")}    ${s.device_label ?? "?"}  created ${s.created_at ?? "?"}`);
+    out(`            expires ${s.expires_at ?? "?"}  (hard cap ${s.absolute_expires_at ?? "?"})`);
+    const l = b["limits"] ?? {};
+    out(`${pc3.bold("Limits")}     ${l.used_last_minute ?? "?"}/${l.per_minute ?? "?"} per min, ${l.used_today ?? "?"}/${l.per_day ?? "?"} today`);
+    out(pc3.bold("Access"));
+    for (const a of b["access"] ?? []) {
+      const teams = (a.teams ?? []).map((t) => t.team_slug ?? t.team_id).join(", ") || "-";
+      out(`  ${a.surface ?? ""}${a.purpose ? ` / ${a.purpose}` : ""}  teams: ${teams}${a.automatic ? " (automatic)" : ""}`);
+      if (ctx.verbose) out(pc3.dim(`    endpoints: ${(a.endpoints ?? []).join(", ")}`));
+    }
+  });
+  program2.command("use [team]").description("Save (or show / clear) the default team sent as X-StaqOn-Team").option("--clear", "remove the saved default").action(async (team, o) => {
+    const cfg = loadConfig();
+    if (o.clear) {
+      delete cfg.defaultTeam;
+      saveConfig(cfg);
+      return void out(ctx.json ? JSON.stringify({ default_team: null }) : "Default team cleared.");
+    }
+    if (!team) return void out(ctx.json ? JSON.stringify({ default_team: cfg.defaultTeam ?? null }) : cfg.defaultTeam ? `Default team: ${cfg.defaultTeam}` : "No default team set.");
+    try {
+      await requireSession();
+      const r = await proxy({ ep: "whoami", method: "GET", noTeam: true });
+      const known = (r.body?.access ?? []).flatMap((a) => a.teams ?? []);
+      if (known.length && !known.some((t) => String(t.team_slug) === team || String(t.team_id) === team))
+        err(pc3.yellow(`Warning: "${team}" is not among this workspace's teams (${known.map((t) => t.team_slug ?? t.team_id).join(", ")}).`));
+    } catch {
+    }
+    saveConfig({ ...cfg, defaultTeam: team });
+    out(ctx.json ? JSON.stringify({ default_team: team }) : `Default team set to ${team}.`);
+  });
+}
+
+// src/commands/raw.ts
+import fs3 from "fs";
+import path4 from "path";
+var ENDPOINTS = [
+  "external/message",
+  "external/messages",
+  "external/comment",
+  "external/members",
+  "external/member",
+  "external/ad",
+  "external/ad-image",
+  "external/ad-status",
+  "external/staqon-verify-start",
+  "external/staqon-verify-check",
+  "external/staqon-verify-cancel",
+  "internal/message",
+  "internal/members"
+];
+function kv(items, flag) {
+  return (items ?? []).map((s) => {
+    const i = s.indexOf("=");
+    if (i < 1) throw new CliError(`${flag} expects key=value, got "${s}".`, Exit.USAGE);
+    return [s.slice(0, i), s.slice(i + 1)];
+  });
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function readJson(spec) {
+  const text = spec === "-" ? await readStdin() : spec.startsWith("@") ? fs3.readFileSync(spec.slice(1), "utf8") : spec;
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw new CliError(`--data is not valid JSON: ${e instanceof Error ? e.message : e}`, Exit.USAGE);
+  }
+}
+async function buildForm(items) {
+  const fd = new FormData();
+  for (const [k, v] of kv(items, "--form")) {
+    if (v.startsWith("@")) {
+      const p = v.slice(1);
+      if (!fs3.existsSync(p)) throw new CliError(`File not found: ${p}`, Exit.USAGE);
+      fd.append(k, await fs3.openAsBlob(p), path4.basename(p));
+    } else fd.append(k, v);
+  }
+  return fd;
+}
+async function runRaw(ep, o) {
+  if (o.data !== void 0 && o.form?.length) throw new CliError("Use either --data or --form, not both.", Exit.USAGE);
+  const method = o.method ? o.method.toUpperCase() : void 0;
+  if (method && method !== "GET" && method !== "POST") throw new CliError("--method must be GET or POST.", Exit.USAGE);
+  const r = await proxy({
+    ep,
+    method,
+    query: Object.fromEntries(kv(o.query, "--query")),
+    json: o.data !== void 0 ? await readJson(o.data) : void 0,
+    form: o.form?.length ? await buildForm(o.form) : void 0
+  });
+  if (!ctx.json && r.team) debug(`acted as team: ${r.team}`);
+  if (r.body === void 0) {
+    if (ctx.json) process.stdout.write("null\n");
+    return;
+  }
+  printData(r.body);
+}
+function addRawFlags(c) {
+  return c.option("-q, --query <k=v...>", "extra query param for the endpoint (repeatable)", (v, a = []) => [...a, v]).option("-d, --data <json>", "JSON request body: inline, @file.json, or - for stdin").option("-F, --form <k=v...>", "multipart field; k=@path attaches a file (repeatable)", (v, a = []) => [...a, v]).option("-X, --method <GET|POST>", "override the HTTP method (default: POST if a body is given, else GET)");
+}
+function registerRaw(program2) {
+  addRawFlags(
+    program2.command("api <endpoint>").description(`Call any CLI-proxy endpoint directly. Endpoints: ${ENDPOINTS.join(", ")}`)
+  ).action((endpoint, o) => runRaw(endpoint, o));
+}
+
+// src/commands/typed.ts
+import path5 from "path";
+import pc4 from "picocolors";
+
+// src/validate.ts
+import fs4 from "fs";
+var usage = (msg, hint) => new CliError(msg, Exit.USAGE, hint ? { hint } : {});
+var len = (s) => [...s].length;
+function maxLen(name, s, max) {
+  if (len(s) > max) throw usage(`${name} is too long (${len(s)} > ${max} characters).`);
+  return s;
+}
+function range(name, s, min, max) {
+  const n = len(s);
+  if (n < min || n > max) throw usage(`${name} must be ${min}-${max} characters (got ${n}).`);
+  return s;
+}
+function required(name, s) {
+  if (s === void 0 || s.trim() === "") throw usage(`${name} is required.`);
+  return s;
+}
+function httpsUrl(name, s) {
+  let u;
+  try {
+    u = new URL(s);
+  } catch {
+    throw usage(`${name} is not a valid URL.`);
+  }
+  if (u.protocol !== "https:") throw usage(`${name} must be an https URL.`);
+  return s;
+}
+function intOpt(name, min, max) {
+  return (v) => {
+    const n = Number(v);
+    if (!Number.isInteger(n) || n < min || n > max) throw usage(`${name} must be an integer ${min}-${max}.`);
+    return n;
+  };
+}
+async function readStdin2() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function textFrom(flag, value, file2) {
+  if (value !== void 0 && file2 !== void 0) throw usage(`Use either --${flag} or --${flag}-file, not both.`);
+  if (file2 !== void 0) {
+    if (!fs4.existsSync(file2)) throw usage(`File not found: ${file2}`);
+    return fs4.readFileSync(file2, "utf8").replace(/\r\n$|\n$/, "");
+  }
+  if (value === "-") return (await readStdin2()).replace(/\r?\n$/, "");
+  return required(`--${flag}`, value);
+}
+async function readJsonArg(name, spec) {
+  const text = spec === "-" ? await readStdin2() : spec.startsWith("@") ? fs4.readFileSync(spec.slice(1), "utf8") : spec;
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw usage(`${name} is not valid JSON: ${e instanceof Error ? e.message : e}`);
+  }
+}
+var COLORS = ["#1F7A54", "#059669", "#D97706", "#DC2626", "#2563EB", "#4B5563", "#7C3AED", "#0D9488", "#DB2777", "#0891B2"];
+var ICONS = ["check", "warning", "document", "security", "wallet", "person", "alert", "info", "reassign", "pending"];
+var CARD_KEYS = ["header_color", "title", "body", "meta_title", "sub_body", "icon", "button", "table"];
+var BUTTON_KEYS = ["label", "url", "color"];
+var isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var str = (name, v, max, req = false) => {
+  if (v === void 0) {
+    if (req) throw usage(`card.${name} is required.`);
+    return;
+  }
+  if (typeof v !== "string") throw usage(`card.${name} must be a string.`);
+  if (req && v === "") throw usage(`card.${name} is required.`);
+  maxLen(`card.${name}`, v, max);
+};
+function validateCard(card, opts) {
+  if (!isObj(card)) throw usage("--card must be a JSON object.");
+  for (const k of Object.keys(card)) if (!CARD_KEYS.includes(k)) throw usage(`Unknown card key "${k}".`, `Allowed: ${CARD_KEYS.join(", ")}`);
+  if (typeof card["header_color"] !== "string" || !COLORS.includes(card["header_color"]))
+    throw usage("card.header_color is required and must be one of: " + COLORS.join(" "));
+  str("title", card["title"], 200, true);
+  str("body", card["body"], 2e3, true);
+  str("meta_title", card["meta_title"], 60);
+  str("sub_body", card["sub_body"], 2e3);
+  if (card["icon"] !== void 0 && !ICONS.includes(card["icon"]))
+    throw usage("card.icon must be one of: " + ICONS.join(", "));
+  if (card["button"] !== void 0) {
+    if (!opts.allowButton) throw usage("Verification cards cannot have a button.");
+    const b = card["button"];
+    if (!isObj(b)) throw usage("card.button must be an object.");
+    for (const k of Object.keys(b)) if (!BUTTON_KEYS.includes(k)) throw usage(`Unknown card.button key "${k}".`);
+    str("button.label", b["label"], 40, true);
+    str("button.url", b["url"], 2048, true);
+    if (!/^(https:\/\/|tel:|mailto:)/i.test(b["url"])) throw usage("card.button.url must be https, tel or mailto.");
+  }
+  if (card["table"] !== void 0) {
+    const t = card["table"];
+    if (!isObj(t)) throw usage("card.table must be an object.");
+    const cols = t["columns"];
+    const rows = t["rows"];
+    if (!Array.isArray(cols) || cols.length < 2 || cols.length > 6) throw usage("card.table.columns needs 2-6 columns.");
+    if (!Array.isArray(rows) || rows.length < 1 || rows.length > 500) throw usage("card.table.rows needs 1-500 rows.");
+    for (const c of cols) {
+      if (!isObj(c)) throw usage("Each table column must be an object.");
+      str("table.column.label", c["label"], 60, true);
+      if (c["align"] !== void 0 && !["left", "center", "right"].includes(c["align"]))
+        throw usage("table column align must be left, center or right.");
+    }
+    let chars = 0;
+    rows.forEach((r, i) => {
+      if (!Array.isArray(r) || r.length !== cols.length || r.some((x) => typeof x !== "string"))
+        throw usage(`card.table.rows[${i}] must be ${cols.length} strings (one per column).`);
+      chars += r.reduce((n, x) => n + len(x), 0);
+    });
+    if (chars > 6e4) throw usage("card.table is over 60000 characters in total.");
+  }
+  return card;
+}
+async function cardArg(spec, allowButton) {
+  if (spec === void 0) return void 0;
+  return validateCard(await readJsonArg("--card", spec), { allowButton });
+}
+function checkImageFile(file2) {
+  if (!fs4.existsSync(file2) || !fs4.statSync(file2).isFile()) throw usage(`File not found: ${file2}`);
+  const bytes = fs4.readFileSync(file2);
+  if (bytes.length > 300 * 1024) throw usage(`Image is ${(bytes.length / 1024).toFixed(0)} KB; the limit is 300 KB.`, "Compress or resize it first.");
+  let type;
+  if (bytes.subarray(0, 3).equals(Buffer.from([255, 216, 255]))) type = "jpeg";
+  else if (bytes.subarray(0, 4).equals(Buffer.from([137, 80, 78, 71]))) type = "png";
+  else if (bytes.subarray(0, 4).toString("latin1") === "RIFF" && bytes.subarray(8, 12).toString("latin1") === "WEBP") type = "webp";
+  if (!type) throw usage("Only JPEG, PNG and WebP images are accepted (checked on the file contents).");
+  return { bytes, type };
+}
+
+// src/identity.ts
+var MAX_DIRECTORY_PAGES = 50;
+var obj2 = (b) => b && typeof b === "object" ? b : {};
+async function resolveIdentity(who2, want, dir = "external") {
+  const given = [who2.to, who2.email, who2.username].filter((x) => x !== void 0 && x !== "");
+  if (given.length === 0) throw usage(`Say who: --${want}, or --to <email|username>.`);
+  if (given.length > 1) throw usage("Use only one of --to, --email, --username.");
+  const value = (who2.to ?? who2.email ?? who2.username).trim();
+  const isEmail = who2.email !== void 0 ? true : who2.username !== void 0 ? false : value.includes("@");
+  if (isEmail && who2.username === void 0 && !value.includes("@")) throw usage(`"${value}" is not an email address.`);
+  if (isEmail === (want === "email")) return value;
+  debug(`resolving ${isEmail ? "email" : "username"} "${value}" to ${want} via ${dir} members`);
+  if (isEmail && dir === "external") {
+    const r = await proxy({ ep: "external/member", method: "GET", query: { email: value } });
+    const u = obj2(r.body)["member"]?.username;
+    if (typeof u !== "string" || !u) throw new CliError(`Member ${value} has no username.`, Exit.GENERAL);
+    return u;
+  }
+  const matches = (m) => isEmail ? String(m["email"]).toLowerCase() === value.toLowerCase() : String(m["username"]).toLowerCase() === value.toLowerCase();
+  const fetchPage = async (query) => {
+    const r = await proxy({ ep: `${dir}/members`, method: "GET", query, timeoutMs: LIST_TIMEOUT_MS });
+    const b = obj2(r.body);
+    return { list: b["members"] ?? [], pages: Number(b["pages"]) || 1 };
+  };
+  let hit = (await fetchPage({ search: value, limit: "50" })).list.find(matches);
+  if (!hit && !isEmail && dir === "external") {
+    try {
+      const m = await proxy({ ep: "external/messages", method: "GET", query: { username: value, limit: "1" } });
+      const name = obj2(obj2(m.body)["member"])["name"];
+      if (typeof name === "string" && name) hit = (await fetchPage({ search: name, limit: "50" })).list.find(matches);
+    } catch (e) {
+      debug(`name lookup via messages failed (${e instanceof Error ? e.message : e}); falling back to paging`);
+    }
+  }
+  if (!hit) {
+    debug(`search found no exact match for "${value}"; paging through the members directory`);
+    for (let page = 1, pages = 1; !hit && page <= pages && page <= MAX_DIRECTORY_PAGES; page++) {
+      const res = await fetchPage({ limit: "50", page: String(page) });
+      pages = res.pages;
+      hit = res.list.find(matches);
+    }
+  }
+  const out2 = hit?.[want];
+  if (typeof out2 !== "string" || !out2)
+    throw new CliError(`No member in this team matches "${value}".`, Exit.GENERAL, {
+      hint: "Check with: staqon members list --search " + value
+    });
+  return out2;
+}
+
+// src/commands/typed.ts
+var obj3 = (b) => b && typeof b === "object" ? b : {};
+var withWho = (c) => c.option("--to <email|username>", "the member, as an email or a username (converted if needed)").option("--email <email>", "the member's email").option("--username <username>", "the member's username");
+var who = (o) => ({ to: o["to"], email: o["email"], username: o["username"] });
+function note(r) {
+  if (r.team) debug(`acted as team: ${r.team}`);
+}
+function show(r, human) {
+  note(r);
+  if (ctx.json) return void (r.body === void 0 ? out("null") : printData(r.body));
+  if (r.body === void 0 || typeof r.body !== "object") return void (r.body !== void 0 && printData(r.body));
+  human(obj3(r.body));
+}
+var ok = (s) => out(`${pc4.green("\u2714")} ${s}`);
+function table(rows, head) {
+  const all = [head, ...rows];
+  const w = head.map((_, i) => Math.max(...all.map((r) => (r[i] ?? "").length)));
+  const line = (r) => r.map((c, i) => (c ?? "").padEnd(w[i])).join("  ").trimEnd();
+  out(pc4.bold(line(head)));
+  rows.forEach((r) => out(line(r)));
+}
+function registerTyped(program2) {
+  const message = program2.command("message").description("Send messages as the workspace");
+  withWho(message.command("send").description("Send a message to a member (endpoint takes an email)")).option("-m, --message <text>", 'message text, max 60000 chars; "-" reads stdin').option("--message-file <path>", "read the message from a file").addHelpText("after", '\nExamples:\n  staqon message send --email ada@example.com -m "Hello"\n  staqon message send --to ada -m "Hello"   (username is resolved to an email)').action(async (o) => {
+    const text = maxLen("message", await textFrom("message", o["message"], o["messageFile"]), 6e4);
+    const email = await resolveIdentity(who(o), "email");
+    const r = await proxy({ ep: "external/message", json: { email, message: text } });
+    show(r, (b) => ok(`Sent. message_id=${b["message_id"]} conversation_id=${b["conversation_id"]}`));
+  });
+  withWho(program2.command("messages").description("Read a member's conversation (needs the member's approved link)")).option("--limit <n>", "1-200 (default 50)", intOpt("--limit", 1, 200)).option("--before <id>", "messages older than this id").option("--after <id>", "messages newer than this id").action(async (o) => {
+    if (o["before"] && o["after"]) throw usage("Use --before or --after, not both.");
+    const username = await resolveIdentity(who(o), "username");
+    const query = { username };
+    if (o["limit"]) query["limit"] = String(o["limit"]);
+    if (o["before"]) query["before"] = o["before"];
+    if (o["after"]) query["after"] = o["after"];
+    const r = await proxy({ ep: "external/messages", method: "GET", query });
+    show(r, (b) => {
+      out(pc4.bold(`Conversation ${b["conversation_id"]} with ${b["member"]?.name ?? ""} (@${b["member"]?.username ?? username})`));
+      for (const m of b["messages"] ?? []) {
+        const flags = [m["edited"] && "edited", m["deleted"] && "deleted", m["source"]].filter(Boolean).join(", ");
+        out(`${pc4.dim(`#${m["id"]} ${m["sent_at"]}`)} ${pc4.cyan(m["sender_name"] ?? m["sender_side"])}${flags ? pc4.dim(` (${flags})`) : ""}`);
+        out(`  ${m["deleted"] ? pc4.dim("[deleted]") : m["content"] ?? ""}`);
+        if (m["card"]) out(pc4.dim(`  [card: ${m["card"].title ?? ""}]`));
+        for (const a of m["attachments"] ?? [])
+          out(pc4.dim(`  \u{1F4CE} ${a["name"]} (${a["mime"]}, ${a["size"]} B)${a["url_available"] ? " " + a["url"] : " [unavailable]"}`));
+      }
+      if (b["paging"]) out(pc4.dim(`paging: ${JSON.stringify(b["paging"])}  (signed attachment URLs last 1 day)`));
+    });
+  });
+  withWho(program2.command("comment").description("Post a comment on a member's thread (endpoint takes a username)")).option("-c, --comment <text>", 'comment text, max 60000 chars; "-" reads stdin').option("--comment-file <path>", "read the comment from a file").option("--external-ref <ref>", "idempotency key, max 190 chars; a repeat is rejected, nothing is posted").option("--card <json>", "card object: inline JSON, @file.json, or - for stdin").action(async (o) => {
+    const text = maxLen("comment", await textFrom("comment", o["comment"], o["commentFile"]), 6e4);
+    if (o["externalRef"] !== void 0) maxLen("--external-ref", o["externalRef"], 190);
+    const card = await cardArg(o["card"], true);
+    const username = await resolveIdentity(who(o), "username");
+    const json = { username, comment: text };
+    if (o["externalRef"] !== void 0) json["external_ref"] = o["externalRef"];
+    if (card) json["card"] = card;
+    try {
+      const r = await proxy({ ep: "external/comment", json });
+      show(r, (b) => ok(`Posted. message_id=${b["message_id"]} conversation_id=${b["conversation_id"]} sent_at=${b["sent_at"]}`));
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 409 && obj3(e.body)["message_id"] !== void 0)
+        throw new ApiError(
+          `Duplicate external_ref: nothing was posted (existing message_id ${obj3(e.body)["message_id"]}, sent ${obj3(e.body)["sent_at"]}).`,
+          Exit.GENERAL,
+          409,
+          e.body,
+          e.traceId
+        );
+      throw e;
+    }
+  });
+  const listOpts = (c) => c.option("--page <n>", "page number", intOpt("--page", 1, 1e6)).option("--limit <n>", `1-${MAX_LIST_LIMIT} (default 50; the directory is slow, ~0.35s per row)`, intOpt("--limit", 1, MAX_LIST_LIMIT)).option("--search <text>", "filter by name or email");
+  const memberQuery = (o) => {
+    const q = {};
+    if (o["page"]) q["page"] = String(o["page"]);
+    if (o["limit"]) q["limit"] = String(o["limit"]);
+    if (o["search"]) q["search"] = o["search"];
+    return q;
+  };
+  const memberTable = (b, extra) => {
+    const rows = (b["members"] ?? []).map((m) => [String(m["id"]), m["name"] ?? "", m["email"] ?? "", m["username"] ?? "", m["status"] ?? "", m[extra] === void 0 ? "" : String(m[extra])]);
+    table(rows, ["ID", "NAME", "EMAIL", "USERNAME", "STATUS", extra.toUpperCase()]);
+    out(pc4.dim(`page ${b["page"]}/${b["pages"]}, ${b["total"]} total`));
+  };
+  const members = program2.command("members").description("Workspace members");
+  listOpts(members.command("list").description("List members (shows both email and username)")).action(async (o) => {
+    const r = await proxy({ ep: "external/members", method: "GET", query: memberQuery(o), timeoutMs: LIST_TIMEOUT_MS });
+    show(r, (b) => memberTable(b, "last_message_at"));
+  });
+  program2.command("member [email-or-id]").description("Look up one member by email or member id").option("--email <email>", "look up by email").option("--member-id <id>", "look up by member id").action(async (arg, o) => {
+    const given = [arg, o["email"], o["memberId"]].filter((x) => x);
+    if (given.length !== 1) throw usage("Give exactly one of: <email-or-id>, --email, --member-id.");
+    const query = {};
+    if (o["memberId"]) query["member_id"] = o["memberId"];
+    else {
+      const v = arg ?? o["email"];
+      if (v.includes("@")) query["email"] = v;
+      else query["member_id"] = v;
+    }
+    const r = await proxy({ ep: "external/member", method: "GET", query });
+    show(r, (b) => {
+      const m = obj3(b["member"]);
+      for (const k of ["id", "name", "email", "username", "joined_at", "last_active", "messages_sent", "has_mpin"])
+        out(`${pc4.bold(k.padEnd(14))} ${m[k] ?? ""}`);
+    });
+  });
+  const internal = program2.command("internal").description("Internal (one-way API Messages feed)");
+  withWho(internal.command("message").description("Send a one-way message to a member's API Messages feed (needs their approval)")).option("-m, --message <text>", 'message text, max 60000 chars; "-" reads stdin').option("--message-file <path>", "read the message from a file").option("--title <title>", "max 200 chars").option("--external-ref <ref>", "idempotency key, max 190 chars").option("--link-url <url>", "http(s) URL").option("--card <json>", "card object: inline JSON, @file.json, or - for stdin").action(async (o) => {
+    const text = maxLen("message", await textFrom("message", o["message"], o["messageFile"]), 6e4);
+    if (o["title"] !== void 0) maxLen("--title", o["title"], 200);
+    if (o["externalRef"] !== void 0) maxLen("--external-ref", o["externalRef"], 190);
+    if (o["linkUrl"] !== void 0 && !/^https?:\/\//i.test(o["linkUrl"])) throw usage("--link-url must be an http(s) URL.");
+    const card = await cardArg(o["card"], true);
+    const username = await resolveIdentity(who(o), "username", "internal");
+    const json = { username, message: text };
+    if (o["title"] !== void 0) json["title"] = o["title"];
+    if (o["externalRef"] !== void 0) json["external_ref"] = o["externalRef"];
+    if (o["linkUrl"] !== void 0) json["link_url"] = o["linkUrl"];
+    if (card) json["card"] = card;
+    try {
+      const r = await proxy({ ep: "internal/message", json });
+      show(r, (b) => ok(`Delivered. id=${b["id"]} delivered_at=${b["delivered_at"]}`));
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 404 && /internal link/i.test(String(obj3(e.body)["error"] ?? obj3(e.body)["message"])))
+        throw new ApiError("Internal Link is not set up for this workspace.", Exit.TEAM_OR_KEY, 404, e.body, e.traceId, {
+          hint: "The workspace owner has to set it up in settings."
+        });
+      if (e instanceof ApiError && e.status === 409 && obj3(e.body)["id"] !== void 0)
+        throw new ApiError(`Duplicate external_ref: nothing was sent (existing id ${obj3(e.body)["id"]}, delivered ${obj3(e.body)["delivered_at"]}).`, Exit.GENERAL, 409, e.body, e.traceId);
+      throw e;
+    }
+  });
+  listOpts(internal.command("members").description("List members of the internal directory (search also matches username)")).action(async (o) => {
+    const r = await proxy({ ep: "internal/members", method: "GET", query: memberQuery(o), timeoutMs: LIST_TIMEOUT_MS });
+    show(r, (b) => memberTable(b, "role"));
+  });
+  const ad = program2.command("ad").description("Ads (asynchronous: delivered by a background worker)");
+  const uploadImage = async (file2) => {
+    const { bytes, type } = checkImageFile(file2);
+    const fd = new FormData();
+    fd.append("image", new Blob([new Uint8Array(bytes)], { type: `image/${type}` }), path5.basename(file2));
+    return proxy({ ep: "external/ad-image", form: fd });
+  };
+  const imageHuman = (b) => {
+    ok(`Uploaded ${b["width"]}x${b["height"]}, ${b["bytes"]} B (auto-cropped to 16:9, metadata stripped).`);
+    out(`image_url: ${b["image_url"]}`);
+    err(pc4.dim(`Use it with: staqon ad create --image-url "${b["image_url"]}" ...`));
+  };
+  ad.command("image <file>").description("Upload an ad image (JPEG/PNG/WebP, max 300 KB; cropped to 16:9, max 1280x720)").action(async (file2) => show(await uploadImage(file2), imageHuman));
+  ad.command("create").description("Create an ad. Success is 202 + an ad_request_id; track it with: staqon ad status <id>").option("--body <text>", 'ad text, 50-900 chars; "-" reads stdin').option("--body-file <path>", "read the body from a file").option("--button-label <label>", "max 30 chars").option("--button-url <url>", "https URL").option("--image-url <url>", 'URL returned by "staqon ad image" (same workspace and team)').option("--image <file>", "upload this image first, then use it (same as ad image + --image-url)").option("--external-ref <ref>", "idempotency key, max 150 chars").option("--wait", "poll until the ad finishes (every 5s, up to 10 min)").action(async (o) => {
+    const body = range("body", await textFrom("body", o["body"], o["bodyFile"]), 50, 900);
+    const label = maxLen("--button-label", required("--button-label", o["buttonLabel"]), 30);
+    const url = httpsUrl("--button-url", required("--button-url", o["buttonUrl"]));
+    if (o["externalRef"] !== void 0) maxLen("--external-ref", o["externalRef"], 150);
+    if (o["image"] && o["imageUrl"]) throw usage("Use either --image or --image-url, not both.");
+    if (o["image"]) checkImageFile(o["image"]);
+    let imageUrl = o["imageUrl"];
+    if (o["image"]) {
+      const up = await uploadImage(o["image"]);
+      imageUrl = obj3(up.body)["image_url"];
+      info(`Uploaded image: ${imageUrl}`);
+    }
+    const json = { body, button_label: label, button_url: url };
+    if (imageUrl) json["image_url"] = imageUrl;
+    if (o["externalRef"] !== void 0) json["external_ref"] = o["externalRef"];
+    let r;
+    try {
+      r = await proxy({ ep: "external/ad", json });
+    } catch (e) {
+      if (e instanceof ApiError && imageUrl && o["image"])
+        err(pc4.dim(`The image was uploaded; to retry without re-uploading use --image-url "${imageUrl}"`));
+      if (e instanceof ApiError && e.status === 409) throw new ApiError("Duplicate external_ref: no new ad was queued.", Exit.GENERAL, 409, e.body, e.traceId, { showBody: true });
+      throw e;
+    }
+    const id = obj3(r.body)["ad_request_id"];
+    if (!o["wait"]) return show(r, (b) => {
+      ok(`Queued (202). ad_request_id=${b["ad_request_id"]}  external_ref=${b["external_ref"] ?? ""}  status=${b["status"]}`);
+      out(`Track it with: staqon ad status ${b["ad_request_id"]}`);
+    });
+    info(`Queued: ad_request_id=${id}. Waiting\u2026`);
+    const final = await waitForAd(String(id));
+    show(final, adStatusHuman);
+    if (obj3(final.body)["status"] === "failed") process.exitCode = Exit.GENERAL;
+  });
+  const adStatusHuman = (b) => {
+    const col = b["status"] === "completed" ? pc4.green : b["status"] === "failed" ? pc4.red : pc4.yellow;
+    out(`${pc4.bold("ad " + b["ad_request_id"])}  ${col(String(b["status"]))}${b["legacy"] ? pc4.dim(" (legacy ref)") : ""}`);
+    out(`targets ${b["total_targets"]}: delivered ${b["delivered"]}, failed ${b["failed"]}, skipped ${b["skipped"]}, processed ${b["processed"]}`);
+    out(pc4.dim(`created ${b["created_at"] ?? "-"}  started ${b["started_at"] ?? "-"}  finished ${b["finished_at"] ?? "-"}  (${b["duration_ms"] ?? "-"} ms)  webhook: ${b["webhook_status"] ?? "-"}`));
+    if (b["error"]) out(pc4.red(`error: ${b["error"]}`));
+  };
+  const info = (s) => ctx.json || err(s);
+  async function waitForAd(id) {
+    const deadline = Date.now() + 10 * 6e4;
+    for (; ; ) {
+      const r = await proxy({ ep: "external/ad-status", method: "GET", query: { ad_request_id: id } });
+      const st = obj3(r.body)["status"];
+      if (st === "completed" || st === "failed") return r;
+      if (Date.now() > deadline) throw new CliError(`Still ${st} after 10 minutes; check later with: staqon ad status ${id}`);
+      await new Promise((res) => setTimeout(res, 5e3));
+    }
+  }
+  ad.command("status [ad_request_id]").description("Check an ad by request id or external ref").option("--external-ref <ref>", "look up by external_ref instead").action(async (id, o) => {
+    if (!!id === !!o["externalRef"]) throw usage("Give exactly one of: <ad_request_id>, --external-ref.");
+    const query = id ? { ad_request_id: id } : { external_ref: o["externalRef"] };
+    show(await proxy({ ep: "external/ad-status", method: "GET", query }), adStatusHuman);
+  });
+  const verify = program2.command("verify").description("StaqOn Verify (needs the member's approved link)");
+  withWho(verify.command("start").description("Ask a member to approve an action")).option("--action <text>", "what is being approved, max 100 chars").option("--context <text>", "extra context, max 500 chars").option("--ttl <seconds>", "how long the request stays open (clamped to 30-180, default 30)", intOpt("--ttl", 1, 1e5)).option("--card <json>", "card (no button allowed): inline JSON, @file.json, or - for stdin").action(async (o) => {
+    const action = maxLen("--action", required("--action", o["action"]), 100);
+    const context = maxLen("--context", required("--context", o["context"]), 500);
+    const card = await cardArg(o["card"], false);
+    const username = await resolveIdentity(who(o), "username");
+    const json = { username, action, context };
+    if (o["ttl"] !== void 0) json["ttl_seconds"] = o["ttl"];
+    if (card) json["card"] = card;
+    const r = await proxy({ ep: "external/staqon-verify-start", json });
+    show(r, (b) => {
+      ok(`Verification started. verification_id=${b["verification_id"]}  expires_at=${b["expires_at"]}`);
+      out(`Check it with: staqon verify check ${b["verification_id"]}`);
+    });
+  });
+  verify.command("check <verification_id>").description("Has the member approved? (verified true/false + reason)").option("--strict", "exit 1 unless the result is verified (pending/declined/timeout/cancelled all exit 1)").action(async (id, o) => {
+    const r = await proxy({ ep: "external/staqon-verify-check", json: { verification_id: id } });
+    show(
+      r,
+      (b) => b["verified"] ? ok("Verified.") : out(`${pc4.yellow("Not verified")}: ${b["reason"]}${b["reason"] === "pending" ? pc4.dim("  (still waiting; check again)") : ""}`)
+    );
+    if (o["strict"] && obj3(r.body)["verified"] !== true) process.exitCode = Exit.GENERAL;
+  });
+  verify.command("cancel <verification_id>").description("Cancel a pending verification").action(async (id) => {
+    try {
+      const r = await proxy({ ep: "external/staqon-verify-cancel", json: { verification_id: id } });
+      show(r, (b) => ok(b["already"] ? "Already cancelled." : "Cancelled."));
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 409 && obj3(e.body)["reason"] === "already_resolved")
+        throw new ApiError(`Too late to cancel: the member already answered (status ${obj3(e.body)["status"]}, verified ${obj3(e.body)["verified"]}).`, Exit.GENERAL, 409, e.body, e.traceId);
+      if (e instanceof ApiError && e.status === 410)
+        throw new ApiError("This verification has already expired.", Exit.GENERAL, 410, e.body, e.traceId);
+      throw e;
+    }
+  });
+}
+
+// src/cli.ts
+var program = new Command("staqon").description("StaqOn command-line client").version(VERSION).option("--json", "machine-readable output (raw response bodies on stdout, errors as JSON on stderr)").option("--team <team>", "team id or slug to act as (overrides the saved default)").option("--base-url <url>", "API host (default https://staqon.one; also STAQON_BASE_URL)").option("--no-color", "disable colors").option("--verbose", "print request lines and trace ids to stderr").showHelpAfterError().exitOverride();
+program.hook("preAction", (cmd) => {
+  const o = cmd.optsWithGlobals();
+  ctx.json = Boolean(o.json);
+  ctx.team = o.team;
+  ctx.baseUrl = o.baseUrl;
+  ctx.verbose = Boolean(o.verbose);
+  ctx.interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY) && !ctx.json;
+});
+registerAuth(program);
+registerTyped(program);
+registerRaw(program);
+try {
+  await program.parseAsync(process.argv);
+} catch (e) {
+  const code = e.code;
+  if (code === "commander.helpDisplayed" || code === "commander.version" || code === "commander.help") process.exit(0);
+  if (typeof code === "string" && code.startsWith("commander.")) process.exit(Exit.USAGE);
+  process.exit(reportError(e));
+}