@stndrds/cli 1.0.0-alpha.292 → 1.0.0-alpha.294

package/README.md

@@ -0,0 +1,34 @@
+# Standards CLI
+
+The Standards CLI connects a terminal to a Standards instance. See the public
+[CLI guide](../../content/docs/07-cli.mdx) for installation and the full command surface.
+
+## Run this computer as a paired device
+
+Remote device execution is an optional server capability. Once an operator has enabled it,
+create a named profile, pair the current computer, and keep the foreground worker running:
+
+```bash
+standards login --name production --url https://standards.example/v1 --key "$STANDARDS_API_KEY"
+standards device pair --name "Build Mac"
+standards device serve
+```
+
+The worker supports macOS and Linux and makes outbound HTTPS requests only. It executes each
+approved command in the foreground using the user's local account and permissions. There is no
+privilege escalation, background service installation, PTY, file transfer, or GUI control.
+
+Commands time out after 10 minutes by default and may not exceed 60 minutes. Standard output and
+standard error are each limited to 30,000 characters. Stop the worker with `Ctrl+C`; inspect it
+with `standards device status`; revoke its credential with `standards device revoke`.
+
+Interactive harnesses are outside the V0 contract. Invoke installed tools in their
+non-interactive mode, for example:
+
+```bash
+codex exec --json "Run the repository checks"
+claude -p "Summarize the failing tests"
+```
+
+Every agent command targeting a device requires explicit user approval. Calls to `exec_command`
+without a `deviceId` continue to use the agent sandbox.

package/dist/bin.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/program.ts
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 import { Command } from "commander";
 
 // src/client.ts
@@ -129,6 +129,13 @@ function getClientFromCommand(cmd) {
   }
   return createClient({ apiUrl: root.apiUrl, apiKey: root.apiKey, tenantId: root.tenant });
 }
+function requireTenant(cmd, message) {
+  const { tenant } = getGlobalOptions(cmd);
+  if (!tenant) {
+    throw new Error(message);
+  }
+  return tenant;
+}
 function messageOf(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -301,6 +308,833 @@ function registerConnectorsCommand(program) {
   });
 }
 
+// src/commands/device.ts
+import { hostname } from "os";
+import { SchemaError as SchemaError2, SchemaErrorCode as SchemaErrorCode2 } from "@stndrds/schema";
+
+// src/config.ts
+import { randomUUID } from "crypto";
+import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var DEFAULT_API_URL = "http://localhost:4100/v1";
+var ENV_PROFILE_NAME = "sandbox";
+function getDefaultApiUrl() {
+  return DEFAULT_API_URL;
+}
+function getConfigPath() {
+  const configDir = process.env.STANDARDS_CONFIG_DIR ?? join(homedir(), ".standards");
+  return join(configDir, "config.json");
+}
+async function readConfig() {
+  try {
+    const raw = await readFile(getConfigPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      ...parsed.installationId ? { installationId: parsed.installationId } : {},
+      currentProfile: parsed.currentProfile,
+      profiles: parsed.profiles ?? {}
+    };
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return { profiles: {} };
+    }
+    throw error;
+  }
+}
+async function writeConfig(config) {
+  const path = getConfigPath();
+  const directory = dirname(path);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await chmod(directory, 448);
+  await writeFile(path, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
+function normalizeApiOrigin(apiUrl) {
+  try {
+    return new URL(apiUrl).origin;
+  } catch {
+    return apiUrl.replace(/\/+$/, "");
+  }
+}
+async function upsertProfile(input2) {
+  const config = await readConfig();
+  const existingProfile = config.profiles[input2.name];
+  const device = existingProfile?.device && normalizeApiOrigin(existingProfile.apiUrl) === normalizeApiOrigin(input2.apiUrl) ? existingProfile.device : void 0;
+  config.profiles[input2.name] = {
+    apiUrl: input2.apiUrl,
+    apiKey: input2.apiKey,
+    ...device ? { device } : {}
+  };
+  config.currentProfile = input2.name;
+  await writeConfig(config);
+}
+async function getOrCreateInstallationId() {
+  const config = await readConfig();
+  if (config.installationId) return config.installationId;
+  const installationId = randomUUID();
+  config.installationId = installationId;
+  await writeConfig(config);
+  return installationId;
+}
+async function getStoredDeviceCredential(profileName) {
+  const config = await readConfig();
+  return config.profiles[profileName]?.device ?? null;
+}
+async function storeDeviceCredential(profileName, credential) {
+  const config = await readConfig();
+  const profile = config.profiles[profileName];
+  if (!profile) return false;
+  profile.device = credential;
+  await writeConfig(config);
+  return true;
+}
+async function removeDeviceCredential(profileName) {
+  const config = await readConfig();
+  const profile = config.profiles[profileName];
+  if (!profile?.device) return false;
+  profile.device = void 0;
+  await writeConfig(config);
+  return true;
+}
+async function setCurrentProfile(name) {
+  const config = await readConfig();
+  if (!config.profiles[name]) {
+    throw new Error(`Unknown Standards instance "${name}"`);
+  }
+  config.currentProfile = name;
+  await writeConfig(config);
+}
+async function removeProfile(name) {
+  const config = await readConfig();
+  const profileName = name ?? config.currentProfile;
+  if (!profileName) return;
+  delete config.profiles[profileName];
+  if (config.currentProfile === profileName) {
+    config.currentProfile = void 0;
+  }
+  await writeConfig(config);
+}
+async function listProfiles() {
+  const config = await readConfig();
+  const profiles = Object.entries(config.profiles).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({
+    name,
+    apiUrl: profile.apiUrl,
+    current: config.currentProfile === name
+  }));
+  const envProfile = getEnvProfile();
+  if (envProfile) {
+    profiles.push({
+      name: ENV_PROFILE_NAME,
+      apiUrl: envProfile.apiUrl,
+      current: !config.currentProfile,
+      source: "env"
+    });
+  }
+  return profiles;
+}
+async function getActiveProfile() {
+  const config = await readConfig();
+  if (!config.currentProfile) {
+    const envProfile = getEnvProfile();
+    return envProfile ? { name: ENV_PROFILE_NAME, ...envProfile } : null;
+  }
+  const profile = config.profiles[config.currentProfile];
+  if (!profile) return null;
+  return { name: config.currentProfile, ...profile };
+}
+function getEnvProfile() {
+  if (!process.env.STANDARDS_API_KEY) return null;
+  return {
+    apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+    apiKey: process.env.STANDARDS_API_KEY
+  };
+}
+async function resolveCliConfig(options) {
+  if (options.apiUrl || options.apiKey) {
+    return {
+      apiUrl: options.apiUrl ?? process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+      apiKey: options.apiKey ?? process.env.STANDARDS_API_KEY
+    };
+  }
+  const config = await readConfig();
+  const profileName = options.instance ?? config.currentProfile;
+  if (profileName) {
+    const profile = config.profiles[profileName];
+    if (!profile) throw new Error(`Unknown Standards instance "${profileName}"`);
+    return {
+      apiUrl: profile.apiUrl,
+      apiKey: profile.apiKey,
+      profileName
+    };
+  }
+  return {
+    apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+    apiKey: process.env.STANDARDS_API_KEY
+  };
+}
+
+// src/device/worker-client.ts
+import { SchemaError, SchemaErrorCode } from "@stndrds/schema";
+var REQUEST_TIMEOUT_MS = 3e4;
+var DeviceWorkerRequestError = class extends SchemaError {
+  constructor(statusCode, message, code = SchemaErrorCode.REPOSITORY_QUERY_FAILED) {
+    super(message, code, { statusCode });
+    this.statusCode = statusCode;
+    this.name = "DeviceWorkerRequestError";
+  }
+};
+var DeviceCredentialRejectedError = class extends DeviceWorkerRequestError {
+  constructor() {
+    super(
+      401,
+      "Device credential rejected; run standards device pair again",
+      SchemaErrorCode.ACCESS_DENIED
+    );
+    this.name = "DeviceCredentialRejectedError";
+  }
+};
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function readJson(response) {
+  const text = await response.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function messageFrom(value, fallback) {
+  return isRecord(value) && typeof value.message === "string" ? value.message : fallback;
+}
+function parseLease(value) {
+  if (!isRecord(value)) throw new DeviceWorkerRequestError(200, "Invalid lease response");
+  const leaseToken = value.leaseToken;
+  if (!isRecord(value.command)) {
+    throw new DeviceWorkerRequestError(200, "Invalid lease response");
+  }
+  const leasedCommand = value.command;
+  const { id, intent, command, cwd, timeoutMs } = leasedCommand;
+  if (typeof id !== "string" || typeof leaseToken !== "string" || typeof intent !== "string" || typeof command !== "string" || cwd !== void 0 && cwd !== null && typeof cwd !== "string" || typeof timeoutMs !== "number" || !Number.isInteger(timeoutMs)) {
+    throw new DeviceWorkerRequestError(200, "Invalid lease response");
+  }
+  return {
+    id,
+    leaseToken,
+    intent,
+    command,
+    timeoutMs,
+    ...typeof cwd === "string" ? { cwd } : {}
+  };
+}
+function parseHeartbeat(value) {
+  if (!isRecord(value)) {
+    throw new DeviceWorkerRequestError(200, "Invalid heartbeat response");
+  }
+  const { cancel } = value;
+  if (typeof cancel !== "boolean") {
+    throw new DeviceWorkerRequestError(200, "Invalid heartbeat response");
+  }
+  const reason = value.reason;
+  if (reason !== void 0 && reason !== "cancelled" && reason !== "revoked") {
+    throw new DeviceWorkerRequestError(200, "Invalid heartbeat response");
+  }
+  return { cancel, ...reason === void 0 ? {} : { reason } };
+}
+function isAbortError(error) {
+  return error instanceof DOMException && error.name === "AbortError";
+}
+var DeviceWorkerClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetch = options.fetch ?? fetch;
+    this.apiUrl = options.apiUrl.replace(/\/+$/, "");
+  }
+  async request(path, input2 = {}) {
+    const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const signal = input2.signal ? AbortSignal.any([input2.signal, timeoutSignal]) : timeoutSignal;
+    let response;
+    try {
+      response = await this.fetch(`${this.apiUrl}/device-worker${path}`, {
+        method: "POST",
+        signal,
+        headers: {
+          authorization: `Device ${this.options.token}`,
+          "content-type": "application/json",
+          ...input2.leaseToken ? { "x-device-lease-token": input2.leaseToken } : {}
+        },
+        ...input2.body === void 0 ? {} : { body: JSON.stringify(input2.body) }
+      });
+    } catch (error) {
+      if (input2.signal?.aborted) throw new DOMException("Aborted", "AbortError");
+      if (isAbortError(error)) throw error;
+      throw new DeviceWorkerRequestError(0, "Device worker request failed");
+    }
+    if (response.status === 401) throw new DeviceCredentialRejectedError();
+    if (!response.ok) {
+      const body = await readJson(response);
+      throw new DeviceWorkerRequestError(
+        response.status,
+        messageFrom(body, `Device worker request failed with status ${response.status}`),
+        response.status === 409 ? SchemaErrorCode.CONFLICT : SchemaErrorCode.REPOSITORY_QUERY_FAILED
+      );
+    }
+    return response;
+  }
+  async lease(signal) {
+    const response = await this.request("/commands/lease", {
+      body: { version: "1", capabilities: ["exec"] },
+      signal
+    });
+    if (response.status === 204) return null;
+    return parseLease(await readJson(response));
+  }
+  async markRunning(commandId, leaseToken) {
+    await this.request(`/commands/${commandId}/running`, { leaseToken });
+  }
+  async heartbeat(commandId, leaseToken, signal) {
+    const response = await this.request(`/commands/${commandId}/heartbeat`, {
+      leaseToken,
+      signal
+    });
+    return parseHeartbeat(await readJson(response));
+  }
+  async output(commandId, leaseToken, stdout, stderr) {
+    await this.request(`/commands/${commandId}/output`, {
+      leaseToken,
+      body: { stdout, stderr }
+    });
+  }
+  async complete(commandId, leaseToken, result) {
+    await this.request(`/commands/${commandId}/complete`, {
+      leaseToken,
+      body: {
+        exitCode: result.exitCode,
+        success: result.success,
+        ...result.errorCode ? { errorCode: result.errorCode } : {}
+      }
+    });
+  }
+};
+
+// src/device/process-runner.ts
+import { spawn } from "child_process";
+import { constants } from "fs";
+import { access, stat } from "fs/promises";
+import { isAbsolute } from "path";
+import { StringDecoder } from "string_decoder";
+var OUTPUT_LIMIT = 3e4;
+var TERMINATION_GRACE_MS = 5e3;
+var TERMINATION_POLL_MS = 50;
+var BoundedTextBuffer = class {
+  constructor() {
+    this.decoder = new StringDecoder("utf8");
+    this.decoderFlushed = false;
+    this.value = "";
+    this.truncated = false;
+  }
+  append(chunk) {
+    if (this.truncated) return;
+    const text = typeof chunk === "string" ? chunk : this.decoder.write(Buffer.from(chunk));
+    this.appendText(text);
+  }
+  appendText(text) {
+    const remaining = OUTPUT_LIMIT - this.value.length;
+    if (text.length <= remaining) {
+      this.value += text;
+      return;
+    }
+    this.value += text.slice(0, Math.max(remaining, 0));
+    this.truncated = true;
+  }
+  toString() {
+    if (!this.decoderFlushed) {
+      this.decoderFlushed = true;
+      this.appendText(this.decoder.end());
+    }
+    return this.truncated ? `${this.value}
+... output truncated to ${OUTPUT_LIMIT} chars` : this.value;
+  }
+};
+function isMissingProcess(error) {
+  return error instanceof Error && "code" in error && error.code === "ESRCH";
+}
+function signalProcessGroup(pid, signal, kill) {
+  try {
+    kill(-pid, signal);
+    return true;
+  } catch (error) {
+    if (isMissingProcess(error)) return false;
+    throw error;
+  }
+}
+function beginProcessGroupTermination(pid, deps = {}) {
+  const kill = deps.kill ?? process.kill.bind(process);
+  const setTimer = deps.setTimer ?? setTimeout;
+  const clearTimer = deps.clearTimer ?? clearTimeout;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let escalationTimer;
+    let pollTimer;
+    function clearTimers() {
+      if (escalationTimer) clearTimer(escalationTimer);
+      if (pollTimer) clearTimer(pollTimer);
+    }
+    function finish() {
+      if (settled) return;
+      settled = true;
+      clearTimers();
+      resolve();
+    }
+    function fail(error) {
+      if (settled) return;
+      settled = true;
+      clearTimers();
+      reject(error);
+    }
+    function poll() {
+      if (settled) return;
+      try {
+        if (!signalProcessGroup(pid, 0, kill)) {
+          finish();
+          return;
+        }
+        pollTimer = setTimer(poll, TERMINATION_POLL_MS);
+      } catch (error) {
+        fail(error);
+      }
+    }
+    try {
+      if (!signalProcessGroup(pid, "SIGTERM", kill)) {
+        finish();
+        return;
+      }
+      escalationTimer = setTimer(() => {
+        try {
+          if (!signalProcessGroup(pid, 0, kill)) {
+            finish();
+            return;
+          }
+          signalProcessGroup(pid, "SIGKILL", kill);
+        } catch (error) {
+          fail(error);
+        }
+      }, TERMINATION_GRACE_MS);
+      pollTimer = setTimer(poll, TERMINATION_POLL_MS);
+    } catch (error) {
+      fail(error);
+    }
+  });
+}
+async function resolveShell(shell = process.env.SHELL) {
+  if (!(shell && isAbsolute(shell))) return "/bin/sh";
+  try {
+    const metadata = await stat(shell);
+    if (!metadata.isFile()) return "/bin/sh";
+    await access(shell, constants.X_OK);
+    return shell;
+  } catch {
+    return "/bin/sh";
+  }
+}
+function terminalResult(reason, stdout, stderr) {
+  return {
+    stdout: stdout.toString(),
+    stderr: stderr.toString(),
+    exitCode: reason === "timed_out" ? 124 : 130,
+    success: false,
+    errorCode: reason
+  };
+}
+async function runDeviceProcess(input2) {
+  if (input2.signal?.aborted) {
+    return { stdout: "", stderr: "", exitCode: 130, success: false, errorCode: "cancelled" };
+  }
+  const shell = await resolveShell();
+  if (input2.signal?.aborted) {
+    return { stdout: "", stderr: "", exitCode: 130, success: false, errorCode: "cancelled" };
+  }
+  const stdout = new BoundedTextBuffer();
+  const stderr = new BoundedTextBuffer();
+  return new Promise((resolve) => {
+    let settled = false;
+    let terminationReason;
+    let termination;
+    let child;
+    function finish(result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      input2.signal?.removeEventListener("abort", cancel);
+      resolve(result);
+    }
+    function finishTerminationFailure(error) {
+      finish({
+        stdout: stdout.toString(),
+        stderr: error instanceof Error ? error.message : String(error),
+        exitCode: 1,
+        success: false,
+        errorCode: "execution_failed"
+      });
+    }
+    function terminate(reason) {
+      if (settled || terminationReason || !child?.pid) return;
+      terminationReason = reason;
+      termination = beginProcessGroupTermination(child.pid);
+      termination.catch(finishTerminationFailure);
+    }
+    function cancel() {
+      terminate("cancelled");
+    }
+    const timeout = setTimeout(() => terminate("timed_out"), input2.timeoutMs);
+    try {
+      const spawned2 = spawn(shell, ["-lc", input2.command], {
+        cwd: input2.cwd,
+        env: process.env,
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      child = spawned2;
+    } catch (error) {
+      finish({
+        stdout: "",
+        stderr: error instanceof Error ? error.message : String(error),
+        exitCode: 1,
+        success: false,
+        errorCode: "execution_failed"
+      });
+      return;
+    }
+    input2.signal?.addEventListener("abort", cancel, { once: true });
+    if (input2.signal?.aborted) cancel();
+    const spawned = child;
+    spawned.stdout.on("data", (chunk) => stdout.append(chunk));
+    spawned.stderr.on("data", (chunk) => stderr.append(chunk));
+    spawned.once("error", (error) => {
+      finish({
+        stdout: stdout.toString(),
+        stderr: error.message,
+        exitCode: 1,
+        success: false,
+        errorCode: "execution_failed"
+      });
+    });
+    spawned.once("close", (code) => {
+      if (terminationReason) {
+        const reason = terminationReason;
+        (termination ?? Promise.resolve()).then(
+          () => finish(terminalResult(reason, stdout, stderr)),
+          finishTerminationFailure
+        );
+        return;
+      }
+      const exitCode = code ?? 1;
+      finish({
+        stdout: stdout.toString(),
+        stderr: stderr.toString(),
+        exitCode,
+        success: exitCode === 0,
+        ...code === null ? { errorCode: "execution_failed" } : {}
+      });
+    });
+  });
+}
+
+// src/device/worker-loop.ts
+var HEARTBEAT_INTERVAL_MS = 2e3;
+var INITIAL_RETRY_MS = 250;
+var MAX_RETRY_MS = 1e4;
+var RETRY_JITTER_MS = 250;
+function computeRetryDelay(attempt, random = Math.random) {
+  const exponential = Math.min(INITIAL_RETRY_MS * 2 ** attempt, MAX_RETRY_MS);
+  return exponential + Math.floor(random() * RETRY_JITTER_MS);
+}
+function sleepWithAbort(milliseconds, signal) {
+  if (signal?.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
+  return new Promise((resolve, reject) => {
+    function abort() {
+      clearTimeout(timer);
+      reject(new DOMException("Aborted", "AbortError"));
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    }, milliseconds);
+    signal?.addEventListener("abort", abort, { once: true });
+  });
+}
+function isAbortError2(error) {
+  return error instanceof DOMException && error.name === "AbortError";
+}
+function isRetryableIdleError(error) {
+  return error instanceof DeviceWorkerRequestError && (error.statusCode === 0 || error.statusCode >= 500);
+}
+function isLeaseConflict(error) {
+  return error instanceof DeviceWorkerRequestError && error.statusCode === 409;
+}
+async function executeLease(command, input2, runProcess, sleep) {
+  try {
+    await input2.client.markRunning(command.id, command.leaseToken);
+  } catch (error) {
+    if (error instanceof DeviceCredentialRejectedError) throw error;
+    return;
+  }
+  input2.onEvent?.({ type: "running", commandId: command.id, intent: command.intent });
+  const commandController = new AbortController();
+  const heartbeatController = new AbortController();
+  let completionAllowed = true;
+  let heartbeatFailure;
+  function abortCommand() {
+    commandController.abort();
+  }
+  input2.signal.addEventListener("abort", abortCommand, { once: true });
+  const processPromise = runProcess({
+    command: command.command,
+    cwd: command.cwd,
+    timeoutMs: command.timeoutMs,
+    signal: commandController.signal
+  });
+  const heartbeatPromise = (async () => {
+    while (!heartbeatController.signal.aborted) {
+      try {
+        await sleep(HEARTBEAT_INTERVAL_MS, heartbeatController.signal);
+        const heartbeat = await input2.client.heartbeat(
+          command.id,
+          command.leaseToken,
+          heartbeatController.signal
+        );
+        if (heartbeat.cancel) {
+          if (heartbeat.reason === "revoked") completionAllowed = false;
+          commandController.abort();
+          return;
+        }
+      } catch (error) {
+        if (heartbeatController.signal.aborted && isAbortError2(error)) return;
+        heartbeatFailure = error;
+        completionAllowed = false;
+        commandController.abort();
+        return;
+      }
+    }
+  })();
+  let result;
+  try {
+    result = await processPromise;
+  } catch (error) {
+    result = {
+      stdout: "",
+      stderr: error instanceof Error ? error.message : String(error),
+      exitCode: 1,
+      success: false,
+      errorCode: "execution_failed"
+    };
+  } finally {
+    heartbeatController.abort();
+    await heartbeatPromise;
+    input2.signal.removeEventListener("abort", abortCommand);
+  }
+  if (heartbeatFailure instanceof DeviceCredentialRejectedError) throw heartbeatFailure;
+  if (!completionAllowed || isLeaseConflict(heartbeatFailure)) return;
+  try {
+    await input2.client.output(command.id, command.leaseToken, result.stdout, result.stderr);
+    await input2.client.complete(command.id, command.leaseToken, result);
+  } catch (error) {
+    if (error instanceof DeviceCredentialRejectedError) throw error;
+    return;
+  }
+  input2.onEvent?.({ type: "completed", commandId: command.id, exitCode: result.exitCode });
+}
+async function runDeviceWorker(input2) {
+  const runProcess = input2.runProcess ?? runDeviceProcess;
+  const sleep = input2.sleep ?? sleepWithAbort;
+  const random = input2.random ?? Math.random;
+  let retryAttempt = 0;
+  while (!input2.signal.aborted) {
+    let command;
+    try {
+      command = await input2.client.lease(input2.signal);
+      retryAttempt = 0;
+    } catch (error) {
+      if (input2.signal.aborted) return;
+      if (error instanceof DeviceCredentialRejectedError) throw error;
+      if (!isRetryableIdleError(error)) throw error;
+      try {
+        await sleep(computeRetryDelay(retryAttempt, random), input2.signal);
+      } catch (sleepError) {
+        if (input2.signal.aborted && isAbortError2(sleepError)) return;
+        throw sleepError;
+      }
+      retryAttempt += 1;
+      continue;
+    }
+    if (!command) continue;
+    await executeLease(command, input2, runProcess, sleep);
+  }
+}
+
+// src/commands/device.ts
+var NAMED_PROFILE_REQUIRED = "Device pairing requires a named Standards profile";
+var SUPPORTED_PLATFORMS_REQUIRED = "Device workers support macOS and Linux only";
+var DeviceCommandError = class extends SchemaError2 {
+  constructor(message) {
+    super(message, SchemaErrorCode2.VALIDATION_FAILED);
+    this.name = "DeviceCommandError";
+  }
+};
+function requireSupportedPlatform(platform) {
+  if (platform === "darwin" || platform === "linux") return platform;
+  throw new DeviceCommandError(SUPPORTED_PLATFORMS_REQUIRED);
+}
+function requireNamedProfile(command) {
+  const options = getGlobalOptions(command);
+  if (!(options.profileName && options.apiUrl && options.apiKey)) {
+    throw new DeviceCommandError(NAMED_PROFILE_REQUIRED);
+  }
+  return {
+    apiUrl: options.apiUrl,
+    apiKey: options.apiKey,
+    profileName: options.profileName,
+    tenantId: options.tenant
+  };
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseDeviceView(value) {
+  if (!isRecord2(value)) throw new DeviceCommandError("Invalid device response");
+  const { id, name, platform, arch, hostname: deviceHostname } = value;
+  const { status } = value;
+  if (typeof id !== "string" || typeof name !== "string" || platform !== "darwin" && platform !== "linux" || typeof arch !== "string" || typeof deviceHostname !== "string" || status !== "online" && status !== "offline" && status !== "revoked") {
+    throw new DeviceCommandError("Invalid device response");
+  }
+  return { id, name, platform, arch, hostname: deviceHostname, status };
+}
+function parsePairDeviceResponse(value) {
+  if (!isRecord2(value) || typeof value.token !== "string") {
+    throw new DeviceCommandError("Invalid device pairing response");
+  }
+  return { device: parseDeviceView(value.device), token: value.token };
+}
+function parseDeviceList(value) {
+  if (!Array.isArray(value)) throw new DeviceCommandError("Invalid device list response");
+  return value.map(parseDeviceView);
+}
+async function pairDevice(name, command) {
+  const platform = requireSupportedPlatform(process.platform);
+  const profile = requireNamedProfile(command);
+  const installationId = await getOrCreateInstallationId();
+  const client = createClient({
+    apiUrl: profile.apiUrl,
+    apiKey: profile.apiKey,
+    tenantId: profile.tenantId
+  });
+  const response = parsePairDeviceResponse(
+    await client.post("/devices/pair", {
+      installationId,
+      name,
+      platform,
+      arch: process.arch,
+      hostname: hostname()
+    })
+  );
+  const stored = await storeDeviceCredential(profile.profileName, {
+    id: response.device.id,
+    name: response.device.name,
+    token: response.token
+  });
+  if (!stored) throw new DeviceCommandError(NAMED_PROFILE_REQUIRED);
+  process.stdout.write(`Paired ${response.device.name} (${response.device.id})
+`);
+}
+async function showDeviceStatus(command) {
+  const profile = requireNamedProfile(command);
+  const credential = await getStoredDeviceCredential(profile.profileName);
+  if (!credential) {
+    throw new DeviceCommandError("No paired device; run standards device pair first");
+  }
+  const client = createClient({
+    apiUrl: profile.apiUrl,
+    apiKey: profile.apiKey,
+    tenantId: profile.tenantId
+  });
+  const devices = parseDeviceList(await client.get("/devices"));
+  const pairedDevice = devices.find((device) => device.id === credential.id);
+  formatOutput(
+    pairedDevice ? [pairedDevice] : [{ id: credential.id, name: credential.name, status: "revoked" }],
+    getFormat(command)
+  );
+}
+async function revokeDevice(command) {
+  const profile = requireNamedProfile(command);
+  const credential = await getStoredDeviceCredential(profile.profileName);
+  if (!credential) {
+    throw new DeviceCommandError("No paired device; run standards device pair first");
+  }
+  const client = createClient({
+    apiUrl: profile.apiUrl,
+    apiKey: profile.apiKey,
+    tenantId: profile.tenantId
+  });
+  await client.delete(`/devices/${credential.id}`);
+  await removeDeviceCredential(profile.profileName);
+}
+async function serveDevice(command) {
+  const platform = requireSupportedPlatform(process.platform);
+  const profile = requireNamedProfile(command);
+  const credential = await getStoredDeviceCredential(profile.profileName);
+  if (!credential) {
+    throw new DeviceCommandError("No paired device; run standards device pair first");
+  }
+  const userClient = createClient({
+    apiUrl: profile.apiUrl,
+    apiKey: profile.apiKey,
+    tenantId: profile.tenantId
+  });
+  const devices = parseDeviceList(await userClient.get("/devices"));
+  const device = devices.find((candidate) => candidate.id === credential.id);
+  if (!device) throw new DeviceCommandError("Device is unavailable");
+  if (device.platform !== platform) {
+    throw new DeviceCommandError("Device platform does not match paired device");
+  }
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+  process.stdout.write(`Connected as ${credential.name}
+`);
+  process.stdout.write("Waiting for commands \u2014 press Ctrl+C to disconnect\n");
+  try {
+    await runDeviceWorker({
+      client: new DeviceWorkerClient({ apiUrl: profile.apiUrl, token: credential.token }),
+      signal: controller.signal,
+      onEvent: (event) => {
+        if (event.type === "running") {
+          process.stdout.write(`Running ${event.commandId}: ${event.intent}
+`);
+          return;
+        }
+        process.stdout.write(`Completed ${event.commandId} with exit code ${event.exitCode}
+`);
+      }
+    });
+  } finally {
+    process.removeListener("SIGINT", stop);
+    process.removeListener("SIGTERM", stop);
+  }
+}
+function registerDeviceCommand(program) {
+  const device = program.command("device").description("Pair and run this computer as a device");
+  device.command("pair").description("Pair this computer with Standards").requiredOption("--name <name>", "device name").action(
+    async (options, command) => pairDevice(options.name, command)
+  );
+  device.command("status").description("Show the paired device status").action(async (_options, command) => showDeviceStatus(command));
+  device.command("revoke").description("Revoke this computer's device credential").action(async (_options, command) => revokeDevice(command));
+  device.command("serve").description("Run the foreground device worker").action(async (_options, command) => serveDevice(command));
+}
+
 // src/commands/documents.ts
 import { formatByteSize } from "@stndrds/schema";
 function toFileRow(file) {
@@ -379,8 +1213,24 @@ function registerDocumentsCommand(program) {
   });
 }
 
+// src/commands/embeddings.ts
+import chalk4 from "chalk";
+function registerEmbeddingsCommand(program) {
+  const embeddings = program.command("embeddings").description("Maintain record embeddings");
+  embeddings.command("drain").description("Embed every pending memory and skill record of the tenant").action(async (_opts, cmd) => {
+    const tenant = requireTenant(
+      cmd,
+      'An embedding drain names its tenant explicitly. Pass "--tenant <id>".'
+    );
+    const client = getClientFromCommand(cmd);
+    await client.post("/admin/embeddings/drain", { tenantId: tenant });
+    process.stdout.write(`${chalk4.green("\u2713")} Embedding drain accepted for tenant ${tenant}.
+`);
+  });
+}
+
 // src/commands/folders.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 function registerFoldersCommand(program) {
   const folders = program.command("folders").description("Manage record drive folders");
   folders.command("reconcile-paths").description("Create a folder tree on a record drive from paths").argument("<object>", "object name (e.g. contacts)").argument("<recordId>", "record ID owning the drive").option(
@@ -394,7 +1244,7 @@ function registerFoldersCommand(program) {
   ).option("--paths-file <file>", "file containing one path per line").option("--mode <mode>", "reconcile mode: repair or dryRun", "repair").action(async (objectName, recordId, opts, cmd) => {
     const paths = [...opts.path];
     if (opts.pathsFile) {
-      const content = await readFile(opts.pathsFile, "utf-8");
+      const content = await readFile2(opts.pathsFile, "utf-8");
       const filePaths = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
       paths.push(...filePaths);
     }
@@ -412,7 +1262,7 @@ function registerFoldersCommand(program) {
 }
 
 // src/commands/keys.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 function registerKeysCommand(program) {
   const keys = program.command("keys").description("Manage Standards API keys");
   keys.command("list").description("List API keys").action(async (_opts, cmd) => {
@@ -439,14 +1289,14 @@ function registerKeysCommand(program) {
     }
     const client = getClientFromCommand(cmd);
     await client.delete(`/api-keys/${id}`);
-    process.stdout.write(`${chalk4.green("\u2713")} API key ${id} revoked.
+    process.stdout.write(`${chalk5.green("\u2713")} API key ${id} revoked.
 `);
   });
 }
 
 // src/commands/mcp.ts
 import { RESOURCE_VISIBILITIES, ValidationError as ValidationError2 } from "@stndrds/schema";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 var AUTH_TYPES = ["none", "header"];
 function buildAuth(opts) {
   const type = opts.authType ?? "none";
@@ -509,7 +1359,7 @@ function registerMcpCommand(program) {
     const client = getClientFromCommand(cmd);
     await client.post(`/mcp-servers/${id}/trust`, { trusted });
     process.stdout.write(
-      `${chalk5.green("\u2713")} MCP server ${id} ${trusted ? "trusted" : "untrusted"}.
+      `${chalk6.green("\u2713")} MCP server ${id} ${trusted ? "trusted" : "untrusted"}.
 `
     );
   });
@@ -522,13 +1372,18 @@ function registerMcpCommand(program) {
     }
     const client = getClientFromCommand(cmd);
     await client.delete(`/mcp-servers/${id}`);
-    process.stdout.write(`${chalk5.green("\u2713")} MCP server ${id} disconnected.
+    process.stdout.write(`${chalk6.green("\u2713")} MCP server ${id} disconnected.
 `);
   });
 }
 
 // src/commands/meetings.ts
-import { ValidationError as ValidationError3 } from "@stndrds/schema";
+import { createHmac } from "crypto";
+import {
+  FAKE_MEETING_BOT_SIGNATURE_HEADER,
+  RECORDING_OVERRIDES,
+  ValidationError as ValidationError3
+} from "@stndrds/schema";
 var ORDERS = ["asc", "desc"];
 function parseOrder(order) {
   if (ORDERS.includes(order)) return order;
@@ -553,6 +1408,43 @@ function buildQuery(opts) {
   if (opts.offset !== void 0) query.offset = parseCount("--offset", opts.offset);
   return query;
 }
+function parseOverride(opts) {
+  const chosen = RECORDING_OVERRIDES.filter(
+    (override) => opts[override]
+  );
+  if (opts.auto) chosen.push(null);
+  if (chosen.length !== 1) {
+    throw new ValidationError3("record needs exactly one of --force, --skip or --auto", []);
+  }
+  return chosen[0] ?? null;
+}
+var SIMULATED_LINE_MS = 4e3;
+var DEFAULT_SIMULATED_LINES = 12;
+var SIMULATED_SENTENCES = [
+  "Bonjour \xE0 tous, merci d'\xEAtre l\xE0, on commence par le point d'avancement.",
+  "De mon c\xF4t\xE9 la maquette est valid\xE9e, il reste les retours du client.",
+  "On garde le planning initial, la livraison est pr\xE9vue pour vendredi.",
+  "Est-ce que quelqu'un a des questions sur le budget de la phase deux ?",
+  "Je propose qu'on fasse un point rapide jeudi pour v\xE9rifier les tests.",
+  "Tr\xE8s bien, je vous envoie le compte rendu dans la journ\xE9e, bonne journ\xE9e."
+];
+function simulatedSpeakers(meeting) {
+  const speakers = meeting.participants.map(
+    (participant) => participant.name?.trim() || participant.address.split("@")[0] || participant.address
+  );
+  return speakers.length > 0 ? speakers : ["Speaker"];
+}
+function buildSimulatedSegments(speakers, lines) {
+  return Array.from({ length: lines }, (_, index) => ({
+    speaker: speakers[index % speakers.length] ?? null,
+    startsAtMs: index * SIMULATED_LINE_MS,
+    endsAtMs: (index + 1) * SIMULATED_LINE_MS,
+    text: SIMULATED_SENTENCES[index % SIMULATED_SENTENCES.length] ?? ""
+  }));
+}
+function signFakeWebhook(secret, body) {
+  return createHmac("sha256", secret).update(body).digest("hex");
+}
 function withQueryOptions(command) {
   return command.option("--search <text>", "match title, description and location").option("--since <iso>", "inclusive ISO lower bound on the start").option("--before <iso>", "exclusive ISO upper bound on the start").option("--addresses <emails>", "comma-separated participant addresses to restrict to").option("--record <id>", "only meetings linked to this record").option("--order <order>", "asc for what is coming next, desc to read history").option("--limit <n>", "max meetings to return").option("--offset <n>", "number of meetings to skip");
 }
@@ -589,10 +1481,69 @@ function registerMeetingsCommand(program) {
       formatOutput(result, getFormat(cmd));
     }
   );
+  meetings.command("transcript").description("Read a meeting's completed transcript").argument("<id>", "meeting ID").action(async (id, _opts, cmd) => {
+    const client = getClientFromCommand(cmd);
+    const result = await client.get(`/meetings/${id}/transcript`);
+    formatOutput(result, getFormat(cmd));
+  });
+  meetings.command("record").description("Force, skip, or hand back to the workspace policy the recording of a meeting").argument("<id>", "meeting ID").option("--force", "record this meeting whatever the workspace policy says").option("--skip", "never record this meeting").option("--auto", "clear the override and follow the workspace policy").action(async (id, opts, cmd) => {
+    const override = parseOverride(opts);
+    const client = getClientFromCommand(cmd);
+    const result = await client.put(`/meetings/${id}/recording`, { override });
+    formatOutput(result, getFormat(cmd));
+  });
+  meetings.command("simulate-transcript").description("Complete a fake-provider bot by posting a generated transcript to its webhook").argument("<id>", "meeting ID").option(
+    "--lines <n>",
+    "number of transcript lines to generate",
+    String(DEFAULT_SIMULATED_LINES)
+  ).action(async (id, opts, cmd) => {
+    const secret = process.env.MEETING_BOT_FAKE_SECRET;
+    if (!secret) {
+      throw new ValidationError3("MEETING_BOT_FAKE_SECRET is not set in this shell", []);
+    }
+    const lines = parseCount("--lines", opts.lines);
+    if (lines < 1) throw new ValidationError3("--lines must be at least 1", []);
+    const client = getClientFromCommand(cmd);
+    const meeting = await client.get(`/meetings/${id}`);
+    const { status, botId } = meeting.recording;
+    if (status !== "scheduled" && status !== "recording" || botId === null) {
+      throw new ValidationError3(`Meeting ${id} has no bot to complete (status: ${status})`, []);
+    }
+    const segments = buildSimulatedSegments(simulatedSpeakers(meeting), lines);
+    const startedAt = meeting.startsAt ?? (/* @__PURE__ */ new Date()).toISOString();
+    const endedAt = new Date(
+      new Date(startedAt).getTime() + lines * SIMULATED_LINE_MS
+    ).toISOString();
+    const body = JSON.stringify({
+      botId,
+      transcript: {
+        fullText: segments.map((segment) => segment.text).join("\n"),
+        segments,
+        language: "fr",
+        startedAt,
+        endedAt
+      }
+    });
+    const response = await fetch(
+      `${getGlobalOptions(cmd).apiUrl}/meetings/transcripts/webhook/fake`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          [FAKE_MEETING_BOT_SIGNATURE_HEADER]: signFakeWebhook(secret, body)
+        },
+        body
+      }
+    );
+    if (!response.ok) {
+      throw new ValidationError3(`webhook answered ${response.status}`, []);
+    }
+    formatOutput({ botId, segments: segments.length }, getFormat(cmd));
+  });
 }
 
 // src/commands/pull.ts
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 
 // src/drift/reconciliation-prompt.ts
 var PREAMBLE = [
@@ -711,7 +1662,7 @@ function registerPullCommand(program) {
     try {
       client = getClientFromCommand(cmd);
     } catch (error) {
-      console.error(chalk6.red(`\u2717 ${messageOf(error)}`));
+      console.error(chalk7.red(`\u2717 ${messageOf(error)}`));
       process.exit(2);
       return;
     }
@@ -721,14 +1672,14 @@ function registerPullCommand(program) {
         console.info(JSON.stringify(state, null, 2));
         process.exit(0);
       } catch (error) {
-        console.error(chalk6.red(`\u2717 ${messageOf(error)}`));
+        console.error(chalk7.red(`\u2717 ${messageOf(error)}`));
         process.exit(2);
       }
       return;
     }
     const result = await runPullCommand(client);
     if (result.exitCode === 2) {
-      console.error(chalk6.red(`\u2717 ${result.errorMessage}`));
+      console.error(chalk7.red(`\u2717 ${result.errorMessage}`));
       process.exit(2);
       return;
     }
@@ -738,7 +1689,7 @@ function registerPullCommand(program) {
 }
 
 // src/commands/records.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { basename } from "path";
 function parseSortFlag(sort) {
   const [attribute, direction = "asc"] = sort.split(":");
@@ -804,7 +1755,7 @@ function registerRecordsCommand(program) {
     formatOutput(result, getFormat(cmd));
   });
   records.command("attach-document").description("Upload and attach a local file to a record").argument("<object>", "object name (e.g. contacts)").argument("<recordId>", "record ID").requiredOption("--file <path>", "local file path to upload").option("--attribute <attr>", "attribute name to attach the document to").option("--parent-id <folderId>", "parent folder ID").option("--title <title>", "document title (defaults to filename)").action(async (objectName, recordId, opts, cmd) => {
-    const fileContent = await readFile2(opts.file);
+    const fileContent = await readFile3(opts.file);
     const fileName = basename(opts.file);
     const title = opts.title ?? fileName;
     const form = new FormData();
@@ -824,129 +1775,7 @@ function registerRecordsCommand(program) {
 // src/commands/root.ts
 import { stdin as input, stdout as output } from "process";
 import { createInterface } from "readline/promises";
-import chalk7 from "chalk";
-
-// src/config.ts
-import { mkdir, readFile as readFile3, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
-var DEFAULT_API_URL = "http://localhost:4100/v1";
-var ENV_PROFILE_NAME = "sandbox";
-function getDefaultApiUrl() {
-  return DEFAULT_API_URL;
-}
-function getConfigPath() {
-  const configDir = process.env.STANDARDS_CONFIG_DIR ?? join(homedir(), ".standards");
-  return join(configDir, "config.json");
-}
-async function readConfig() {
-  try {
-    const raw = await readFile3(getConfigPath(), "utf8");
-    const parsed = JSON.parse(raw);
-    return {
-      currentProfile: parsed.currentProfile,
-      profiles: parsed.profiles ?? {}
-    };
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return { profiles: {} };
-    }
-    throw error;
-  }
-}
-async function writeConfig(config) {
-  const path = getConfigPath();
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(path, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
-}
-async function upsertProfile(input2) {
-  const config = await readConfig();
-  config.profiles[input2.name] = {
-    apiUrl: input2.apiUrl,
-    apiKey: input2.apiKey
-  };
-  config.currentProfile = input2.name;
-  await writeConfig(config);
-}
-async function setCurrentProfile(name) {
-  const config = await readConfig();
-  if (!config.profiles[name]) {
-    throw new Error(`Unknown Standards instance "${name}"`);
-  }
-  config.currentProfile = name;
-  await writeConfig(config);
-}
-async function removeProfile(name) {
-  const config = await readConfig();
-  const profileName = name ?? config.currentProfile;
-  if (!profileName) return;
-  delete config.profiles[profileName];
-  if (config.currentProfile === profileName) {
-    config.currentProfile = void 0;
-  }
-  await writeConfig(config);
-}
-async function listProfiles() {
-  const config = await readConfig();
-  const profiles = Object.entries(config.profiles).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({
-    name,
-    apiUrl: profile.apiUrl,
-    current: config.currentProfile === name
-  }));
-  const envProfile = getEnvProfile();
-  if (envProfile) {
-    profiles.push({
-      name: ENV_PROFILE_NAME,
-      apiUrl: envProfile.apiUrl,
-      current: !config.currentProfile,
-      source: "env"
-    });
-  }
-  return profiles;
-}
-async function getActiveProfile() {
-  const config = await readConfig();
-  if (!config.currentProfile) {
-    const envProfile = getEnvProfile();
-    return envProfile ? { name: ENV_PROFILE_NAME, ...envProfile } : null;
-  }
-  const profile = config.profiles[config.currentProfile];
-  if (!profile) return null;
-  return { name: config.currentProfile, ...profile };
-}
-function getEnvProfile() {
-  if (!process.env.STANDARDS_API_KEY) return null;
-  return {
-    apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
-    apiKey: process.env.STANDARDS_API_KEY
-  };
-}
-async function resolveCliConfig(options) {
-  if (options.apiUrl || options.apiKey) {
-    return {
-      apiUrl: options.apiUrl ?? process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
-      apiKey: options.apiKey ?? process.env.STANDARDS_API_KEY
-    };
-  }
-  const config = await readConfig();
-  const profileName = options.instance ?? config.currentProfile;
-  if (profileName) {
-    const profile = config.profiles[profileName];
-    if (!profile) throw new Error(`Unknown Standards instance "${profileName}"`);
-    return {
-      apiUrl: profile.apiUrl,
-      apiKey: profile.apiKey,
-      profileName
-    };
-  }
-  return {
-    apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
-    apiKey: process.env.STANDARDS_API_KEY
-  };
-}
-
-// src/commands/root.ts
+import chalk8 from "chalk";
 async function promptForMissingValue(label) {
   const rl = createInterface({ input, output });
   try {
@@ -964,7 +1793,7 @@ function registerRootCommands(program) {
     await client.get("/api-keys");
     await upsertProfile({ name: opts.name, apiUrl: opts.url, apiKey });
     process.stdout.write(
-      `${chalk7.green("\u2713")} Standards instance "${opts.name}" saved and selected.
+      `${chalk8.green("\u2713")} Standards instance "${opts.name}" saved and selected.
 `
     );
     process.stdout.write(`  API URL: ${opts.url}
@@ -976,7 +1805,7 @@ function registerRootCommands(program) {
   });
   program.command("use").description("Select the active Standards instance").argument("<name>", "instance name").action(async (name) => {
     await setCurrentProfile(name);
-    process.stdout.write(`${chalk7.green("\u2713")} Standards instance "${name}" selected.
+    process.stdout.write(`${chalk8.green("\u2713")} Standards instance "${name}" selected.
 `);
   });
   program.command("instances").description("List configured Standards instances").action(async (_opts, cmd) => {
@@ -995,7 +1824,7 @@ function registerRootCommands(program) {
   });
   program.command("logout").description("Remove a Standards instance from local CLI config").argument("[name]", "instance name, defaults to current").action(async (name) => {
     await removeProfile(name);
-    process.stdout.write(`${chalk7.green("\u2713")} Standards instance removed.
+    process.stdout.write(`${chalk8.green("\u2713")} Standards instance removed.
 `);
   });
 }
@@ -1016,7 +1845,7 @@ function registerSchemaCommand(program) {
 }
 
 // src/commands/search.ts
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 function registerSearchCommand(program) {
   const search = program.command("search").description("Maintain the Standards search index");
   search.command("reindex").description("Clear the tenant search index and re-inject every record").option("--yes", "reindex without confirmation").action(async (opts, cmd) => {
@@ -1025,16 +1854,14 @@ function registerSearchCommand(program) {
         'A full reindex clears the index before refilling it. Re-run with "--yes" to confirm.'
       );
     }
-    const { tenant } = getGlobalOptions(cmd);
-    if (!tenant) {
-      throw new Error(
-        'A full reindex names its tenant explicitly. Pass "--tenant <id>" with the tenant you are authenticated in.'
-      );
-    }
+    const tenant = requireTenant(
+      cmd,
+      'A full reindex names its tenant explicitly. Pass "--tenant <id>" with the tenant you are authenticated in.'
+    );
     const client = getClientFromCommand(cmd);
     await client.post("/admin/search/full-reindex", { tenantId: tenant });
     process.stdout.write(
-      `${chalk8.green("\u2713")} Full reindex accepted for tenant ${tenant}. It runs in the background \u2014 follow the server logs for progress.
+      `${chalk9.green("\u2713")} Full reindex accepted for tenant ${tenant}. It runs in the background \u2014 follow the server logs for progress.
 `
     );
   });
@@ -1054,6 +1881,7 @@ function createProgram() {
   registerSchemaCommand(program);
   registerPullCommand(program);
   registerDocumentsCommand(program);
+  registerDeviceCommand(program);
   registerFoldersCommand(program);
   registerKeysCommand(program);
   registerAuthCommand(program);
@@ -1062,6 +1890,7 @@ function createProgram() {
   registerMcpCommand(program);
   registerMeetingsCommand(program);
   registerSearchCommand(program);
+  registerEmbeddingsCommand(program);
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const raw = program.opts();
     const resolved = await resolveCliConfig({
@@ -1075,7 +1904,7 @@ function createProgram() {
     program.setOptionValue("tenant", raw.tenant);
     if (!(resolved.apiKey || isPublicCommand(actionCommand))) {
       console.error(
-        chalk9.red(
+        chalk10.red(
           `\u2717 Error: No Standards instance configured. Run "standards login" or pass --api-key.`
         )
       );
@@ -1089,12 +1918,12 @@ async function runProgram(argv = process.argv) {
   await program.parseAsync(argv).catch((error) => {
     if (error instanceof ApiClientError) {
       if (error.statusCode > 0) {
-        console.error(chalk9.red(`\u2717 Error (${error.statusCode}): ${error.message}`));
+        console.error(chalk10.red(`\u2717 Error (${error.statusCode}): ${error.message}`));
       } else {
-        console.error(chalk9.red(`\u2717 Error: ${error.message}`));
+        console.error(chalk10.red(`\u2717 Error: ${error.message}`));
       }
     } else if (error instanceof Error) {
-      console.error(chalk9.red(`\u2717 Error: ${error.message}`));
+      console.error(chalk10.red(`\u2717 Error: ${error.message}`));
     }
     process.exit(1);
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stndrds/cli",
-  "version": "1.0.0-alpha.292",
+  "version": "1.0.0-alpha.294",
   "description": "CLI tool to interact with Standards API",
   "type": "module",
   "bin": {
@@ -13,7 +13,7 @@
     "chalk": "^5.4.1",
     "cli-table3": "^0.6.5",
     "commander": "^13.1.0",
-    "@stndrds/schema": "1.0.0-alpha.292"
+    "@stndrds/schema": "1.0.0-alpha.294"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",