@tekmemo/cli 0.1.0

package/dist/runner-CiA5dFku.cjs

@@ -0,0 +1,3914 @@
+const require_chunk = require('./chunk-C0xms8kb.cjs');
+let _tekmemo_cloud_client = require("@tekmemo/cloud-client");
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = require_chunk.__toESM(node_fs_promises, 1);
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path, 1);
+let tekmemo = require("tekmemo");
+let node_crypto = require("node:crypto");
+let node_module = require("node:module");
+let commander = require("commander");
+let _tekmemo_agentfs = require("@tekmemo/agentfs");
+let _tekmemo_fs = require("@tekmemo/fs");
+let zod = require("zod");
+let node_readline_promises = require("node:readline/promises");
+node_readline_promises = require_chunk.__toESM(node_readline_promises, 1);
+
+//#region src/errors/cli-errors.ts
+var CliError = class extends Error {
+	code;
+	exitCode;
+	cause;
+	constructor(code, message, options) {
+		super(message);
+		this.name = this.constructor.name;
+		this.code = code;
+		this.exitCode = options?.exitCode ?? 1;
+		this.cause = options?.cause;
+	}
+};
+var CliUsageError = class extends CliError {
+	constructor(message, options) {
+		super("CLI_USAGE_ERROR", message, {
+			exitCode: 1,
+			cause: options?.cause
+		});
+	}
+};
+var CliValidationError = class extends CliError {
+	constructor(message, options) {
+		super("CLI_VALIDATION_ERROR", message, {
+			exitCode: 1,
+			cause: options?.cause
+		});
+	}
+};
+var CliFsError = class extends CliError {
+	constructor(message, options) {
+		super("CLI_FS_ERROR", message, {
+			exitCode: 1,
+			cause: options?.cause
+		});
+	}
+};
+var CliProtocolError = class extends CliError {
+	constructor(message, options) {
+		super("CLI_PROTOCOL_ERROR", message, {
+			exitCode: 1,
+			cause: options?.cause
+		});
+	}
+};
+var CliJsonlError = class extends CliError {
+	constructor(message, options) {
+		super("CLI_JSONL_ERROR", message, {
+			exitCode: 1,
+			cause: options?.cause
+		});
+	}
+};
+
+//#endregion
+//#region src/cloud/client.ts
+function createCliCloudClient(options = {}) {
+	return (0, _tekmemo_cloud_client.createTekMemoCloudClient)(toCloudClientOptions(options));
+}
+function toCloudClientOptions(options = {}) {
+	const normalized = normalizeCloudConnectionOptions(options);
+	return {
+		baseUrl: normalized.baseUrl,
+		...normalized.apiKey !== void 0 ? { apiKey: normalized.apiKey } : {},
+		...normalized.projectId !== void 0 ? { defaultProjectId: normalized.projectId } : {},
+		...normalized.workspaceId !== void 0 ? { defaultWorkspaceId: normalized.workspaceId } : {},
+		...normalized.timeoutMs !== void 0 ? { timeoutMs: normalized.timeoutMs } : {},
+		userAgent: "@tekmemo/cli",
+		requireApiKey: !options.allowMissingApiKey,
+		acceptLegacyEnvelope: false
+	};
+}
+function normalizeCloudConnectionOptions(options = {}) {
+	const baseUrl = firstNonEmpty$1(options.cloudUrl, process.env.TEKMEMO_CLOUD_URL, process.env.TEKMEMO_API_URL);
+	if (!baseUrl) throw new CliUsageError("TekMemo Cloud URL is required. Pass --cloud-url or set TEKMEMO_CLOUD_URL.");
+	const apiKey = firstNonEmpty$1(options.apiKey, process.env.TEKMEMO_API_KEY);
+	if (!apiKey && !options.allowMissingApiKey) throw new CliUsageError("TekMemo Cloud API key is required. Pass --api-key or set TEKMEMO_API_KEY.");
+	const workspaceId = firstNonEmpty$1(options.workspaceId, process.env.TEKMEMO_WORKSPACE_ID);
+	const projectId = firstNonEmpty$1(options.projectId, process.env.TEKMEMO_PROJECT_ID);
+	if (!projectId && !options.allowMissingProjectId) throw new CliUsageError("TekMemo Cloud project ID is required. Pass --project-id or set TEKMEMO_PROJECT_ID.");
+	const timeoutMs = normalizeTimeoutMs$1(options.timeoutMs);
+	return {
+		baseUrl,
+		...apiKey !== void 0 ? { apiKey } : {},
+		...workspaceId !== void 0 ? { workspaceId } : {},
+		...projectId !== void 0 ? { projectId } : {},
+		...timeoutMs !== void 0 ? { timeoutMs } : {}
+	};
+}
+function formatCloudError(error) {
+	if (error instanceof _tekmemo_cloud_client.TekMemoCloudError) {
+		const parts = [error.message];
+		if (error.status !== void 0) parts.push(`status=${error.status}`);
+		if (error.code) parts.push(`code=${error.code}`);
+		if (error.requestId) parts.push(`requestId=${error.requestId}`);
+		if (error.retryAfterMs !== void 0) parts.push(`retryAfterMs=${error.retryAfterMs}`);
+		return parts.join(" ");
+	}
+	return error instanceof Error ? error.message : String(error);
+}
+function cloudConnectionSummary(options) {
+	return {
+		baseUrl: options.baseUrl,
+		apiKey: options.apiKey ? (0, _tekmemo_cloud_client.redactSecrets)(options.apiKey, [options.apiKey]) : null,
+		workspaceId: options.workspaceId ?? null,
+		projectId: options.projectId ?? null,
+		timeoutMs: options.timeoutMs ?? null
+	};
+}
+function firstNonEmpty$1(...values) {
+	for (const value of values) {
+		const trimmed = value?.trim();
+		if (trimmed) return trimmed;
+	}
+}
+function normalizeTimeoutMs$1(value) {
+	if (value === void 0) return void 0;
+	if (typeof value === "number") {
+		if (!Number.isInteger(value) || value < 1) throw new CliUsageError("timeout must be a positive integer in milliseconds.");
+		return value;
+	}
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed) || parsed < 1) throw new CliUsageError("timeout must be a positive integer in milliseconds.");
+	return parsed;
+}
+
+//#endregion
+//#region src/config/runtime.ts
+async function resolveCliRuntimeConfig(input) {
+	const flags = input.flags ?? {};
+	const env = input.env ?? process.env;
+	const initialRoot = firstNonEmpty(flags.root, env.TEKMEMO_ROOT, input.cwd) ?? input.cwd;
+	const configPath = node_path.default.join(node_path.default.resolve(input.cwd, initialRoot), ".tekmemo", "config.json");
+	const config = await readOptionalConfig(configPath);
+	const configRoot = config.value?.root;
+	const root = node_path.default.resolve(input.cwd, firstNonEmpty(flags.root, env.TEKMEMO_ROOT, configRoot, initialRoot) ?? initialRoot);
+	const runtime = normalizeRuntime(firstNonEmpty(flags.runtime, env.TEKMEMO_RUNTIME, config.value?.runtime, "local"));
+	const readPolicy = normalizeReadPolicy(firstNonEmpty(flags.readPolicy, env.TEKMEMO_READ_POLICY, config.value?.hybrid?.readPolicy, "local-first"));
+	const writePolicy = normalizeWritePolicy(firstNonEmpty(flags.writePolicy, env.TEKMEMO_WRITE_POLICY, config.value?.hybrid?.writePolicy, "local-first"));
+	const timeoutMs = normalizeTimeoutMs(firstDefined(flags.timeoutMs, env.TEKMEMO_CLOUD_TIMEOUT_MS, config.value?.cloud?.timeoutMs));
+	return {
+		runtime,
+		root,
+		configPath,
+		configLoaded: config.loaded,
+		cloud: compactCloud({
+			cloudUrl: firstNonEmpty(flags.cloudUrl, env.TEKMEMO_CLOUD_URL, env.TEKMEMO_API_URL, config.value?.cloud?.baseUrl),
+			apiKey: firstNonEmpty(flags.apiKey, env.TEKMEMO_API_KEY),
+			workspaceId: firstNonEmpty(flags.workspaceId, env.TEKMEMO_WORKSPACE_ID, config.value?.cloud?.workspaceId),
+			projectId: firstNonEmpty(flags.projectId, env.TEKMEMO_PROJECT_ID, config.value?.cloud?.projectId),
+			...timeoutMs !== void 0 ? { timeoutMs } : {}
+		}),
+		hybrid: {
+			readPolicy,
+			writePolicy
+		}
+	};
+}
+async function writeDefaultCliConfig(input) {
+	const root = node_path.default.resolve(input.cwd, input.root ?? ".");
+	const configPath = node_path.default.join(root, ".tekmemo", "config.json");
+	await node_fs_promises.default.mkdir(node_path.default.dirname(configPath), { recursive: true });
+	const exists = await fileExists(configPath);
+	if (exists && !input.force) return {
+		path: configPath,
+		created: false,
+		overwritten: false
+	};
+	const config = input.config ?? {
+		version: 1,
+		runtime: "local",
+		root: "."
+	};
+	await node_fs_promises.default.writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+	return {
+		path: configPath,
+		created: !exists,
+		overwritten: exists
+	};
+}
+async function readOptionalConfig(configPath) {
+	try {
+		const raw = await node_fs_promises.default.readFile(configPath, "utf8");
+		return {
+			loaded: true,
+			value: validateConfig(JSON.parse(raw), configPath)
+		};
+	} catch (error) {
+		if (isNodeError$1(error) && error.code === "ENOENT") return { loaded: false };
+		if (error instanceof SyntaxError) throw new CliUsageError(`Invalid TekMemo config JSON at ${configPath}: ${error.message}`);
+		throw error;
+	}
+}
+function validateConfig(value, configPath) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CliUsageError(`TekMemo config must be an object: ${configPath}`);
+	const record = value;
+	if (record.runtime !== void 0) normalizeRuntime(record.runtime);
+	if (record.hybrid?.readPolicy !== void 0) normalizeReadPolicy(record.hybrid.readPolicy);
+	if (record.hybrid?.writePolicy !== void 0) normalizeWritePolicy(record.hybrid.writePolicy);
+	if (record.cloud?.timeoutMs !== void 0) normalizeTimeoutMs(record.cloud.timeoutMs);
+	return record;
+}
+function normalizeRuntime(value) {
+	if (value === "local" || value === "cloud" || value === "hybrid") return value;
+	throw new CliUsageError("runtime must be local, cloud, or hybrid.");
+}
+function normalizeReadPolicy(value) {
+	if (value === "local-first" || value === "cloud-first" || value === "local-only" || value === "cloud-only") return value;
+	throw new CliUsageError("read policy must be local-first, cloud-first, local-only, or cloud-only.");
+}
+function normalizeWritePolicy(value) {
+	if (value === "local-first" || value === "cloud-first" || value === "local-only" || value === "cloud-only") return value;
+	throw new CliUsageError("write policy must be local-first, cloud-first, local-only, or cloud-only.");
+}
+function normalizeTimeoutMs(value) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	const parsed = typeof value === "number" ? value : Number(value);
+	if (!Number.isInteger(parsed) || parsed < 1) throw new CliUsageError("cloud timeout must be a positive integer in milliseconds.");
+	return parsed;
+}
+function firstNonEmpty(...values) {
+	for (const value of values) {
+		if (typeof value !== "string") continue;
+		const trimmed = value.trim();
+		if (trimmed) return trimmed;
+	}
+}
+function firstDefined(...values) {
+	for (const value of values) if (value !== void 0) return value;
+}
+function compactCloud(input) {
+	return {
+		...input.cloudUrl !== void 0 ? { cloudUrl: input.cloudUrl } : {},
+		...input.apiKey !== void 0 ? { apiKey: input.apiKey } : {},
+		...input.workspaceId !== void 0 ? { workspaceId: input.workspaceId } : {},
+		...input.projectId !== void 0 ? { projectId: input.projectId } : {},
+		...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {}
+	};
+}
+async function fileExists(filePath) {
+	try {
+		await node_fs_promises.default.stat(filePath);
+		return true;
+	} catch (error) {
+		if (isNodeError$1(error) && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+function isNodeError$1(error) {
+	return error instanceof Error && "code" in error;
+}
+
+//#endregion
+//#region src/fs/paths.ts
+function normalizeRootDir(rootDir) {
+	if (typeof rootDir !== "string" || rootDir.trim().length === 0) throw new CliFsError("rootDir must be a non-empty string.");
+	if (rootDir.includes("\0")) throw new CliFsError("rootDir must not contain null bytes.");
+	return node_path.default.resolve(rootDir);
+}
+function resolveInsideRoot(rootDir, relativePath) {
+	if (typeof relativePath !== "string" || relativePath.trim().length === 0) throw new CliFsError("relativePath must be a non-empty string.");
+	if (relativePath.includes("\0")) throw new CliFsError("relativePath must not contain null bytes.");
+	if (node_path.default.isAbsolute(relativePath)) throw new CliFsError("relativePath must not be absolute.");
+	const normalized = relativePath.replaceAll("\\", "/");
+	if (normalized.split("/").includes("..")) throw new CliFsError("relativePath must not contain path traversal.");
+	const resolved = node_path.default.resolve(rootDir, normalized);
+	const relative = node_path.default.relative(rootDir, resolved);
+	if (relative.startsWith("..") || node_path.default.isAbsolute(relative)) throw new CliFsError("Resolved path escaped rootDir.");
+	return resolved;
+}
+
+//#endregion
+//#region src/fs/tekmemo-fs.ts
+var TekMemoFileSystem = class {
+	rootDir;
+	rejectSymlinkedTekMemoDir;
+	constructor(options) {
+		this.rootDir = normalizeRootDir(options.rootDir);
+		this.rejectSymlinkedTekMemoDir = options.rejectSymlinkedTekMemoDir ?? true;
+	}
+	resolve(relativePath) {
+		return resolveInsideRoot(this.rootDir, relativePath);
+	}
+	async ensureSafeRoot() {
+		await node_fs_promises.default.mkdir(this.rootDir, { recursive: true });
+		await this.rejectUnsafeTekMemoSymlinkIfNeeded();
+	}
+	async exists(relativePath) {
+		try {
+			await node_fs_promises.default.lstat(this.resolve(relativePath));
+			return true;
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return false;
+			throw new CliFsError(`Failed checking path "${relativePath}".`, { cause: error });
+		}
+	}
+	async readText(relativePath) {
+		try {
+			return await node_fs_promises.default.readFile(this.resolve(relativePath), "utf8");
+		} catch (error) {
+			throw new CliFsError(`Failed reading "${relativePath}".`, { cause: error });
+		}
+	}
+	async readTextIfExists(relativePath) {
+		try {
+			return await node_fs_promises.default.readFile(this.resolve(relativePath), "utf8");
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return void 0;
+			throw new CliFsError(`Failed reading "${relativePath}".`, { cause: error });
+		}
+	}
+	async writeText(relativePath, content) {
+		if (typeof content !== "string") throw new CliFsError("content must be a string.");
+		const target = this.resolve(relativePath);
+		const parent = node_path.default.dirname(target);
+		await node_fs_promises.default.mkdir(parent, { recursive: true });
+		const tmp = node_path.default.join(parent, `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+		try {
+			await node_fs_promises.default.writeFile(tmp, content, "utf8");
+			await node_fs_promises.default.rename(tmp, target);
+		} catch (error) {
+			await node_fs_promises.default.rm(tmp, { force: true }).catch(() => void 0);
+			throw new CliFsError(`Failed writing "${relativePath}".`, { cause: error });
+		}
+	}
+	async appendText(relativePath, content) {
+		if (typeof content !== "string") throw new CliFsError("content must be a string.");
+		const target = this.resolve(relativePath);
+		await node_fs_promises.default.mkdir(node_path.default.dirname(target), { recursive: true });
+		try {
+			await node_fs_promises.default.appendFile(target, content, "utf8");
+		} catch (error) {
+			throw new CliFsError(`Failed appending "${relativePath}".`, { cause: error });
+		}
+	}
+	async mkdir(relativePath) {
+		try {
+			await node_fs_promises.default.mkdir(this.resolve(relativePath), { recursive: true });
+		} catch (error) {
+			throw new CliFsError(`Failed creating directory "${relativePath}".`, { cause: error });
+		}
+	}
+	async stat(relativePath) {
+		try {
+			const stats = await node_fs_promises.default.lstat(this.resolve(relativePath));
+			return {
+				isFile: stats.isFile(),
+				isDirectory: stats.isDirectory(),
+				isSymbolicLink: stats.isSymbolicLink(),
+				size: stats.size
+			};
+		} catch (error) {
+			throw new CliFsError(`Failed stat for "${relativePath}".`, { cause: error });
+		}
+	}
+	async rejectUnsafeTekMemoSymlinkIfNeeded() {
+		if (!this.rejectSymlinkedTekMemoDir) return;
+		try {
+			if ((await node_fs_promises.default.lstat(this.resolve(".tekmemo"))).isSymbolicLink()) throw new CliFsError("Refusing to use symlinked .tekmemo directory.");
+		} catch (error) {
+			if (error instanceof CliFsError) throw error;
+			if (isNodeError(error) && error.code === "ENOENT") return;
+			throw new CliFsError("Failed checking .tekmemo directory safety.", { cause: error });
+		}
+	}
+};
+function isNodeError(error) {
+	return error instanceof Error && "code" in error;
+}
+
+//#endregion
+//#region src/output/output.ts
+const colors = {
+	reset: "\x1B[0m",
+	red: "\x1B[31m",
+	green: "\x1B[32m",
+	yellow: "\x1B[33m",
+	dim: "\x1B[2m"
+};
+function shouldDisableColor(noColor) {
+	if (noColor) return true;
+	if ("NO_COLOR" in process.env) return true;
+	if (process.env.TERM === "dumb") return true;
+	return false;
+}
+function createBufferedOutput(options) {
+	const stdout = [];
+	const stderr = [];
+	const c = shouldDisableColor(options?.noColor) ? {
+		red: "",
+		green: "",
+		yellow: "",
+		reset: "",
+		dim: ""
+	} : colors;
+	return {
+		stdout,
+		stderr,
+		write(message) {
+			stdout.push(message);
+		},
+		error(message) {
+			stderr.push(`${c.red}${message}${c.reset}`);
+		},
+		success(message) {
+			stdout.push(`${c.green}${message}${c.reset}`);
+		},
+		warn(message) {
+			stdout.push(`${c.yellow}${message}${c.reset}`);
+		}
+	};
+}
+function printHumanOrJson(output, value, human, json = false) {
+	if (json) {
+		output.write(JSON.stringify(value, null, 2));
+		return;
+	}
+	output.write(human);
+}
+function printJsonEnvelope(output, command, data) {
+	const envelope = {
+		ok: true,
+		command,
+		data
+	};
+	output.write(JSON.stringify(envelope, null, 2));
+}
+function printJsonError(output, command, code, message, details) {
+	const error = {
+		ok: false,
+		command,
+		error: {
+			code,
+			message,
+			...details !== void 0 ? { details } : {}
+		}
+	};
+	output.write(JSON.stringify(error, null, 2));
+}
+
+//#endregion
+//#region src/protocol/constants.ts
+/**
+* Flat CLI path map kept for command ergonomics.
+* The values intentionally come from `tekmemo`, so the CLI cannot drift from
+* the canonical protocol owned by the core package.
+*/
+const TEKMEMO_PATHS = {
+	manifest: tekmemo.MANIFEST_PATH,
+	coreMemory: tekmemo.CORE_MEMORY_PATH,
+	notesMemory: tekmemo.NOTES_MEMORY_PATH,
+	memoryEvents: tekmemo.MEMORY_EVENTS_PATH,
+	conversations: tekmemo.CONVERSATIONS_MEMORY_PATH,
+	chunks: tekmemo.CHUNKS_INDEX_PATH,
+	graphNodes: tekmemo.GRAPH_NODES_PATH,
+	graphEdges: tekmemo.GRAPH_EDGES_PATH,
+	snapshots: tekmemo.SNAPSHOTS_INDEX_PATH,
+	snapshotsDir: `${tekmemo.TEKMEMO_DIR}/snapshots`,
+	tmpDir: `${tekmemo.TEKMEMO_DIR}/tmp`
+};
+const REQUIRED_FILES = tekmemo.CANONICAL_TEKMEMO_FILES;
+const REQUIRED_DIRS = [
+	tekmemo.TEKMEMO_DIR,
+	`${tekmemo.TEKMEMO_DIR}/memory`,
+	`${tekmemo.TEKMEMO_DIR}/events`,
+	`${tekmemo.TEKMEMO_DIR}/indexes`,
+	`${tekmemo.TEKMEMO_DIR}/graph`,
+	`${tekmemo.TEKMEMO_DIR}/snapshots`,
+	`${tekmemo.TEKMEMO_DIR}/tmp`
+];
+
+//#endregion
+//#region src/protocol/jsonl.ts
+function parseJsonl(content, options) {
+	const strict = options?.strict ?? false;
+	const records = [];
+	content.split(/\r?\n/).forEach((line, index) => {
+		const lineNumber = index + 1;
+		const trimmed = line.trim();
+		if (trimmed.length === 0) return;
+		try {
+			const parsed = JSON.parse(trimmed);
+			if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new CliJsonlError(`Line ${lineNumber} is not a JSON object.`);
+			records.push({
+				line: lineNumber,
+				value: parsed
+			});
+		} catch (error) {
+			if (strict) {
+				if (error instanceof CliJsonlError) throw error;
+				throw new CliJsonlError(`Line ${lineNumber} is invalid JSON.`, { cause: error });
+			}
+		}
+	});
+	return records;
+}
+function stringifyJsonl(records) {
+	return records.map((record) => JSON.stringify(record)).join("\n") + (records.length > 0 ? "\n" : "");
+}
+
+//#endregion
+//#region src/protocol/manifest.ts
+function createDefaultManifest(input) {
+	return (0, tekmemo.createDefaultTekMemoManifest)({
+		projectId: input?.projectId ?? `proj_${(0, node_crypto.randomUUID)()}`,
+		...input?.now !== void 0 ? { now: () => input.now } : {}
+	});
+}
+function parseManifest(content) {
+	try {
+		return (0, tekmemo.parseManifest)(content);
+	} catch (error) {
+		throw new CliProtocolError(`manifest.json is invalid: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+}
+function validateManifest(value) {
+	try {
+		return (0, tekmemo.validateTekMemoManifest)(value);
+	} catch (error) {
+		throw new CliProtocolError(`manifest.json is invalid: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+}
+
+//#endregion
+//#region src/protocol/summary.ts
+async function inspectTekMemo(fs) {
+	const exists = await fs.exists(".tekmemo");
+	const manifestContent = await fs.readTextIfExists(TEKMEMO_PATHS.manifest);
+	const manifest = manifestContent === void 0 ? void 0 : parseManifest(manifestContent);
+	const tracked = [
+		TEKMEMO_PATHS.manifest,
+		TEKMEMO_PATHS.coreMemory,
+		TEKMEMO_PATHS.notesMemory,
+		TEKMEMO_PATHS.memoryEvents,
+		TEKMEMO_PATHS.conversations,
+		TEKMEMO_PATHS.chunks,
+		TEKMEMO_PATHS.graphNodes,
+		TEKMEMO_PATHS.graphEdges,
+		TEKMEMO_PATHS.snapshots
+	];
+	const files = [];
+	const recordCounts = {};
+	for (const filePath of tracked) {
+		const content = await fs.readTextIfExists(filePath);
+		const isJsonl = filePath.endsWith(".jsonl");
+		let records = 0;
+		if (content !== void 0 && isJsonl) {
+			records = parseJsonl(content, { strict: false }).length;
+			recordCounts[filePath] = records;
+		}
+		files.push({
+			path: filePath,
+			exists: content !== void 0,
+			bytes: content ? Buffer.byteLength(content) : 0,
+			...content !== void 0 ? { lines: content.split(/\r?\n/).filter(Boolean).length } : {},
+			...content !== void 0 && isJsonl ? { records } : {}
+		});
+	}
+	return {
+		rootDir: fs.rootDir,
+		exists,
+		...manifest ? { manifest } : {},
+		files,
+		summary: {
+			eventCount: recordCounts[TEKMEMO_PATHS.memoryEvents] ?? 0,
+			conversationCount: recordCounts[TEKMEMO_PATHS.conversations] ?? 0,
+			chunkCount: recordCounts[TEKMEMO_PATHS.chunks] ?? 0,
+			graphNodeCount: recordCounts[TEKMEMO_PATHS.graphNodes] ?? 0,
+			graphEdgeCount: recordCounts[TEKMEMO_PATHS.graphEdges] ?? 0,
+			snapshotCount: recordCounts[TEKMEMO_PATHS.snapshots] ?? 0
+		}
+	};
+}
+
+//#endregion
+//#region src/commands/agent.ts
+const LATEST_AGENT_SESSION_PATH = `${TEKMEMO_PATHS.tmpDir}/agent-sessions/latest.json`;
+/**
+* Starts a local AgentFS-style session workspace.
+*
+* @param options - Command options.
+* @returns CLI exit code.
+*/
+async function runAgentStartCommand(options) {
+	const session = (0, _tekmemo_agentfs.createTekMemoAgentSession)({
+		client: createLocalAgentfsClient(options.fs),
+		memory: (0, _tekmemo_fs.createNodeFsMemoryStore)({
+			rootDir: options.fs.rootDir,
+			missingFileBehavior: "empty",
+			createRoot: true
+		}),
+		task: options.task,
+		projectId: options.projectId,
+		actorId: options.actorId,
+		sessionId: options.sessionId
+	});
+	await session.prepare();
+	const pointer = {
+		sessionId: session.sessionId,
+		projectId: options.projectId ?? null,
+		root: session.paths.root,
+		task: options.task,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		paths: session.paths
+	};
+	await options.fs.writeText(LATEST_AGENT_SESSION_PATH, `${JSON.stringify(pointer, null, 2)}\n`);
+	if (options.json) {
+		printJsonEnvelope(options.output, "agent.start", pointer);
+		return 0;
+	}
+	options.output.success(`Started TekMemo agent session ${session.sessionId}`);
+	options.output.write(formatAgentInstructions(pointer));
+	return 0;
+}
+/**
+* Prints paths for a known agent session.
+*
+* @param options - Command options.
+* @returns CLI exit code.
+*/
+async function runAgentPathsCommand(options) {
+	const pointer = await readSessionPointer(options.fs, options.session);
+	if (options.json) {
+		printJsonEnvelope(options.output, "agent.paths", pointer);
+		return 0;
+	}
+	options.output.write(formatAgentInstructions(pointer));
+	return 0;
+}
+/**
+* Extracts output files from an agent session.
+*
+* @param options - Command options.
+* @returns CLI exit code.
+*/
+async function runAgentExtractCommand(options) {
+	const pointer = await readSessionPointer(options.fs, options.session);
+	const extracted = await (0, _tekmemo_agentfs.extractSessionMemory)(createLocalAgentfsClient(options.fs), pointer.paths);
+	if (options.json) {
+		printJsonEnvelope(options.output, "agent.extract", {
+			sessionId: pointer.sessionId,
+			extracted
+		});
+		return 0;
+	}
+	options.output.write([
+		`# TekMemo Agent Session ${pointer.sessionId}`,
+		"",
+		"## Summary",
+		extracted.summary || "No summary written.",
+		"",
+		"## Durable Memory",
+		extracted.durableMemory || "No durable memory written.",
+		"",
+		"## Follow-ups",
+		extracted.followUps || "No follow-ups written."
+	].join("\n"));
+	return 0;
+}
+/**
+* Completes an agent session and optionally persists durable memory locally.
+*
+* @param options - Command options.
+* @returns CLI exit code.
+*/
+async function runAgentCompleteCommand(options) {
+	const pointer = await readSessionPointer(options.fs, options.session);
+	const result = await (0, _tekmemo_agentfs.createTekMemoAgentSession)({
+		client: createLocalAgentfsClient(options.fs),
+		memory: (0, _tekmemo_fs.createNodeFsMemoryStore)({
+			rootDir: options.fs.rootDir,
+			missingFileBehavior: "empty",
+			createRoot: true
+		}),
+		task: pointer.task,
+		projectId: pointer.projectId ?? void 0,
+		sessionId: pointer.sessionId
+	}).complete({
+		extractDurableMemory: options.extract ?? false,
+		checkpointLabel: options.checkpointLabel
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "agent.complete", {
+			sessionId: pointer.sessionId,
+			...result
+		});
+		return 0;
+	}
+	options.output.success(`Completed TekMemo agent session ${pointer.sessionId}`);
+	if (result.durableMemoryWritten) options.output.success("Persisted extracted durable memory to notes.");
+	options.output.write(`Summary: ${result.extracted.summary || "No summary written."}`);
+	return 0;
+}
+/**
+* Adapts the CLI filesystem to the AgentFS-like client contract.
+*
+* @param fs - CLI filesystem.
+* @returns AgentFS-like client.
+*/
+function createLocalAgentfsClient(fs) {
+	return {
+		readText(path) {
+			return fs.readText(toRelativeAgentPath(path));
+		},
+		writeText(path, content) {
+			return fs.writeText(toRelativeAgentPath(path), content);
+		},
+		appendText(path, content) {
+			return fs.appendText(toRelativeAgentPath(path), content);
+		},
+		exists(path) {
+			return fs.exists(toRelativeAgentPath(path));
+		},
+		sync: {
+			pull: async () => {},
+			push: async () => {},
+			checkpoint: async () => {}
+		}
+	};
+}
+/**
+* Converts AgentFS absolute-ish paths into project-relative CLI paths.
+*
+* @param path - AgentFS path.
+* @returns Project-relative path.
+*/
+function toRelativeAgentPath(path) {
+	return path.replace(/^\/+/, "");
+}
+/**
+* Reads a session pointer from `.tekmemo/tmp`.
+*
+* @param fs - CLI filesystem.
+* @param session - Session ID or latest.
+* @returns Session pointer.
+*/
+async function readSessionPointer(fs, session) {
+	const latest = await fs.readText(LATEST_AGENT_SESSION_PATH);
+	const pointer = JSON.parse(latest);
+	if (!session || session === "latest" || session === pointer.sessionId) return pointer;
+	throw new Error(`Unknown session "${session}". Only latest session ${pointer.sessionId} is tracked locally.`);
+}
+/**
+* Formats agent-facing instructions for Codex, Claude Code, or any file-native agent.
+*
+* @param pointer - Session pointer.
+* @returns Markdown instructions.
+*/
+function formatAgentInstructions(pointer) {
+	return [
+		"",
+		"## Agent Instructions",
+		`Session: ${pointer.sessionId}`,
+		`Task: ${pointer.task}`,
+		"",
+		"Read before editing:",
+		`- ${pointer.paths.context.core}`,
+		`- ${pointer.paths.context.notes}`,
+		"",
+		"Update during work:",
+		`- ${pointer.paths.working.plan}`,
+		`- ${pointer.paths.working.commands}`,
+		`- ${pointer.paths.working.errors}`,
+		`- ${pointer.paths.working.changes}`,
+		"",
+		"Write before finishing:",
+		`- ${pointer.paths.output.summary}`,
+		`- ${pointer.paths.output.durableMemory}`,
+		`- ${pointer.paths.output.followUps}`,
+		""
+	].join("\n");
+}
+
+//#endregion
+//#region src/commands/chunks.ts
+async function runChunksCommand(options) {
+	const content = await options.fs.readTextIfExists(TEKMEMO_PATHS.chunks);
+	const records = content ? parseJsonl(content, { strict: options.strict ?? false }) : [];
+	const selected = options.limit && options.limit > 0 ? records.slice(-options.limit) : records;
+	if (options.json) {
+		options.output.write(JSON.stringify(selected, null, 2));
+		return 0;
+	}
+	if (selected.length === 0) {
+		options.output.write("No chunk records found.");
+		return 0;
+	}
+	options.output.write(selected.map((record) => {
+		const id = typeof record.value.id === "string" ? record.value.id : typeof record.value.chunkId === "string" ? record.value.chunkId : `line ${record.line}`;
+		const source = typeof record.value.sourcePath === "string" ? record.value.sourcePath : "unknown source";
+		return `${id} ${typeof record.value.status === "string" ? record.value.status : typeof record.value.indexStatus === "string" ? record.value.indexStatus : "unknown"} ${source}`;
+	}).join("\n"));
+	return 0;
+}
+
+//#endregion
+//#region src/utils/content.ts
+async function resolveCommandContent(input) {
+	const sources = [
+		input.inline !== void 0,
+		input.stdin === true,
+		input.file !== void 0
+	].filter(Boolean).length;
+	if (sources === 0) throw new CliUsageError("Provide content as an argument, --stdin, or --file <path>.");
+	if (sources > 1) throw new CliUsageError("Use only one content source: argument, --stdin, or --file.");
+	let content;
+	if (input.inline !== void 0) content = input.inline;
+	else if (input.file !== void 0) {
+		const path = resolveInsideRoot(input.rootDir, input.file);
+		content = await node_fs_promises.default.readFile(path, "utf8");
+	} else content = input.stdinContent ?? await readStdin();
+	if (content.includes("\0")) throw new CliUsageError("Content must not contain null bytes.");
+	if (content.trim().length === 0) throw new CliUsageError("Content must not be empty.");
+	return content.trimEnd();
+}
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+	return Buffer.concat(chunks).toString("utf8");
+}
+
+//#endregion
+//#region src/utils/metadata.ts
+function parseMetadataJson(value) {
+	if (value === void 0 || value.trim().length === 0) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch (error) {
+		throw new CliUsageError(`metadata must be valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new CliUsageError("metadata must be a JSON object.");
+	assertJsonSerializable(parsed, "metadata");
+	return parsed;
+}
+function assertJsonSerializable(value, name = "value") {
+	try {
+		JSON.stringify(value);
+	} catch (error) {
+		throw new CliUsageError(`${name} must be JSON serializable.`, { cause: error });
+	}
+}
+
+//#endregion
+//#region src/utils/numbers.ts
+function parseNonNegativeInteger(value, name = "value") {
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isFinite(parsed) || parsed < 0 || String(parsed) !== String(value).trim()) throw new CliUsageError(`${name} must be a non-negative integer.`);
+	return parsed;
+}
+function parsePositiveInteger(value, name = "value") {
+	const parsed = parseNonNegativeInteger(value, name);
+	if (parsed === 0) throw new CliUsageError(`${name} must be greater than 0.`);
+	return parsed;
+}
+function parseConfidence(value) {
+	const parsed = Number.parseFloat(value);
+	if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) throw new CliUsageError("confidence must be a number between 0 and 1.");
+	return parsed;
+}
+
+//#endregion
+//#region src/utils/secrets.ts
+const SECRET_PATTERNS = [
+	{
+		kind: "env_assignment_secret",
+		pattern: /\b[A-Z0-9_]*(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PRIVATE[_-]?KEY)[A-Z0-9_]*\s*=\s*[^\s]+/gi
+	},
+	{
+		kind: "openai_key",
+		pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g
+	},
+	{
+		kind: "github_token",
+		pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g
+	},
+	{
+		kind: "jwt",
+		pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g
+	},
+	{
+		kind: "pem_private_key",
+		pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g
+	}
+];
+function scanForSecrets(content) {
+	const findings = [];
+	for (const { kind, pattern } of SECRET_PATTERNS) {
+		pattern.lastIndex = 0;
+		let match = pattern.exec(content);
+		while (match !== null) {
+			findings.push({
+				kind,
+				index: match.index,
+				preview: redactSecretPreview(match[0])
+			});
+			match = pattern.exec(content);
+		}
+	}
+	return findings;
+}
+function redactSecretPreview(value) {
+	const trimmed = value.trim();
+	if (trimmed.length <= 8) return "[redacted]";
+	return `${trimmed.slice(0, 4)}…${trimmed.slice(-4)}`;
+}
+
+//#endregion
+//#region src/commands/cloud.ts
+const MEMORY_KINDS = new Set([
+	"decision",
+	"constraint",
+	"goal",
+	"preference",
+	"reference",
+	"summary",
+	"note"
+]);
+const RECALL_STRATEGIES = new Set([
+	"local",
+	"vector",
+	"hybrid"
+]);
+const RECALL_FALLBACKS = new Set(["none", "local"]);
+const INDEX_MODES = new Set([
+	"all",
+	"changed",
+	"core",
+	"notes"
+]);
+const CONFLICT_RESOLUTIONS = new Set([
+	"keep_cloud",
+	"use_client",
+	"ignore"
+]);
+async function runCloudHealthCommand(options) {
+	const result = await createCloudClient(options, true, true).health();
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.health", result);
+		return 0;
+	}
+	options.output.write([
+		"TekMemo Cloud",
+		`ok: ${result.ok}`,
+		`name: ${result.name ?? "unknown"}`,
+		`version: ${result.version ?? "unknown"}`,
+		`capabilities: ${(result.capabilities ?? []).join(", ") || "none"}`,
+		...result.warnings?.length ? result.warnings.map((warning) => `warning: ${warning}`) : []
+	].join("\n"));
+	return result.ok ? 0 : 1;
+}
+async function runCloudContextCommand(options) {
+	const client = createCloudClient(options);
+	const topK = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const maxBytes = normalizeOptionalPositiveInteger(options.maxBytes, "max bytes");
+	const includeCore = options.includeCore !== false;
+	const includeNotes = options.includeNotes !== false;
+	const includeRecent = options.includeRecent !== false;
+	const sections = [];
+	const data = {
+		query: options.query,
+		sections: []
+	};
+	if (includeCore) {
+		const core = await client.memory.readCore();
+		sections.push(`# Core Memory\n\n${core.content.trim()}`);
+		data.sections.push({
+			type: "core",
+			content: core.content
+		});
+	}
+	if (includeNotes || includeRecent) {
+		const notes = await client.memory.listNotes({ limit: topK ?? 10 });
+		const renderedNotes = notes.items.map(renderNote).join("\n\n");
+		sections.push(`# Notes\n\n${renderedNotes || "No cloud notes found."}`);
+		data.sections.push({
+			type: "notes",
+			items: notes.items,
+			nextCursor: notes.nextCursor
+		});
+	}
+	const recall = await client.recall.query({
+		query: options.query,
+		...topK !== void 0 ? { topK } : {},
+		strategy: "hybrid",
+		fallback: "local",
+		rerank: true
+	});
+	sections.push(`# Recall\n\n${renderRecallHits(recall.items)}`);
+	data.sections.push({
+		type: "recall",
+		result: recall
+	});
+	const text = truncateText(sections.filter(Boolean).join("\n\n---\n\n"), maxBytes);
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.context", {
+			...data,
+			text,
+			truncated: maxBytes !== void 0 && text.length >= maxBytes
+		});
+		return 0;
+	}
+	options.output.write(text.trimEnd());
+	return 0;
+}
+async function runCloudRecallCommand(options) {
+	const client = createCloudClient(options);
+	const topK = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const strategy = normalizeRecallStrategy(options.strategy);
+	const fallback = normalizeRecallFallback(options.fallback);
+	const result = await client.recall.query({
+		query: options.query,
+		...topK !== void 0 ? { topK } : {},
+		...strategy !== void 0 ? { strategy } : {},
+		...fallback !== void 0 ? { fallback } : {},
+		...options.rerank !== void 0 ? { rerank: options.rerank } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.recall", result);
+		return 0;
+	}
+	options.output.write(renderRecallHits(result.items));
+	return 0;
+}
+async function runCloudRecallIndexCommand(options) {
+	const client = createCloudClient(options);
+	const mode = normalizeIndexMode(options.mode);
+	const result = await client.recall.index({
+		...mode !== void 0 ? { mode } : {},
+		...options.force !== void 0 ? { force: options.force } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.recall.index", result);
+		return 0;
+	}
+	options.output.success(`Recall indexing ${result.status}${result.jobId ? ` job=${result.jobId}` : ""}`);
+	if (result.indexed !== void 0) options.output.write(`indexed: ${result.indexed}`);
+	for (const warning of result.warnings ?? []) options.output.warn(`warning: ${warning}`);
+	return 0;
+}
+async function runCloudRememberCommand(options) {
+	const client = createCloudClient(options);
+	const content = await resolveCommandContent({
+		rootDir: options.rootDir ?? process.cwd(),
+		inline: options.content,
+		stdin: options.stdin,
+		file: options.file,
+		stdinContent: options.stdinContent
+	});
+	const findings = scanForSecrets(content);
+	if (findings.length > 0 && !options.allowSecrets) {
+		const data = {
+			stored: false,
+			secretFindings: findings
+		};
+		if (options.json) printJsonEnvelope(options.output, "cloud.remember", data);
+		else options.output.error(`Refusing to store possible secret (${findings[0]?.kind}). Use --allow-secrets only after review.`);
+		return 1;
+	}
+	const metadata = parseMetadataJson(options.metadata);
+	const note = {
+		content,
+		kind: normalizeMemoryKind(options.kind),
+		...options.title ? { title: options.title } : {},
+		...options.tags?.length ? { tags: options.tags.map((tag) => tag.trim()).filter(Boolean) } : {},
+		...options.source ? { source: options.source } : {},
+		...options.confidence !== void 0 ? { confidence: normalizeConfidence(options.confidence) } : {},
+		...metadata ? { metadata } : {}
+	};
+	const result = await client.memory.createNote(note);
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.remember", {
+			...result,
+			secretFindings: findings
+		});
+		return 0;
+	}
+	options.output.success(`Stored cloud memory ${result.id}`);
+	return 0;
+}
+async function runCloudReadCommand(options) {
+	const client = createCloudClient(options);
+	if (options.target === "core") {
+		const result = await client.memory.readCore();
+		if (options.json) printJsonEnvelope(options.output, "cloud.read", {
+			target: "core",
+			...result
+		});
+		else options.output.write(result.content.trimEnd());
+		return 0;
+	}
+	const limit = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const result = await client.memory.listNotes({ ...limit !== void 0 ? { limit } : {} });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.read", {
+			target: "notes",
+			...result
+		});
+		return 0;
+	}
+	options.output.write(result.items.map(renderNote).join("\n\n") || "No cloud notes found.");
+	return 0;
+}
+async function runCloudUpdateCoreCommand(options) {
+	const client = createCloudClient(options);
+	const content = await resolveCommandContent({
+		rootDir: options.rootDir ?? process.cwd(),
+		inline: options.content,
+		stdin: options.stdin,
+		file: options.file,
+		stdinContent: options.stdinContent
+	});
+	const findings = scanForSecrets(content);
+	if (findings.length > 0 && !options.allowSecrets) {
+		const data = {
+			updated: false,
+			secretFindings: findings
+		};
+		if (options.json) printJsonEnvelope(options.output, "cloud.update-core", data);
+		else options.output.error(`Refusing to store possible secret (${findings[0]?.kind}). Use --allow-secrets only after review.`);
+		return 1;
+	}
+	const result = await client.memory.updateCore({ content });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.update-core", {
+			...result,
+			secretFindings: findings
+		});
+		return 0;
+	}
+	options.output.success("Updated cloud core memory.");
+	return 0;
+}
+async function runCloudRecentCommand(options) {
+	return runCloudReadCommand({
+		...options,
+		target: "notes"
+	});
+}
+async function runCloudValidateCommand(options) {
+	const client = createCloudClient(options);
+	const errors = [];
+	const warnings = [];
+	let healthOk = false;
+	try {
+		const health = await client.health();
+		healthOk = health.ok;
+		for (const warning of health.warnings ?? []) warnings.push(warning);
+		if (!health.ok) errors.push("Cloud health check returned ok=false.");
+	} catch (error) {
+		errors.push(`health: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	try {
+		await client.memory.readCore();
+	} catch (error) {
+		errors.push(`memory/core: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (options.strict) try {
+		await client.memory.listNotes({ limit: 1 });
+	} catch (error) {
+		errors.push(`memory/notes: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const result = {
+		ok: healthOk && errors.length === 0,
+		warnings,
+		errors
+	};
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.validate", result);
+		return result.ok ? 0 : 1;
+	}
+	if (result.ok) options.output.success("Cloud memory is valid.");
+	else options.output.error("Cloud memory validation failed.");
+	for (const warning of warnings) options.output.warn(`warning: ${warning}`);
+	for (const error of errors) options.output.error(`error: ${error}`);
+	return result.ok ? 0 : 1;
+}
+async function runCloudSnapshotCommand(options) {
+	const data = {
+		created: false,
+		reason: "cloud_snapshots_not_available",
+		message: "Cloud snapshots/exports are planned for the R2 milestone and are not exposed by the current project-scoped Cloud API.",
+		label: options.label ?? "manual",
+		type: options.type ?? "manual"
+	};
+	if (options.json) printJsonEnvelope(options.output, "cloud.snapshot", data);
+	else options.output.error(data.message);
+	return 2;
+}
+async function runCloudSyncStatusCommand(options) {
+	const result = await createCloudClient(options).sync.status({ ...options.clientId ? { clientId: options.clientId } : {} });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.sync.status", result);
+		return 0;
+	}
+	options.output.write([
+		`serverVersion: ${result.serverVersion}`,
+		`openConflicts: ${result.openConflicts}`,
+		`clients: ${result.clients.length}`,
+		...result.recentEvents !== void 0 ? [`recentEvents: ${result.recentEvents}`] : []
+	].join("\n"));
+	return 0;
+}
+async function runCloudSyncPullCommand(options) {
+	const client = createCloudClient(options);
+	const sinceServerVersion = normalizeOptionalNonNegativeInteger(options.sinceServerVersion, "since server version");
+	const limit = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const result = await client.sync.pull({
+		clientId: options.clientId,
+		...sinceServerVersion !== void 0 ? { sinceServerVersion } : {},
+		...limit !== void 0 ? { limit } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.sync.pull", result);
+		return 0;
+	}
+	options.output.write(`Pulled ${result.events.length} event(s). serverVersion=${result.serverVersion}`);
+	return 0;
+}
+async function runCloudSyncPushCommand(options) {
+	const client = createCloudClient(options);
+	const payload = await resolveJsonPayload({
+		rootDir: options.rootDir ?? process.cwd(),
+		inline: options.eventsJson,
+		stdin: options.stdin,
+		file: options.file,
+		stdinContent: options.stdinContent,
+		fieldName: "events JSON"
+	});
+	const events = extractSyncEvents(payload);
+	const checkpoint = options.checkpointJson ? parseJsonObject(options.checkpointJson, "checkpoint JSON") : extractCheckpoint(payload);
+	const result = await client.sync.push({
+		clientId: options.clientId,
+		events,
+		...checkpoint !== void 0 ? { checkpoint } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.sync.push", result);
+		return 0;
+	}
+	options.output.write([
+		`accepted: ${result.accepted.length}`,
+		`duplicates: ${result.duplicates.length}`,
+		`rejected: ${result.rejected.length}`,
+		`conflicts: ${result.conflicts.length}`,
+		`serverVersion: ${result.serverVersion}`
+	].join("\n"));
+	return result.rejected.length === 0 && result.conflicts.length === 0 ? 0 : 1;
+}
+async function runCloudSyncResolveCommand(options) {
+	const client = createCloudClient(options);
+	const resolution = normalizeConflictResolution(options.resolution);
+	const content = options.contentJson ? parseJsonObject(options.contentJson, "content JSON") : void 0;
+	const result = await client.sync.resolveConflict({
+		conflictId: options.conflictId,
+		resolution,
+		...content !== void 0 ? { content } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.sync.resolve", result);
+		return 0;
+	}
+	options.output.success(`Resolved conflict ${result.conflictId}`);
+	if (result.serverVersion !== void 0) options.output.write(`serverVersion: ${result.serverVersion}`);
+	return result.resolved ? 0 : 1;
+}
+async function runCloudReadinessCommand(options) {
+	const result = await createCloudClient(options, true, true).readiness();
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.readiness", result);
+		return 0;
+	}
+	options.output.write([
+		`ok: ${result.ok}`,
+		`name: ${result.name ?? "unknown"}`,
+		`version: ${result.version ?? "unknown"}`,
+		`capabilities: ${(result.capabilities ?? []).join(", ") || "none"}`,
+		...result.warnings?.length ? result.warnings.map((warning) => `warning: ${warning}`) : []
+	].join("\n"));
+	return result.ok ? 0 : 1;
+}
+async function runCloudContextComposeCommand(options) {
+	const client = createCloudClient(options);
+	const topK = normalizeOptionalPositiveInteger(options.topK, "topK");
+	const result = await client.context.compose({
+		query: options.query,
+		...topK !== void 0 ? { topK } : {},
+		...options.strategy !== void 0 ? { strategy: options.strategy } : {},
+		...options.rerank !== void 0 ? { rerank: options.rerank } : {},
+		...options.includeCoreMemory !== void 0 ? { includeCoreMemory: options.includeCoreMemory } : {},
+		...options.includeRecallResults !== void 0 ? { includeRecallResults: options.includeRecallResults } : {},
+		...options.includeGraphContext !== void 0 ? { includeGraphContext: options.includeGraphContext } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.context.compose", result);
+		return 0;
+	}
+	options.output.write(result.context);
+	return 0;
+}
+async function runCloudGraphListNodesCommand(options) {
+	const client = createCloudClient(options);
+	const limit = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const result = await client.graph.listNodes({
+		...limit !== void 0 ? { limit } : {},
+		...options.cursor ? { cursor: options.cursor } : {},
+		...options.status ? { status: options.status } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.graph.list-nodes", result);
+		return 0;
+	}
+	options.output.write(result.items.map((node) => `Node: ${node.nodeId} - ${node.label}`).join("\n") || "No nodes found.");
+	return 0;
+}
+async function runCloudGraphCreateNodeCommand(options) {
+	const client = createCloudClient(options);
+	const metadata = options.metadataJson ? parseJsonObject(options.metadataJson, "metadata JSON") : void 0;
+	const result = await client.graph.createNode({
+		nodeId: options.nodeId,
+		type: options.type,
+		label: options.label,
+		...options.summary ? { summary: options.summary } : {},
+		...options.aliases ? { aliases: options.aliases } : {},
+		...metadata ? { metadata } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.graph.create-node", result);
+		return 0;
+	}
+	options.output.success(`Created node ${result.nodeId}`);
+	return 0;
+}
+async function runCloudGraphListEdgesCommand(options) {
+	const client = createCloudClient(options);
+	const limit = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const result = await client.graph.listEdges({
+		...limit !== void 0 ? { limit } : {},
+		...options.cursor ? { cursor: options.cursor } : {},
+		...options.status ? { status: options.status } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.graph.list-edges", result);
+		return 0;
+	}
+	options.output.write(result.items.map((edge) => `Edge: ${edge.edgeId ?? "(new)"} - ${edge.fromNodeId} -> ${edge.toNodeId}`).join("\n") || "No edges found.");
+	return 0;
+}
+async function runCloudGraphCreateEdgeCommand(options) {
+	const client = createCloudClient(options);
+	const metadata = options.metadataJson ? parseJsonObject(options.metadataJson, "metadata JSON") : void 0;
+	const weight = options.weight !== void 0 ? parseFloat(String(options.weight)) : void 0;
+	const result = await client.graph.createEdge({
+		...options.edgeId ? { edgeId: options.edgeId } : {},
+		fromNodeId: options.fromNodeId,
+		toNodeId: options.toNodeId,
+		type: options.type,
+		...options.directed !== void 0 ? { directed: options.directed } : {},
+		...weight !== void 0 ? { weight } : {},
+		...metadata ? { metadata } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.graph.create-edge", result);
+		return 0;
+	}
+	options.output.success(`Created edge ${result.edgeId ?? "(new)"}`);
+	return 0;
+}
+async function runCloudGraphNeighborsCommand(options) {
+	const client = createCloudClient(options);
+	const depth = options.depth !== void 0 ? parseInt(String(options.depth), 10) : void 0;
+	const limit = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const result = await client.graph.neighbors({
+		nodeId: options.nodeId,
+		...options.direction ? { direction: options.direction } : {},
+		...depth !== void 0 ? { depth } : {},
+		...limit !== void 0 ? { limit } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.graph.neighbors", result);
+		return 0;
+	}
+	options.output.write(`Nodes: ${result.nodes.length}, Edges: ${result.edges.length}`);
+	return 0;
+}
+async function runCloudGraphPathCommand(options) {
+	const client = createCloudClient(options);
+	const maxDepth = options.maxDepth !== void 0 ? parseInt(String(options.maxDepth), 10) : void 0;
+	const result = await client.graph.path({
+		fromNodeId: options.fromNodeId,
+		toNodeId: options.toNodeId,
+		...maxDepth !== void 0 ? { maxDepth } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.graph.path", result);
+		return 0;
+	}
+	options.output.write(`Nodes: ${result.nodes.length}, Edges: ${result.edges.length}`);
+	return 0;
+}
+async function runCloudExtractionRunCommand(options) {
+	const result = await createCloudClient(options).extraction.run({
+		...options.mode ? { mode: options.mode } : {},
+		...options.force !== void 0 ? { force: options.force } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.extraction.run", result);
+		return 0;
+	}
+	options.output.success(`Extraction ${result.status}${result.jobId ? ` job=${result.jobId}` : ""}`);
+	return 0;
+}
+async function runCloudExtractionJobsCommand(options) {
+	const client = createCloudClient(options);
+	const limit = normalizeOptionalPositiveInteger(options.limit, "limit");
+	const result = await client.extraction.jobs({ ...limit !== void 0 ? { limit } : {} });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.extraction.jobs", result);
+		return 0;
+	}
+	options.output.write(result.items.map((job) => `Job: ${job.jobId} - ${job.status}`).join("\n") || "No jobs found.");
+	return 0;
+}
+async function runCloudEvalsRunCommand(options) {
+	const result = await createCloudClient(options).evals.run({
+		...options.fixtureIds ? { fixtureIds: options.fixtureIds.split(",").map((s) => s.trim()) } : {},
+		...options.iterations !== void 0 ? { iterations: parseInt(String(options.iterations), 10) } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.evals.run", result);
+		return 0;
+	}
+	options.output.success(`Eval pass rate: ${result.passRate}`);
+	return 0;
+}
+async function runCloudBenchmarksRunCommand(options) {
+	const result = await createCloudClient(options).benchmarks.run({
+		...options.fixtureIds ? { fixtureIds: options.fixtureIds.split(",").map((s) => s.trim()) } : {},
+		...options.iterations !== void 0 ? { iterations: parseInt(String(options.iterations), 10) } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.benchmarks.run", result);
+		return 0;
+	}
+	options.output.success(`Benchmark pass rate: ${result.passRate}, avg latency: ${result.avgLatencyMs ?? "N/A"}ms`);
+	return 0;
+}
+async function runCloudExportsCreateCommand(options) {
+	const result = await createCloudClient(options).exports.create({ ...options.label ? { label: options.label } : {} });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.exports.create", result);
+		return 0;
+	}
+	options.output.success(`Created export ${result.exportId}`);
+	return 0;
+}
+async function runCloudExportsDownloadCommand(options) {
+	const result = await createCloudClient(options).exports.downloadUrl({ exportId: options.exportId });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.exports.download", result);
+		return 0;
+	}
+	options.output.write(`Download URL: ${result.downloadUrl}`);
+	return 0;
+}
+async function runCloudSnapshotsCreateCommand(options) {
+	const result = await createCloudClient(options).snapshots.create({
+		...options.label ? { label: options.label } : {},
+		...options.trigger ? { trigger: options.trigger } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.snapshots.create", result);
+		return 0;
+	}
+	options.output.success(`Created snapshot ${result.snapshotId}`);
+	return 0;
+}
+async function runCloudSnapshotsDownloadCommand(options) {
+	const result = await createCloudClient(options).snapshots.downloadUrl({ snapshotId: options.snapshotId });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.snapshots.download", result);
+		return 0;
+	}
+	options.output.write(`Download URL: ${result.downloadUrl}`);
+	return 0;
+}
+async function runCloudProvidersListCommand(options) {
+	const result = await createCloudClient(options).providers.list();
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.providers.list", result);
+		return 0;
+	}
+	options.output.write(result.map((cred) => `Provider: ${cred.provider} - ${cred.keyName}`).join("\n") || "No providers found.");
+	return 0;
+}
+async function runCloudProvidersCreateCommand(options) {
+	const result = await createCloudClient(options).providers.create({
+		provider: options.provider,
+		keyName: options.keyName,
+		secret: options.secret,
+		...options.restUrl ? { restUrl: options.restUrl } : {},
+		...options.embeddingModel ? { embeddingModel: options.embeddingModel } : {},
+		...options.rerankModel ? { rerankModel: options.rerankModel } : {}
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.providers.create", result);
+		return 0;
+	}
+	options.output.success(`Created provider credential ${result.credentialId}`);
+	return 0;
+}
+async function runCloudProvidersTestCommand(options) {
+	const result = await createCloudClient(options).providers.test({ credentialId: options.credentialId });
+	if (options.json) {
+		printJsonEnvelope(options.output, "cloud.providers.test", result);
+		return 0;
+	}
+	options.output.write(`Test result: ${result.ok ? "OK" : "Failed"}${result.message ? ` - ${result.message}` : ""}`);
+	return result.ok ? 0 : 1;
+}
+function createCloudClient(options, allowMissingApiKey = false, allowMissingProjectId = false) {
+	return createCliCloudClient({
+		cloudUrl: options.cloudUrl,
+		apiKey: options.apiKey,
+		workspaceId: options.workspaceId,
+		projectId: options.projectId,
+		timeoutMs: options.timeoutMs,
+		allowMissingApiKey,
+		allowMissingProjectId
+	});
+}
+function normalizeMemoryKind(value) {
+	const candidate = value ?? "note";
+	if (!MEMORY_KINDS.has(candidate)) throw new CliUsageError(`kind must be one of: ${[...MEMORY_KINDS].join(", ")}.`);
+	return candidate;
+}
+function normalizeRecallStrategy(value) {
+	if (value === void 0) return void 0;
+	if (RECALL_STRATEGIES.has(value)) return value;
+	throw new CliUsageError("recall strategy must be local, vector, or hybrid.");
+}
+function normalizeRecallFallback(value) {
+	if (value === void 0) return void 0;
+	if (RECALL_FALLBACKS.has(value)) return value;
+	throw new CliUsageError("recall fallback must be none or local.");
+}
+function normalizeIndexMode(value) {
+	if (value === void 0) return void 0;
+	if (INDEX_MODES.has(value)) return value;
+	throw new CliUsageError("index mode must be all, changed, core, or notes.");
+}
+function normalizeConflictResolution(value) {
+	if (CONFLICT_RESOLUTIONS.has(value)) return value;
+	throw new CliUsageError("conflict resolution must be keep_cloud, use_client, or ignore.");
+}
+function normalizeConfidence(value) {
+	return parseConfidence(String(value));
+}
+function normalizeOptionalPositiveInteger(value, name) {
+	if (value === void 0) return void 0;
+	const parsed = typeof value === "number" ? value : Number(value);
+	if (!Number.isInteger(parsed) || parsed < 1) throw new CliUsageError(`${name} must be a positive integer.`);
+	return parsed;
+}
+function normalizeOptionalNonNegativeInteger(value, name) {
+	if (value === void 0) return void 0;
+	const parsed = typeof value === "number" ? value : Number(value);
+	if (!Number.isInteger(parsed) || parsed < 0) throw new CliUsageError(`${name} must be a non-negative integer.`);
+	return parsed;
+}
+function renderNote(note) {
+	const heading = note.title ? `${note.title} (${note.id})` : note.id;
+	const tags = note.tags?.length ? `\n- tags: ${note.tags.join(", ")}` : "";
+	const created = note.createdAt ? `\n- createdAt: ${note.createdAt}` : "";
+	return `## ${heading}\n- kind: ${note.kind}${created}${tags}\n\n${note.content.trim()}`;
+}
+function renderRecallHits(items) {
+	if (items.length === 0) return "No matching cloud memories found.";
+	return items.map((item, index) => {
+		const score = item.score === void 0 ? "" : ` score=${item.score}`;
+		return `${index + 1}. ${item.text}${score}`;
+	}).join("\n\n");
+}
+function truncateText(text, maxBytes) {
+	if (maxBytes === void 0 || text.length <= maxBytes) return text;
+	return `${text.slice(0, Math.max(0, maxBytes - 40)).trimEnd()}\n\n[truncated by --max-bytes]`;
+}
+async function resolveJsonPayload(input) {
+	const raw = await resolveCommandContent({
+		rootDir: input.rootDir,
+		inline: input.inline,
+		stdin: input.stdin,
+		file: input.file,
+		stdinContent: input.stdinContent
+	});
+	try {
+		return JSON.parse(raw);
+	} catch (error) {
+		throw new CliUsageError(`${input.fieldName} must be valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function parseJsonObject(raw, fieldName) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (!isJsonObject(parsed)) throw new Error("value must be an object");
+		return parsed;
+	} catch (error) {
+		throw new CliUsageError(`${fieldName} must be a JSON object: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function extractSyncEvents(payload) {
+	const events = Array.isArray(payload) ? payload : isJsonObject(payload) ? payload.events : void 0;
+	if (!Array.isArray(events)) throw new CliUsageError("sync push payload must be an event array or an object with an events array.");
+	return events.map((event, index) => {
+		if (!isJsonObject(event)) throw new CliUsageError(`sync event at index ${index} must be an object.`);
+		return event;
+	});
+}
+function extractCheckpoint(payload) {
+	if (!isJsonObject(payload) || payload.checkpoint === void 0) return void 0;
+	if (!isJsonObject(payload.checkpoint)) throw new CliUsageError("sync checkpoint must be an object.");
+	return payload.checkpoint;
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+//#endregion
+//#region src/commands/context.ts
+function truncate(value, maxChars) {
+	if (value.length <= maxChars) return value;
+	return `${value.slice(0, Math.max(0, maxChars - 20)).trimEnd()}\n\n[truncated]`;
+}
+function searchText(file, content, query) {
+	const lower = query.toLowerCase();
+	return content.split(/\r?\n/).map((line, index) => ({
+		file,
+		line: index + 1,
+		content: line.trim()
+	})).filter((entry) => entry.content.toLowerCase().includes(lower));
+}
+async function runContextCommand(options) {
+	const maxChars = typeof options.maxChars === "number" ? options.maxChars : options.maxChars ? parsePositiveInteger(options.maxChars, "max chars") : 12e3;
+	const core = await options.fs.readTextIfExists(TEKMEMO_PATHS.coreMemory) ?? "";
+	const notes = await options.fs.readTextIfExists(TEKMEMO_PATHS.notesMemory) ?? "";
+	const eventContent = await options.fs.readTextIfExists(TEKMEMO_PATHS.memoryEvents) ?? "";
+	const chunkContent = await options.fs.readTextIfExists(TEKMEMO_PATHS.chunks) ?? "";
+	const events = eventContent ? parseJsonl(eventContent).slice(-10).map((record) => record.value) : [];
+	const chunks = chunkContent ? parseJsonl(chunkContent).slice(-10).map((record) => record.value) : [];
+	const matches = options.query ? [...searchText(TEKMEMO_PATHS.coreMemory, core, options.query), ...searchText(TEKMEMO_PATHS.notesMemory, notes, options.query)] : [];
+	const data = {
+		rootDir: options.fs.rootDir,
+		query: options.query ?? null,
+		core: truncate(core.trim(), Math.floor(maxChars * .45)),
+		notes: truncate(notes.trim(), Math.floor(maxChars * .35)),
+		matches,
+		...options.includeEvents ? { recentEvents: events } : {},
+		...options.includeChunks ? { recentChunks: chunks } : {}
+	};
+	if (options.json) {
+		printJsonEnvelope(options.output, "context", data);
+		return 0;
+	}
+	const sections = [
+		"# TekMemo Context",
+		`Root: ${options.fs.rootDir}`,
+		options.query ? `Query: ${options.query}` : void 0,
+		"",
+		"## Core Memory",
+		data.core || "No core memory found.",
+		"",
+		"## Notes Memory",
+		data.notes || "No notes memory found."
+	];
+	if (matches.length > 0) sections.push("", "## Text Matches", ...matches.slice(0, 20).map((m) => `- ${m.file}:${m.line} — ${m.content}`));
+	if (options.includeEvents && events.length > 0) sections.push("", "## Recent Memory Events", ...events.map((event) => `- ${String(event.timestamp ?? "unknown")} ${String(event.type ?? "unknown")} ${String(event.summary ?? "")}`.trim()));
+	options.output.write(truncate(sections.filter((section) => section !== void 0).join("\n"), maxChars));
+	return 0;
+}
+
+//#endregion
+//#region src/commands/diff.ts
+function lineCount(content) {
+	return content.split(/\r?\n/).filter(Boolean).length;
+}
+function contentHash(content) {
+	return (0, node_crypto.createHash)("sha256").update(content).digest("hex");
+}
+async function loadBundle(fs, path) {
+	const raw = await fs.readText(path);
+	const parsed = JSON.parse(raw);
+	if (typeof parsed !== "object" || parsed === null || typeof parsed.files !== "object") throw new Error("Snapshot bundle is malformed.");
+	return parsed;
+}
+function snapshotMatches(record, key) {
+	if (record.id === key) return true;
+	if (record.label === key) return true;
+	const metadata = record.metadata;
+	if (typeof metadata === "object" && metadata !== null && !Array.isArray(metadata)) return metadata.label === key;
+	return false;
+}
+async function runDiffCommand(options) {
+	const snapshotContent = await options.fs.readTextIfExists(TEKMEMO_PATHS.snapshots);
+	if (!snapshotContent) {
+		options.output.error("No snapshots found.");
+		return 1;
+	}
+	const snapshots = parseJsonl(snapshotContent);
+	const snapA = snapshots.find((s) => snapshotMatches(s.value, options.labelA));
+	const snapB = snapshots.find((s) => snapshotMatches(s.value, options.labelB));
+	if (!snapA) {
+		options.output.error(`Snapshot "${options.labelA}" not found.`);
+		return 1;
+	}
+	if (!snapB) {
+		options.output.error(`Snapshot "${options.labelB}" not found.`);
+		return 1;
+	}
+	const pathA = snapA.value.path;
+	const pathB = snapB.value.path;
+	if (typeof pathA !== "string" || typeof pathB !== "string") {
+		options.output.error("Snapshot index contains a malformed path.");
+		return 1;
+	}
+	let bundleA;
+	let bundleB;
+	try {
+		bundleA = await loadBundle(options.fs, pathA);
+	} catch {
+		options.output.error(`Failed to load snapshot bundle: ${pathA}`);
+		return 1;
+	}
+	try {
+		bundleB = await loadBundle(options.fs, pathB);
+	} catch {
+		options.output.error(`Failed to load snapshot bundle: ${pathB}`);
+		return 1;
+	}
+	const allPaths = new Set([...Object.keys(bundleA.files), ...Object.keys(bundleB.files)]);
+	const diffs = [];
+	for (const filePath of allPaths) {
+		const contentA = bundleA.files[filePath];
+		const contentB = bundleB.files[filePath];
+		if (contentA === void 0 && contentB !== void 0) diffs.push({
+			path: filePath,
+			status: "added",
+			bytesB: Buffer.byteLength(contentB)
+		});
+		else if (contentA !== void 0 && contentB === void 0) diffs.push({
+			path: filePath,
+			status: "removed",
+			bytesA: Buffer.byteLength(contentA)
+		});
+		else if (contentA !== void 0 && contentB !== void 0) if (contentHash(contentA) === contentHash(contentB)) diffs.push({
+			path: filePath,
+			status: "unchanged",
+			bytesA: Buffer.byteLength(contentA),
+			bytesB: Buffer.byteLength(contentB)
+		});
+		else {
+			const isJsonl = filePath.endsWith(".jsonl");
+			diffs.push({
+				path: filePath,
+				status: "changed",
+				bytesA: Buffer.byteLength(contentA),
+				bytesB: Buffer.byteLength(contentB),
+				...isJsonl ? {
+					recordsA: lineCount(contentA),
+					recordsB: lineCount(contentB)
+				} : {}
+			});
+		}
+	}
+	const changed = diffs.filter((d) => d.status !== "unchanged");
+	const data = {
+		labelA: options.labelA,
+		labelB: options.labelB,
+		snapshotA: {
+			id: bundleA.id,
+			createdAt: bundleA.createdAt ?? bundleA.timestamp,
+			path: pathA
+		},
+		snapshotB: {
+			id: bundleB.id,
+			createdAt: bundleB.createdAt ?? bundleB.timestamp,
+			path: pathB
+		},
+		totalFiles: allPaths.size,
+		changedFiles: changed.length,
+		diffs: changed
+	};
+	if (options.json) {
+		printJsonEnvelope(options.output, "diff", data);
+		return 0;
+	}
+	options.output.write(`Comparing "${options.labelA}" vs "${options.labelB}"`);
+	options.output.write(`  [A] ${data.snapshotA.createdAt ?? "unknown"}  [B] ${data.snapshotB.createdAt ?? "unknown"}`);
+	options.output.write("");
+	if (changed.length === 0) {
+		options.output.success("No differences found. Snapshots are identical.");
+		return 0;
+	}
+	const statusLabel = {
+		added: "+",
+		removed: "-",
+		changed: "~"
+	};
+	for (const diff of changed) {
+		let line = `  ${statusLabel[diff.status] ?? "?"} ${diff.path}`;
+		if (diff.status === "changed") {
+			const sizeInfo = `${diff.bytesA}B → ${diff.bytesB}B`;
+			const recordInfo = diff.recordsA !== void 0 && diff.recordsB !== void 0 ? ` (${diff.recordsA} → ${diff.recordsB} records)` : "";
+			line += `  ${sizeInfo}${recordInfo}`;
+		} else if (diff.status === "added" && diff.bytesB !== void 0) line += `  (${diff.bytesB}B)`;
+		else if (diff.status === "removed" && diff.bytesA !== void 0) line += `  (${diff.bytesA}B)`;
+		options.output.write(line);
+	}
+	options.output.write(`\n${changed.length} file(s) changed out of ${allPaths.size} total.`);
+	return 0;
+}
+
+//#endregion
+//#region src/protocol/schemas.ts
+const JsonRecordSchema = zod.z.record(zod.z.string(), zod.z.unknown());
+const IsoDateSchema = zod.z.string().datetime();
+const NonEmptyStringSchema = zod.z.string().min(1);
+const ManifestSchema = zod.z.object({
+	version: NonEmptyStringSchema,
+	projectId: NonEmptyStringSchema.optional(),
+	createdAt: IsoDateSchema,
+	updatedAt: IsoDateSchema,
+	memory: zod.z.object({
+		core: NonEmptyStringSchema,
+		notes: NonEmptyStringSchema
+	}),
+	events: zod.z.object({
+		memoryEvents: NonEmptyStringSchema,
+		conversations: NonEmptyStringSchema
+	}),
+	indexes: zod.z.object({ chunks: NonEmptyStringSchema }),
+	graph: zod.z.object({
+		nodes: NonEmptyStringSchema,
+		edges: NonEmptyStringSchema
+	}),
+	snapshots: zod.z.object({ index: NonEmptyStringSchema })
+});
+const ConversationEntrySchema = zod.z.object({
+	timestamp: IsoDateSchema,
+	role: zod.z.enum([
+		"user",
+		"assistant",
+		"system",
+		"tool"
+	]),
+	content: zod.z.string(),
+	summary: zod.z.string().optional(),
+	metadata: JsonRecordSchema.optional()
+});
+const MemoryEventSchema = zod.z.object({
+	id: NonEmptyStringSchema,
+	type: zod.z.enum([
+		"memory.created",
+		"memory.updated",
+		"memory.merged",
+		"memory.conflicted",
+		"memory.decayed",
+		"memory.forgotten",
+		"memory.restored",
+		"memory.indexed",
+		"memory.reindexed",
+		"snapshot.created",
+		"sync.started",
+		"sync.completed",
+		"sync.failed"
+	]),
+	timestamp: IsoDateSchema,
+	projectId: NonEmptyStringSchema.optional(),
+	sourcePath: NonEmptyStringSchema.optional(),
+	actor: zod.z.object({
+		type: zod.z.enum([
+			"user",
+			"agent",
+			"system",
+			"api"
+		]),
+		id: NonEmptyStringSchema.optional()
+	}).optional(),
+	summary: NonEmptyStringSchema.optional(),
+	metadata: JsonRecordSchema.optional()
+});
+const ChunkRecordSchema = zod.z.object({
+	chunkId: NonEmptyStringSchema,
+	sourcePath: NonEmptyStringSchema,
+	sourceType: zod.z.enum([
+		"document",
+		"note",
+		"conversation",
+		"event",
+		"import",
+		"graph"
+	]),
+	sourceId: NonEmptyStringSchema,
+	sourceHash: NonEmptyStringSchema,
+	textHash: NonEmptyStringSchema,
+	memoryType: zod.z.enum([
+		"core",
+		"notes",
+		"conversation",
+		"event",
+		"chunk",
+		"graph"
+	]),
+	index: zod.z.number().int().nonnegative(),
+	startOffset: zod.z.number().int().nonnegative(),
+	endOffset: zod.z.number().int().nonnegative(),
+	status: zod.z.enum([
+		"active",
+		"stale",
+		"deleted"
+	]),
+	createdAt: IsoDateSchema,
+	updatedAt: IsoDateSchema.optional(),
+	sectionName: zod.z.string().optional(),
+	metadata: JsonRecordSchema.optional()
+});
+const SnapshotEntrySchema = zod.z.object({
+	id: NonEmptyStringSchema,
+	path: NonEmptyStringSchema,
+	type: zod.z.enum([
+		"manual",
+		"automatic",
+		"pre-sync",
+		"pre-restore"
+	]),
+	status: zod.z.enum([
+		"available",
+		"expired",
+		"deleted"
+	]),
+	createdAt: IsoDateSchema,
+	expiresAt: IsoDateSchema.optional(),
+	checksum: NonEmptyStringSchema.optional(),
+	metadata: JsonRecordSchema.optional()
+});
+const LegacySnapshotEntrySchema = zod.z.object({
+	id: NonEmptyStringSchema,
+	timestamp: IsoDateSchema,
+	label: NonEmptyStringSchema,
+	path: NonEmptyStringSchema,
+	metadata: JsonRecordSchema.optional()
+});
+const MemoryChunkSchema = ChunkRecordSchema;
+
+//#endregion
+//#region src/commands/doctor.ts
+async function runDoctorCommand(options) {
+	const issues = [];
+	for (const dir of REQUIRED_DIRS) if (!await options.fs.exists(dir)) issues.push({
+		level: "error",
+		code: "missing_dir",
+		message: `Missing directory: ${dir}`
+	});
+	for (const file of REQUIRED_FILES) if (!await options.fs.exists(file)) issues.push({
+		level: "error",
+		code: "missing_file",
+		message: `Missing file: ${file}`
+	});
+	const manifestContent = await options.fs.readTextIfExists(TEKMEMO_PATHS.manifest);
+	if (manifestContent) try {
+		const parsed = JSON.parse(manifestContent);
+		ManifestSchema.parse(parsed);
+	} catch (error) {
+		issues.push({
+			level: "error",
+			code: "invalid_manifest",
+			message: `manifest.json: ${error instanceof Error ? error.message : String(error)}`
+		});
+	}
+	const validationMap = {
+		[TEKMEMO_PATHS.memoryEvents]: MemoryEventSchema,
+		[TEKMEMO_PATHS.conversations]: ConversationEntrySchema,
+		[TEKMEMO_PATHS.chunks]: MemoryChunkSchema,
+		[TEKMEMO_PATHS.snapshots]: SnapshotEntrySchema
+	};
+	const conversationIds = /* @__PURE__ */ new Set();
+	for (const [file, schema] of Object.entries(validationMap)) {
+		const content = await options.fs.readTextIfExists(file);
+		if (content === void 0) continue;
+		const records = parseJsonl(content, { strict: options.strict ?? false });
+		for (const record of records) try {
+			const validated = schema.parse(record.value);
+			if (file === TEKMEMO_PATHS.conversations && typeof validated.id === "string") conversationIds.add(validated.id);
+		} catch (error) {
+			issues.push({
+				level: "error",
+				code: "invalid_line",
+				message: `${file}:${record.line}: ${error instanceof Error ? error.message : String(error)}`
+			});
+		}
+	}
+	const eventContent = await options.fs.readTextIfExists(TEKMEMO_PATHS.memoryEvents);
+	if (eventContent) {
+		const events = parseJsonl(eventContent);
+		for (const event of events) {
+			const docId = event.value.documentId;
+			if (typeof docId !== "string") continue;
+			if (docId === "core" || docId === "notes") continue;
+			if (conversationIds.size > 0 && !conversationIds.has(docId)) issues.push({
+				level: "warning",
+				code: "orphaned_event",
+				message: `${TEKMEMO_PATHS.memoryEvents}:${event.line}: Event references unknown document/conversation "${docId}"`
+			});
+		}
+	}
+	const result = {
+		ok: issues.filter((issue) => issue.level === "error").length === 0,
+		issues
+	};
+	if (options.json) options.output.write(JSON.stringify(result, null, 2));
+	else if (result.ok) if (issues.length > 0) options.output.warn(["TekMemo doctor passed with warnings:", ...issues.map((issue) => `- [${issue.level}] ${issue.message}`)].join("\n"));
+	else options.output.success("TekMemo doctor passed.");
+	else options.output.error(["TekMemo doctor found errors:", ...issues.map((issue) => `- [${issue.level}] ${issue.message}`)].join("\n"));
+	return result.ok ? 0 : 1;
+}
+
+//#endregion
+//#region src/commands/edit.ts
+async function runEditCommand(options) {
+	const findings = scanForSecrets(options.message);
+	if (findings.length > 0 && !options.allowSecrets) {
+		if (options.json) printJsonEnvelope(options.output, "edit", {
+			updated: false,
+			secretFindings: findings
+		});
+		else options.output.error(`Refusing to store possible secret (${findings[0]?.kind}). Use --allow-secrets only after review.`);
+		return 1;
+	}
+	const file = options.type === "core" ? TEKMEMO_PATHS.coreMemory : TEKMEMO_PATHS.notesMemory;
+	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+	const entry = options.type === "note" ? `\n## ${timestamp}\n- kind: note\n- tags: none\n- confidence: 1\n\n${options.message.trim()}\n` : `\n${options.message.trim()}\n`;
+	await options.fs.appendText(file, entry);
+	const event = {
+		id: `evt_${Date.now()}_${Math.random().toString(16).slice(2)}`,
+		type: "memory.updated",
+		timestamp,
+		sourcePath: file,
+		actor: { type: "user" },
+		summary: `${options.type} memory updated by CLI`,
+		metadata: {
+			document: options.type,
+			command: "edit",
+			createdBy: "@tekmemo/cli"
+		}
+	};
+	await options.fs.appendText(TEKMEMO_PATHS.memoryEvents, stringifyJsonl([event]));
+	const data = {
+		updated: true,
+		path: file,
+		eventId: event.id,
+		secretFindings: findings
+	};
+	if (options.json) printJsonEnvelope(options.output, "edit", data);
+	else options.output.success(`Updated ${file}`);
+	return 0;
+}
+
+//#endregion
+//#region src/commands/events.ts
+async function runEventsCommand(options) {
+	const content = await options.fs.readTextIfExists(TEKMEMO_PATHS.memoryEvents);
+	const records = content ? parseJsonl(content, { strict: options.strict ?? false }) : [];
+	const selected = options.limit && options.limit > 0 ? records.slice(-options.limit) : records;
+	if (options.json) {
+		options.output.write(JSON.stringify(selected, null, 2));
+		return 0;
+	}
+	if (selected.length === 0) {
+		options.output.write("No memory events found.");
+		return 0;
+	}
+	options.output.write(selected.map((record) => {
+		const type = typeof record.value.type === "string" ? record.value.type : "unknown";
+		return `${typeof record.value.timestamp === "string" ? record.value.timestamp : `line ${record.line}`} ${type}${typeof record.value.summary === "string" ? ` — ${record.value.summary}` : ""}`;
+	}).join("\n"));
+	return 0;
+}
+
+//#endregion
+//#region src/commands/init.ts
+async function runInitCommand(options) {
+	await options.fs.ensureSafeRoot();
+	let projectId = options.projectId?.trim();
+	if (projectId !== void 0 && projectId.length === 0) projectId = void 0;
+	if (!projectId && !options.json && !options.noInput && process.stdout.isTTY) {
+		options.output.write("Initializing TekMemo...");
+		const rl = node_readline_promises.default.createInterface({
+			input: process.stdin,
+			output: process.stdout
+		});
+		try {
+			const answer = await rl.question("Enter project ID (leave empty for random): ");
+			if (answer.trim()) projectId = answer.trim();
+		} finally {
+			rl.close();
+		}
+	}
+	for (const dir of REQUIRED_DIRS) await options.fs.mkdir(dir);
+	if (await options.fs.readTextIfExists(TEKMEMO_PATHS.manifest) && !options.force) {
+		const data = {
+			created: false,
+			rootDir: options.fs.rootDir,
+			message: ".tekmemo already exists. Use --force to overwrite seed files."
+		};
+		if (options.json) printJsonEnvelope(options.output, "init", data);
+		else options.output.write(data.message);
+		return 0;
+	}
+	const manifest = createDefaultManifest(projectId ? { projectId } : void 0);
+	const seedFiles = {
+		[TEKMEMO_PATHS.manifest]: `${JSON.stringify(manifest, null, 2)}\n`,
+		[TEKMEMO_PATHS.coreMemory]: "# Core Memory\n\n",
+		[TEKMEMO_PATHS.notesMemory]: "# Notes\n\n",
+		[TEKMEMO_PATHS.memoryEvents]: "",
+		[TEKMEMO_PATHS.conversations]: "",
+		[TEKMEMO_PATHS.chunks]: "",
+		[TEKMEMO_PATHS.graphNodes]: "",
+		[TEKMEMO_PATHS.graphEdges]: "",
+		[TEKMEMO_PATHS.snapshots]: ""
+	};
+	const created = [];
+	const overwritten = [];
+	const skipped = [];
+	for (const file of REQUIRED_FILES) {
+		const exists = await options.fs.exists(file);
+		if (!exists || options.force) {
+			await options.fs.writeText(file, seedFiles[file] ?? "");
+			if (exists) overwritten.push(file);
+			else created.push(file);
+		} else skipped.push(file);
+	}
+	const data = {
+		created: true,
+		rootDir: options.fs.rootDir,
+		manifest,
+		files: {
+			created,
+			overwritten,
+			skipped
+		}
+	};
+	if (options.json) printJsonEnvelope(options.output, "init", data);
+	else options.output.success(`Initialized .tekmemo at ${options.fs.rootDir} (Project ID: ${manifest.projectId ?? "none"})`);
+	return 0;
+}
+
+//#endregion
+//#region src/commands/inspect.ts
+async function runInspectCommand(options) {
+	const inspection = await inspectTekMemo(options.fs);
+	if (options.json) {
+		options.output.write(JSON.stringify(inspection, null, 2));
+		return 0;
+	}
+	const lines = [
+		`TekMemo root: ${inspection.rootDir}`,
+		`.tekmemo exists: ${inspection.exists ? "yes" : "no"}`,
+		inspection.manifest ? `Project: ${inspection.manifest.projectId}` : "Project: missing manifest",
+		"",
+		"Files:"
+	];
+	for (const file of inspection.files) lines.push(`- ${file.path}: ${file.exists ? `${file.bytes} bytes` : "missing"}${file.records !== void 0 ? `, ${file.records} records` : ""}`);
+	lines.push("");
+	lines.push("Summary:");
+	lines.push(`- events: ${inspection.summary.eventCount}`);
+	lines.push(`- conversations: ${inspection.summary.conversationCount}`);
+	lines.push(`- chunks: ${inspection.summary.chunkCount}`);
+	lines.push(`- graph nodes: ${inspection.summary.graphNodeCount}`);
+	lines.push(`- graph edges: ${inspection.summary.graphEdgeCount}`);
+	lines.push(`- snapshots: ${inspection.summary.snapshotCount}`);
+	options.output.write(lines.join("\n"));
+	return 0;
+}
+
+//#endregion
+//#region src/commands/read.ts
+const TARGET_PATHS = {
+	core: TEKMEMO_PATHS.coreMemory,
+	notes: TEKMEMO_PATHS.notesMemory,
+	manifest: TEKMEMO_PATHS.manifest
+};
+async function runReadCommand(options) {
+	const path = TARGET_PATHS[options.target];
+	const content = await options.fs.readTextIfExists(path);
+	if (content === void 0) {
+		options.output.error(`${path} does not exist. Run tekmemo init first.`);
+		return 1;
+	}
+	if (options.json) printJsonEnvelope(options.output, "read", {
+		target: options.target,
+		path,
+		content
+	});
+	else options.output.write(content.trimEnd());
+	return 0;
+}
+
+//#endregion
+//#region src/commands/remember.ts
+const NOTE_KINDS = new Set([
+	"decision",
+	"constraint",
+	"goal",
+	"preference",
+	"reference",
+	"summary",
+	"note"
+]);
+function normalizeKind(kind) {
+	const normalized = (kind ?? "note").trim();
+	if (!NOTE_KINDS.has(normalized)) throw new CliUsageError(`Invalid memory kind "${normalized}". Allowed: ${[...NOTE_KINDS].join(", ")}`);
+	return normalized;
+}
+function parseActor(actor) {
+	if (!actor) return { type: "user" };
+	const [type, id] = actor.split(":", 2);
+	if (type !== "user" && type !== "agent" && type !== "system" && type !== "api") throw new CliUsageError("actor must be one of user, agent, system, or api, optionally followed by :id.");
+	return {
+		type,
+		...id ? { id } : {}
+	};
+}
+function formatTimestampedNote(input) {
+	const heading = input.title ? `${input.timestamp} — ${input.title.replace(/\s+/g, " ").trim()}` : input.timestamp;
+	const tags = input.tags?.length ? input.tags.join(", ") : "none";
+	return [
+		`## ${heading}`,
+		`- kind: ${input.kind}`,
+		`- tags: ${tags}`,
+		`- confidence: ${input.confidence}`,
+		input.source ? `- source: ${input.source}` : void 0,
+		input.metadata ? `- metadata: ${JSON.stringify(input.metadata)}` : void 0,
+		"",
+		input.content.trim(),
+		""
+	].filter((line) => line !== void 0).join("\n");
+}
+async function runRememberCommand(options) {
+	const content = await resolveCommandContent({
+		rootDir: options.fs.rootDir,
+		inline: options.content,
+		stdin: options.stdin,
+		file: options.file,
+		stdinContent: options.stdinContent
+	});
+	const findings = scanForSecrets(content);
+	if (findings.length > 0 && !options.allowSecrets) {
+		const data = { secretFindings: findings };
+		if (options.json) printJsonEnvelope(options.output, "remember", {
+			stored: false,
+			...data
+		});
+		else options.output.error(`Refusing to store possible secret (${findings[0]?.kind}). Use --allow-secrets only after review.`);
+		return 1;
+	}
+	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+	const kind = normalizeKind(options.kind);
+	const tags = (options.tags ?? []).map((tag) => tag.trim()).filter(Boolean);
+	const confidence = typeof options.confidence === "number" ? options.confidence : options.confidence ? parseConfidence(options.confidence) : 1;
+	const metadata = parseMetadataJson(options.metadata);
+	const actor = parseActor(options.actor);
+	const note = formatTimestampedNote({
+		timestamp,
+		kind,
+		content,
+		...options.title ? { title: options.title } : {},
+		...tags.length ? { tags } : {},
+		confidence,
+		...options.source ? { source: options.source } : {},
+		...metadata ? { metadata } : {}
+	});
+	const nextNotes = `${(await options.fs.readTextIfExists(TEKMEMO_PATHS.notesMemory) ?? "# Notes\n").trimEnd()}\n\n${note}`.trimStart();
+	await options.fs.writeText(TEKMEMO_PATHS.notesMemory, `${nextNotes.trimEnd()}\n`);
+	const eventId = `evt_${Date.now()}_${Math.random().toString(16).slice(2)}`;
+	const event = {
+		id: eventId,
+		type: "memory.created",
+		timestamp,
+		sourcePath: TEKMEMO_PATHS.notesMemory,
+		actor,
+		summary: options.title ?? content.split(/\r?\n/)[0]?.slice(0, 140) ?? "Stored memory note",
+		metadata: {
+			kind,
+			tags,
+			confidence,
+			...options.source ? { source: options.source } : {},
+			...metadata ? { userMetadata: metadata } : {},
+			createdBy: "@tekmemo/cli"
+		}
+	};
+	await options.fs.appendText(TEKMEMO_PATHS.memoryEvents, stringifyJsonl([event]));
+	const data = {
+		stored: true,
+		eventId,
+		path: TEKMEMO_PATHS.notesMemory,
+		kind,
+		tags,
+		confidence,
+		secretFindings: findings
+	};
+	if (options.json) printJsonEnvelope(options.output, "remember", data);
+	else options.output.success(`Stored ${kind} memory in ${TEKMEMO_PATHS.notesMemory}`);
+	return 0;
+}
+
+//#endregion
+//#region src/utils/labels.ts
+function validateSnapshotLabel(label) {
+	if (typeof label !== "string" || label.trim().length === 0) throw new CliUsageError("Snapshot label must be a non-empty string.");
+	const normalized = label.trim();
+	if (normalized.length > 80) throw new CliUsageError("Snapshot label must be 80 characters or fewer.");
+	if (normalized.includes("\0")) throw new CliUsageError("Snapshot label must not contain null bytes.");
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(normalized)) throw new CliUsageError("Snapshot label may only contain letters, numbers, dots, underscores, and hyphens, and must start with a letter or number.");
+	return normalized;
+}
+function createSafeIdFromLabel(label, timestamp = (/* @__PURE__ */ new Date()).toISOString()) {
+	return `${validateSnapshotLabel(label)}-${timestamp.replace(/[:.]/g, "-")}`.slice(0, 120);
+}
+
+//#endregion
+//#region src/commands/snapshot.ts
+function checksum(value) {
+	return (0, node_crypto.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+}
+async function runSnapshotCommand(options) {
+	const label = validateSnapshotLabel(options.label);
+	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+	const id = createSafeIdFromLabel(label, createdAt);
+	const path = `${TEKMEMO_PATHS.snapshotsDir}/${id}.json`;
+	const files = {};
+	for (const filePath of REQUIRED_FILES) {
+		const content = await options.fs.readTextIfExists(filePath);
+		if (content !== void 0) files[filePath] = content;
+	}
+	const bundleWithoutChecksum = {
+		id,
+		label,
+		createdAt,
+		protocolVersion: "1",
+		files
+	};
+	const bundle = {
+		...bundleWithoutChecksum,
+		checksum: checksum(bundleWithoutChecksum)
+	};
+	await options.fs.writeText(path, `${JSON.stringify(bundle, null, 2)}\n`);
+	const record = {
+		id,
+		path,
+		type: "manual",
+		status: "available",
+		createdAt,
+		checksum: bundle.checksum,
+		metadata: {
+			label,
+			fileCount: Object.keys(files).length,
+			createdBy: "@tekmemo/cli"
+		}
+	};
+	await options.fs.appendText(TEKMEMO_PATHS.snapshots, stringifyJsonl([record]));
+	await options.fs.appendText(TEKMEMO_PATHS.memoryEvents, stringifyJsonl([{
+		id: `evt_${id}`,
+		type: "snapshot.created",
+		timestamp: createdAt,
+		sourcePath: path,
+		actor: {
+			type: "system",
+			id: "@tekmemo/cli"
+		},
+		summary: `Created snapshot ${label}`,
+		metadata: {
+			snapshotId: id,
+			label,
+			checksum: bundle.checksum
+		}
+	}]));
+	const data = {
+		id,
+		label,
+		path,
+		createdAt,
+		checksum: bundle.checksum,
+		fileCount: Object.keys(files).length
+	};
+	if (options.json) printJsonEnvelope(options.output, "snapshot", data);
+	else options.output.success(`Created snapshot "${label}" at ${path}`);
+	return 0;
+}
+
+//#endregion
+//#region src/commands/validate.ts
+async function runValidateCommand(options) {
+	const issues = [];
+	for (const dir of REQUIRED_DIRS) if (!await options.fs.exists(dir)) issues.push({
+		code: "missing_dir",
+		message: `Missing required directory: ${dir}`
+	});
+	for (const file of REQUIRED_FILES) if (!await options.fs.exists(file)) issues.push({
+		code: "missing_file",
+		message: `Missing required file: ${file}`
+	});
+	const manifestContent = await options.fs.readTextIfExists(TEKMEMO_PATHS.manifest);
+	if (manifestContent === void 0) issues.push({
+		code: "missing_manifest",
+		message: "manifest.json is missing"
+	});
+	else try {
+		const manifest = parseManifest(manifestContent);
+		for (const key of ["core", "notes"]) {
+			const filePath = manifest.memory[key];
+			if (!await options.fs.exists(filePath)) issues.push({
+				code: "manifest_ref_missing",
+				message: `Manifest references ${filePath} but file is missing`
+			});
+		}
+	} catch (error) {
+		issues.push({
+			code: "invalid_manifest",
+			message: `manifest.json: ${error instanceof Error ? error.message : String(error)}`
+		});
+	}
+	const strictSchemas = {
+		[TEKMEMO_PATHS.memoryEvents]: MemoryEventSchema,
+		[TEKMEMO_PATHS.conversations]: ConversationEntrySchema,
+		[TEKMEMO_PATHS.chunks]: MemoryChunkSchema,
+		[TEKMEMO_PATHS.snapshots]: SnapshotEntrySchema
+	};
+	for (const [file, schema] of Object.entries(strictSchemas)) {
+		const content = await options.fs.readTextIfExists(file);
+		if (content === void 0) continue;
+		const lines = content.split(/\r?\n/);
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i]?.trim();
+			if (!line) continue;
+			const lineNumber = i + 1;
+			let parsed;
+			try {
+				parsed = JSON.parse(line);
+			} catch {
+				issues.push({
+					code: "invalid_json",
+					message: `${file}:${lineNumber}: Invalid JSON`
+				});
+				continue;
+			}
+			const result = schema.safeParse(parsed);
+			if (!result.success) {
+				const firstIssue = result.error.issues[0];
+				const path = firstIssue?.path.join(".") ?? "unknown";
+				const msg = firstIssue?.message ?? "validation failed";
+				issues.push({
+					code: "schema_violation",
+					message: `${file}:${lineNumber}: ${path} — ${msg}`
+				});
+			}
+		}
+	}
+	const ok = issues.length === 0;
+	if (options.json) options.output.write(JSON.stringify({
+		ok,
+		issues
+	}, null, 2));
+	else if (ok) options.output.success("Validation passed. All protocol files are valid.");
+	else options.output.error(["Validation failed:", ...issues.map((issue) => `- [${issue.code}] ${issue.message}`)].join("\n"));
+	return ok ? 0 : 1;
+}
+
+//#endregion
+//#region src/commands/runtime.ts
+async function runRuntimeContextCommand(options) {
+	if (options.config.runtime === "cloud") return runCloudContextCommand({
+		output: options.output,
+		json: options.json,
+		...options.config.cloud,
+		query: options.query ?? "project context",
+		maxBytes: options.maxChars
+	});
+	if (options.config.runtime === "local") return runContextCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json,
+		query: options.query,
+		maxChars: options.maxChars,
+		includeEvents: options.includeEvents,
+		includeChunks: options.includeChunks
+	});
+	return runHybridContextCommand(options);
+}
+async function runRuntimeRememberCommand(options) {
+	if (options.config.runtime === "cloud") return runCloudRememberFromRuntime(options);
+	if (options.config.runtime === "local") return runLocalRememberFromRuntime(options);
+	return runWritePolicy(options.config.hybrid.writePolicy, () => runLocalRememberFromRuntime(options), () => runCloudRememberFromRuntime(options));
+}
+async function runRuntimeReadCommand(options) {
+	if (options.target === "manifest") return runLocalReadFromRuntime(options);
+	if (options.config.runtime === "cloud") return runCloudReadFromRuntime(options);
+	if (options.config.runtime === "local") return runLocalReadFromRuntime(options);
+	return runReadPolicy(options.config.hybrid.readPolicy, () => runLocalReadFromRuntime(options), () => runCloudReadFromRuntime(options));
+}
+async function runRuntimeValidateCommand(options) {
+	if (options.config.runtime === "cloud") return runCloudValidateCommand({
+		output: options.output,
+		json: options.json,
+		...options.config.cloud
+	});
+	if (options.config.runtime === "local") return runValidateCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json
+	});
+	const local = createBufferedOutput({ noColor: true });
+	const cloud = createBufferedOutput({ noColor: true });
+	const localExit = await runValidateCommand({
+		fs: options.fs,
+		output: local,
+		json: options.json
+	});
+	const cloudExit = await runCloudValidateCommand({
+		output: cloud,
+		json: options.json,
+		...options.config.cloud
+	}).catch((error) => {
+		cloud.error(error instanceof Error ? error.message : String(error));
+		return 1;
+	});
+	if (options.json) {
+		printJsonEnvelope(options.output, "validate", {
+			runtime: "hybrid",
+			local: {
+				exitCode: localExit,
+				stdout: local.stdout,
+				stderr: local.stderr
+			},
+			cloud: {
+				exitCode: cloudExit,
+				stdout: cloud.stdout,
+				stderr: cloud.stderr
+			}
+		});
+		return localExit === 0 && cloudExit === 0 ? 0 : 1;
+	}
+	options.output.write([
+		"# Local validation",
+		...local.stdout,
+		"",
+		"# Cloud validation",
+		...cloud.stdout
+	].join("\n"));
+	for (const line of [...local.stderr, ...cloud.stderr]) options.output.error(line);
+	return localExit === 0 && cloudExit === 0 ? 0 : 1;
+}
+async function runRuntimeSnapshotCommand(options) {
+	if (options.config.runtime === "cloud") return runCloudSnapshotCommand({
+		output: options.output,
+		json: options.json,
+		...options.config.cloud,
+		label: options.label
+	});
+	if (options.config.runtime === "local") return runSnapshotCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json,
+		label: options.label ?? "manual"
+	});
+	return runWritePolicy(options.config.hybrid.writePolicy, () => runSnapshotCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json,
+		label: options.label ?? "manual"
+	}), () => runCloudSnapshotCommand({
+		output: options.output,
+		json: options.json,
+		...options.config.cloud,
+		label: options.label
+	}));
+}
+async function runHybridContextCommand(options) {
+	const readPolicy = options.config.hybrid.readPolicy;
+	if (readPolicy === "local-only") return runContextCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json,
+		query: options.query,
+		maxChars: options.maxChars,
+		includeEvents: options.includeEvents,
+		includeChunks: options.includeChunks
+	});
+	if (readPolicy === "cloud-only") return runCloudContextCommand({
+		output: options.output,
+		json: options.json,
+		...options.config.cloud,
+		query: options.query ?? "project context",
+		maxBytes: options.maxChars
+	});
+	const local = createBufferedOutput({ noColor: true });
+	const cloud = createBufferedOutput({ noColor: true });
+	const localExit = await runContextCommand({
+		fs: options.fs,
+		output: local,
+		json: false,
+		query: options.query,
+		maxChars: options.maxChars,
+		includeEvents: options.includeEvents,
+		includeChunks: options.includeChunks
+	});
+	const cloudExit = await runCloudContextCommand({
+		output: cloud,
+		json: false,
+		...options.config.cloud,
+		query: options.query ?? "project context",
+		maxBytes: options.maxChars
+	}).catch((error) => {
+		cloud.error(error instanceof Error ? error.message : String(error));
+		return 1;
+	});
+	const first = readPolicy === "cloud-first" ? {
+		label: "Cloud",
+		out: cloud,
+		code: cloudExit
+	} : {
+		label: "Local",
+		out: local,
+		code: localExit
+	};
+	const second = readPolicy === "cloud-first" ? {
+		label: "Local",
+		out: local,
+		code: localExit
+	} : {
+		label: "Cloud",
+		out: cloud,
+		code: cloudExit
+	};
+	if (options.json) {
+		printJsonEnvelope(options.output, "context", {
+			runtime: "hybrid",
+			readPolicy,
+			[first.label.toLowerCase()]: {
+				exitCode: first.code,
+				stdout: first.out.stdout,
+				stderr: first.out.stderr
+			},
+			[second.label.toLowerCase()]: {
+				exitCode: second.code,
+				stdout: second.out.stdout,
+				stderr: second.out.stderr
+			}
+		});
+		return first.code === 0 || second.code === 0 ? 0 : 1;
+	}
+	options.output.write([
+		`# TekMemo Hybrid Context`,
+		`Read policy: ${readPolicy}`,
+		"",
+		`## ${first.label} Context`,
+		...first.out.stdout,
+		"",
+		`## ${second.label} Context`,
+		...second.out.stdout
+	].join("\n"));
+	for (const line of [...first.out.stderr, ...second.out.stderr]) options.output.error(line);
+	return first.code === 0 || second.code === 0 ? 0 : 1;
+}
+async function runLocalRememberFromRuntime(options) {
+	return runRememberCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json,
+		content: options.content,
+		stdin: options.stdin,
+		file: options.file,
+		stdinContent: options.stdinContent,
+		kind: options.kind,
+		title: options.title,
+		tags: options.tags,
+		confidence: options.confidence,
+		source: options.source,
+		actor: options.actor,
+		metadata: options.metadata,
+		allowSecrets: options.allowSecrets
+	});
+}
+async function runCloudRememberFromRuntime(options) {
+	return runCloudRememberCommand({
+		output: options.output,
+		json: options.json,
+		rootDir: options.config.root,
+		stdinContent: options.stdinContent,
+		...options.config.cloud,
+		content: options.content,
+		stdin: options.stdin,
+		file: options.file,
+		kind: options.kind,
+		title: options.title,
+		tags: options.tags,
+		confidence: options.confidence,
+		source: options.source,
+		metadata: options.metadata,
+		allowSecrets: options.allowSecrets
+	});
+}
+async function runLocalReadFromRuntime(options) {
+	return runReadCommand({
+		fs: options.fs,
+		output: options.output,
+		json: options.json,
+		target: options.target
+	});
+}
+async function runCloudReadFromRuntime(options) {
+	if (options.target === "manifest") throw new Error("Cloud runtime cannot read local manifest. Use --runtime local or read core/notes.");
+	return runCloudReadCommand({
+		output: options.output,
+		json: options.json,
+		...options.config.cloud,
+		target: options.target
+	});
+}
+async function runReadPolicy(policy, local, cloud) {
+	if (policy === "local-only") return local();
+	if (policy === "cloud-only") return cloud();
+	if (policy === "cloud-first") {
+		const cloudCode = await cloud();
+		return cloudCode === 0 ? cloudCode : local();
+	}
+	const localCode = await local();
+	return localCode === 0 ? localCode : cloud();
+}
+async function runWritePolicy(policy, local, cloud) {
+	if (policy === "local-only") return local();
+	if (policy === "cloud-only") return cloud();
+	if (policy === "cloud-first") {
+		const cloudCode = await cloud();
+		const localCode = await local();
+		return cloudCode === 0 && localCode === 0 ? 0 : 1;
+	}
+	const localCode = await local();
+	const cloudCode = await cloud();
+	return localCode === 0 && cloudCode === 0 ? 0 : 1;
+}
+
+//#endregion
+//#region src/commands/search.ts
+async function runSearchCommand(options) {
+	const matches = [];
+	const filesToSearch = [
+		TEKMEMO_PATHS.coreMemory,
+		TEKMEMO_PATHS.notesMemory,
+		TEKMEMO_PATHS.conversations
+	];
+	let matcher;
+	if (options.regex) {
+		let pattern;
+		try {
+			pattern = new RegExp(options.query, "i");
+		} catch {
+			options.output.error(`Invalid regular expression: ${options.query}`);
+			return 1;
+		}
+		matcher = (line) => pattern.test(line);
+	} else {
+		const query = options.query.toLowerCase();
+		matcher = (line) => line.toLowerCase().includes(query);
+	}
+	for (const file of filesToSearch) {
+		const content = await options.fs.readTextIfExists(file);
+		if (!content) continue;
+		const lines = content.split(/\r?\n/);
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i];
+			if (line !== void 0 && matcher(line)) matches.push({
+				file,
+				line: i + 1,
+				content: line.trim()
+			});
+		}
+	}
+	if (options.json) {
+		options.output.write(JSON.stringify({
+			query: options.query,
+			matches
+		}, null, 2));
+		return 0;
+	}
+	if (matches.length === 0) {
+		options.output.write(`No matches found for "${options.query}".`);
+		return 0;
+	}
+	for (const match of matches) options.output.write(`${match.file}:${match.line}: ${match.content}`);
+	options.output.success(`Found ${matches.length} match(es).`);
+	return 0;
+}
+
+//#endregion
+//#region src/runner.ts
+const pkg = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)("../package.json");
+const parsePositiveOption = parsePositiveInteger;
+const parseNonNegativeOption = parseNonNegativeInteger;
+function createFs(root) {
+	return new TekMemoFileSystem({ rootDir: root });
+}
+async function runTekMemoCli(input) {
+	const output = input.output ?? createBufferedOutput(input.noColor === void 0 ? void 0 : { noColor: input.noColor });
+	let exitCode = 0;
+	let currentCommand = "tekmemo";
+	let wantsJson = input.argv.includes("--json") || input.argv.includes("-j");
+	const program = new commander.Command();
+	program.name("tekmemo").description("Production-grade CLI for TekMemo .tekmemo/ memory, context, validation, snapshots, and agent tools.").version(pkg.version).option("-r, --root <path>", "project root containing .tekmemo/", input.cwd ?? process.cwd()).option("--runtime <mode>", "runtime mode: local, cloud, or hybrid").option("--cloud-url <url>", "TekMemo Cloud API URL; defaults to config or TEKMEMO_CLOUD_URL").option("--api-key <key>", "TekMemo Cloud API key; defaults to TEKMEMO_API_KEY").option("--workspace-id <id>", "default cloud workspace ID").option("--project-id <id>", "default cloud project ID").option("--timeout-ms <n>", "cloud request timeout in milliseconds", parsePositiveOption).option("--read-policy <policy>", "hybrid read policy: local-first, cloud-first, local-only, cloud-only").option("--write-policy <policy>", "hybrid write policy: local-first, cloud-first, local-only, cloud-only").option("-j, --json", "output machine-readable JSON", false).option("-v, --verbose", "show detailed output", input.verbose ?? false).option("-q, --quiet", "suppress all output except errors", input.quiet ?? false).option("--no-color", "disable colored output", input.noColor ?? false).exitOverride().showHelpAfterError().configureOutput({
+		writeOut: (str) => {
+			if (!program.opts().quiet) output.write(str.trim());
+		},
+		writeErr: (str) => output.error(str.trim()),
+		getOutHelpWidth: () => 100,
+		getErrHelpWidth: () => 100
+	});
+	async function globals() {
+		const opts = program.opts();
+		wantsJson = Boolean(opts.json);
+		const config = await resolveCliRuntimeConfig({
+			cwd: input.cwd ?? process.cwd(),
+			flags: {
+				root: opts.root,
+				runtime: opts.runtime,
+				cloudUrl: opts.cloudUrl,
+				apiKey: opts.apiKey,
+				workspaceId: opts.workspaceId,
+				projectId: opts.projectId,
+				timeoutMs: opts.timeoutMs,
+				readPolicy: opts.readPolicy,
+				writePolicy: opts.writePolicy
+			}
+		});
+		return {
+			root: config.root,
+			json: Boolean(opts.json),
+			verbose: Boolean(opts.verbose),
+			quiet: Boolean(opts.quiet),
+			config
+		};
+	}
+	program.command("init").description("initialize canonical .tekmemo/ files").option("-f, --force", "overwrite existing seed files", false).option("-p, --project-id <id>", "explicit project ID").option("--no-input", "skip interactive prompts", false).action(async (options) => {
+		currentCommand = "init";
+		const g = await globals();
+		exitCode = await runInitCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			force: options.force,
+			projectId: options.projectId,
+			noInput: options.noInput ?? !process.stdout.isTTY
+		});
+	});
+	program.command("inspect").description("summarize local TekMemo memory state").action(async () => {
+		currentCommand = "inspect";
+		const g = await globals();
+		exitCode = await runInspectCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json
+		});
+	});
+	program.command("context").description("pack project memory into an agent-friendly context block").option("-q, --query <query>", "prioritize lines matching a task/query").option("--max-chars <n>", "maximum output characters", parsePositiveOption, 12e3).option("--include-events", "include recent memory events", false).option("--include-chunks", "include recent chunk records", false).action(async (options) => {
+		currentCommand = "context";
+		const g = await globals();
+		exitCode = await runRuntimeContextCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			config: g.config,
+			query: options.query,
+			maxChars: options.maxChars,
+			includeEvents: options.includeEvents,
+			includeChunks: options.includeChunks
+		});
+	});
+	program.command("remember").description("store a durable note for humans or coding agents").argument("[content]", "memory content").option("--stdin", "read memory content from stdin", false).option("--file <path>", "read memory content from a file inside the selected root").option("-k, --kind <kind>", "decision | constraint | goal | preference | reference | summary | note", "note").option("--title <title>", "optional note title").option("-t, --tag <tag>", "tag to attach; repeatable", collect, []).option("--confidence <n>", "confidence from 0 to 1").option("--source <source>", "source identifier, file, URL, or agent name").option("--actor <actor>", "actor type or type:id, e.g. agent:claude-code", "user").option("--metadata-json <json>", "metadata JSON object").option("--allow-secrets", "allow content that looks like a secret after manual review", false).action(async (content, options) => {
+		currentCommand = "remember";
+		const g = await globals();
+		exitCode = await runRuntimeRememberCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			config: g.config,
+			content,
+			stdin: options.stdin,
+			file: options.file,
+			stdinContent: input.stdinContent,
+			kind: options.kind,
+			title: options.title,
+			tags: options.tag,
+			confidence: options.confidence,
+			source: options.source,
+			actor: options.actor,
+			metadata: options.metadataJson,
+			allowSecrets: options.allowSecrets
+		});
+	});
+	program.command("read").description("read a canonical memory document").argument("<target>", "core | notes | manifest").action(async (target) => {
+		currentCommand = "read";
+		const g = await globals();
+		if (target !== "core" && target !== "notes" && target !== "manifest") {
+			output.error("read target must be core, notes, or manifest");
+			exitCode = 1;
+			return;
+		}
+		exitCode = await runRuntimeReadCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			config: g.config,
+			target
+		});
+	});
+	program.command("events").description("read memory event log").option("-l, --limit <n>", "limit number of events", parseNonNegativeOption, 0).option("-s, --strict", "strict protocol validation", false).action(async (options) => {
+		currentCommand = "events";
+		const g = await globals();
+		exitCode = await runEventsCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			limit: options.limit,
+			strict: options.strict
+		});
+	});
+	program.command("chunks").description("read local chunk index").option("-l, --limit <n>", "limit number of chunks", parseNonNegativeOption, 0).option("-s, --strict", "strict protocol validation", false).action(async (options) => {
+		currentCommand = "chunks";
+		const g = await globals();
+		exitCode = await runChunksCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			limit: options.limit,
+			strict: options.strict
+		});
+	});
+	program.command("snapshot").description("create local memory snapshot bundle").option("-l, --label <name>", "snapshot label", "manual").action(async (options) => {
+		currentCommand = "snapshot";
+		const g = await globals();
+		exitCode = await runRuntimeSnapshotCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			config: g.config,
+			label: options.label
+		});
+	});
+	program.command("doctor").description("find missing or corrupt memory files").option("-s, --strict", "strict protocol validation", false).action(async (options) => {
+		currentCommand = "doctor";
+		const g = await globals();
+		exitCode = await runDoctorCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			strict: options.strict
+		});
+	});
+	program.command("validate").description("strict protocol validation for CI").action(async () => {
+		currentCommand = "validate";
+		const g = await globals();
+		exitCode = await runRuntimeValidateCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			config: g.config
+		});
+	});
+	program.command("search").description("search memory files for a query").argument("<query>", "text to search for").option("-e, --regex", "treat query as a regular expression", false).action(async (query, options) => {
+		currentCommand = "search";
+		const g = await globals();
+		exitCode = await runSearchCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			query,
+			regex: options.regex
+		});
+	});
+	program.command("edit").description("legacy alias: append a note or core memory text").argument("<type>", "note or core").argument("<message>", "content to append").option("--allow-secrets", "allow content that looks like a secret after manual review", false).action(async (type, message, options) => {
+		currentCommand = "edit";
+		const g = await globals();
+		if (type !== "note" && type !== "core") {
+			output.error("Edit type must be 'note' or 'core'");
+			exitCode = 1;
+			return;
+		}
+		exitCode = await runEditCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			type,
+			message,
+			allowSecrets: options.allowSecrets
+		});
+	});
+	program.command("diff").description("compare two memory snapshots by ID or label").argument("<labelA>", "first snapshot ID or label").argument("<labelB>", "second snapshot ID or label").action(async (labelA, labelB) => {
+		currentCommand = "diff";
+		const g = await globals();
+		exitCode = await runDiffCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			labelA,
+			labelB
+		});
+	});
+	const agent = program.command("agent").description("manage AgentFS-backed TekMemo coding sessions");
+	agent.command("start").description("start an AgentFS-style workspace for Codex, Claude Code, or another coding agent").requiredOption("--task <task>", "agent task or brief").option("--project <id>", "project ID").option("--actor <id>", "actor ID, e.g. assistant:codex").option("--session <id>", "explicit safe session ID").action(async (options) => {
+		currentCommand = "agent.start";
+		const g = await globals();
+		exitCode = await runAgentStartCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			task: options.task,
+			projectId: options.project ?? g.config.cloud.projectId,
+			actorId: options.actor,
+			sessionId: options.session
+		});
+	});
+	agent.command("paths").description("print paths for the latest or selected agent session").option("--session <id>", "session ID or latest", "latest").action(async (options) => {
+		currentCommand = "agent.paths";
+		const g = await globals();
+		exitCode = await runAgentPathsCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			session: options.session
+		});
+	});
+	agent.command("extract").description("extract summary, durable memory, and follow-ups from an agent session").option("--session <id>", "session ID or latest", "latest").action(async (options) => {
+		currentCommand = "agent.extract";
+		const g = await globals();
+		exitCode = await runAgentExtractCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			session: options.session
+		});
+	});
+	agent.command("complete").description("complete an agent session and optionally persist durable memory").option("--session <id>", "session ID or latest", "latest").option("--extract", "append output/durable-memory.md to TekMemo notes", false).option("--checkpoint-label <label>", "checkpoint label").action(async (options) => {
+		currentCommand = "agent.complete";
+		const g = await globals();
+		exitCode = await runAgentCompleteCommand({
+			fs: createFs(g.root),
+			output,
+			json: g.json,
+			session: options.session,
+			extract: options.extract,
+			checkpointLabel: options.checkpointLabel
+		});
+	});
+	const cloud = program.command("cloud").description("use TekMemo Cloud through @tekmemo/cloud-client").option("--cloud-url <url>", "TekMemo Cloud API URL; defaults to TEKMEMO_CLOUD_URL or TEKMEMO_API_URL").option("--api-key <key>", "TekMemo Cloud API key; defaults to TEKMEMO_API_KEY").option("--workspace-id <id>", "default cloud workspace ID; defaults to TEKMEMO_WORKSPACE_ID").option("--project-id <id>", "default cloud project ID; defaults to TEKMEMO_PROJECT_ID").option("--timeout-ms <n>", "cloud request timeout in milliseconds", parsePositiveOption);
+	async function cloudGlobals() {
+		const g = await globals();
+		const opts = cloud.opts();
+		return {
+			...g,
+			cloudUrl: opts.cloudUrl ?? g.config.cloud.cloudUrl,
+			apiKey: opts.apiKey ?? g.config.cloud.apiKey,
+			workspaceId: opts.workspaceId ?? g.config.cloud.workspaceId,
+			projectId: opts.projectId ?? g.config.cloud.projectId,
+			timeoutMs: opts.timeoutMs ?? g.config.cloud.timeoutMs
+		};
+	}
+	cloud.command("health").description("check TekMemo Cloud health").action(async () => {
+		currentCommand = "cloud.health";
+		const g = await cloudGlobals();
+		exitCode = await runCloudHealthCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs
+		});
+	});
+	cloud.command("context").description("pack cloud memory into an agent-friendly context block").requiredOption("-q, --query <query>", "task/query used to build context").option("-l, --limit <n>", "maximum recall items", parsePositiveOption).option("--max-bytes <n>", "maximum response bytes", parsePositiveOption).option("--include-core", "include core memory", true).option("--include-notes", "include notes memory", true).option("--include-recent", "include recent memory", true).action(async (options) => {
+		currentCommand = "cloud.context";
+		const g = await cloudGlobals();
+		exitCode = await runCloudContextCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			query: options.query,
+			limit: options.limit,
+			maxBytes: options.maxBytes,
+			includeCore: options.includeCore,
+			includeNotes: options.includeNotes,
+			includeRecent: options.includeRecent
+		});
+	});
+	cloud.command("recall").description("search TekMemo Cloud memory").argument("<query>", "text to search for").option("-l, --limit <n>", "maximum recall items", parsePositiveOption).option("--strategy <strategy>", "local | vector | hybrid").option("--fallback <mode>", "none | local").option("--rerank", "request reranking", false).action(async (query, options) => {
+		currentCommand = "cloud.recall";
+		const g = await cloudGlobals();
+		exitCode = await runCloudRecallCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			query,
+			limit: options.limit,
+			strategy: options.strategy,
+			fallback: options.fallback,
+			rerank: options.rerank
+		});
+	});
+	cloud.command("index").description("request TekMemo Cloud recall indexing for the project").option("--mode <mode>", "all | changed | core | notes", "changed").option("--force", "force re-indexing", false).action(async (options) => {
+		currentCommand = "cloud.index";
+		const g = await cloudGlobals();
+		exitCode = await runCloudRecallIndexCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			mode: options.mode,
+			force: options.force
+		});
+	});
+	cloud.command("remember").description("store durable memory in TekMemo Cloud").argument("[content]", "memory content").option("--stdin", "read memory content from stdin", false).option("--file <path>", "read memory content from a file inside the selected root").option("-k, --kind <kind>", "decision | constraint | goal | preference | reference | summary | note", "note").option("--title <title>", "optional note title").option("-t, --tag <tag>", "tag to attach; repeatable", collect, []).option("--confidence <n>", "confidence from 0 to 1").option("--source <source>", "source identifier, file, URL, or agent name").option("--metadata-json <json>", "metadata JSON object").option("--allow-secrets", "allow content that looks like a secret after manual review", false).action(async (content, options) => {
+		currentCommand = "cloud.remember";
+		const g = await cloudGlobals();
+		exitCode = await runCloudRememberCommand({
+			output,
+			json: g.json,
+			rootDir: g.root,
+			stdinContent: input.stdinContent,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			content,
+			stdin: options.stdin,
+			file: options.file,
+			kind: options.kind,
+			title: options.title,
+			tags: options.tag,
+			confidence: options.confidence,
+			source: options.source,
+			metadata: options.metadataJson,
+			allowSecrets: options.allowSecrets
+		});
+	});
+	cloud.command("read").description("read a TekMemo Cloud memory document").argument("<target>", "core | notes").option("-l, --limit <n>", "maximum notes when target is notes", parsePositiveOption).action(async (target, options) => {
+		currentCommand = "cloud.read";
+		const g = await cloudGlobals();
+		if (target !== "core" && target !== "notes") {
+			output.error("cloud read target must be core or notes");
+			exitCode = 1;
+			return;
+		}
+		exitCode = await runCloudReadCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			target,
+			limit: options.limit
+		});
+	});
+	cloud.command("update-core").description("replace TekMemo Cloud core memory").argument("[content]", "new core memory content").option("--stdin", "read core memory from stdin", false).option("--file <path>", "read core memory from a file inside the selected root").option("--allow-secrets", "allow content that looks like a secret after manual review", false).action(async (content, options) => {
+		currentCommand = "cloud.update-core";
+		const g = await cloudGlobals();
+		exitCode = await runCloudUpdateCoreCommand({
+			output,
+			json: g.json,
+			rootDir: g.root,
+			stdinContent: input.stdinContent,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			content,
+			stdin: options.stdin,
+			file: options.file,
+			allowSecrets: options.allowSecrets
+		});
+	});
+	cloud.command("recent").description("list recent TekMemo Cloud memory events").option("-l, --limit <n>", "maximum recent items", parsePositiveOption).action(async (options) => {
+		currentCommand = "cloud.recent";
+		const g = await cloudGlobals();
+		exitCode = await runCloudRecentCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			limit: options.limit
+		});
+	});
+	cloud.command("validate").description("validate TekMemo Cloud memory").option("-s, --strict", "strict protocol validation", false).action(async (options) => {
+		currentCommand = "cloud.validate";
+		const g = await cloudGlobals();
+		exitCode = await runCloudValidateCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			strict: options.strict
+		});
+	});
+	cloud.command("snapshot").description("explain TekMemo Cloud snapshot availability").option("-l, --label <name>", "snapshot label", "manual").option("--type <type>", "manual | automatic | pre-sync | pre-restore", "manual").action(async (options) => {
+		currentCommand = "cloud.snapshot";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSnapshotCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			label: options.label,
+			type: options.type
+		});
+	});
+	const sync = cloud.command("sync").description("use TekMemo Cloud memory sync APIs");
+	sync.command("status").description("read cloud sync status").option("--client-id <id>", "optional sync client ID").action(async (options) => {
+		currentCommand = "cloud.sync.status";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSyncStatusCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			clientId: options.clientId
+		});
+	});
+	sync.command("pull").description("pull cloud sync events").requiredOption("--client-id <id>", "sync client ID").option("--since-server-version <n>", "pull events after this server version", parseNonNegativeOption).option("-l, --limit <n>", "maximum events to return", parsePositiveOption).action(async (options) => {
+		currentCommand = "cloud.sync.pull";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSyncPullCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			clientId: options.clientId,
+			sinceServerVersion: options.sinceServerVersion,
+			limit: options.limit
+		});
+	});
+	sync.command("push").description("push local sync events to TekMemo Cloud").requiredOption("--client-id <id>", "sync client ID").option("--events-json <json>", "event array or object with events array").option("--checkpoint-json <json>", "optional checkpoint JSON object").option("--stdin", "read events JSON from stdin", false).option("--file <path>", "read events JSON from a file inside the selected root").action(async (options) => {
+		currentCommand = "cloud.sync.push";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSyncPushCommand({
+			output,
+			json: g.json,
+			rootDir: g.root,
+			stdinContent: input.stdinContent,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			clientId: options.clientId,
+			eventsJson: options.eventsJson,
+			checkpointJson: options.checkpointJson,
+			stdin: options.stdin,
+			file: options.file
+		});
+	});
+	sync.command("resolve").description("resolve a cloud sync conflict").argument("<conflictId>", "conflict ID").requiredOption("--resolution <resolution>", "keep_cloud | use_client | ignore").option("--content-json <json>", "optional resolution content JSON object").action(async (conflictId, options) => {
+		currentCommand = "cloud.sync.resolve";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSyncResolveCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			conflictId,
+			resolution: options.resolution,
+			contentJson: options.contentJson
+		});
+	});
+	cloud.command("readiness").description("check TekMemo Cloud readiness").action(async () => {
+		currentCommand = "cloud.readiness";
+		const g = await cloudGlobals();
+		exitCode = await runCloudReadinessCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs
+		});
+	});
+	cloud.command("context-compose").description("compose full context package from cloud").requiredOption("-q, --query <query>", "task/query used to build context").option("-l, --limit <n>", "maximum recall items", parsePositiveOption).option("--strategy <strategy>", "auto | vector | local").option("--rerank", "request reranking", false).option("--include-core-memory", "include core memory", true).option("--include-recall-results", "include recall results", true).option("--include-graph-context", "include graph context", true).action(async (options) => {
+		currentCommand = "cloud.context-compose";
+		const g = await cloudGlobals();
+		exitCode = await runCloudContextComposeCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			query: options.query,
+			topK: options.limit,
+			strategy: options.strategy,
+			rerank: options.rerank,
+			includeCoreMemory: options.includeCoreMemory,
+			includeRecallResults: options.includeRecallResults,
+			includeGraphContext: options.includeGraphContext
+		});
+	});
+	const graph = cloud.command("graph").description("graph memory operations");
+	graph.command("list-nodes").description("list graph nodes").option("-l, --limit <n>", "maximum nodes to return", parsePositiveOption).option("--cursor <string>", "pagination cursor").option("--status <status>", "active | deprecated | conflicted | deleted").action(async (options) => {
+		currentCommand = "cloud.graph.list-nodes";
+		const g = await cloudGlobals();
+		exitCode = await runCloudGraphListNodesCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			limit: options.limit,
+			cursor: options.cursor,
+			status: options.status
+		});
+	});
+	graph.command("create-node").description("create a graph node").requiredOption("--node-id <id>", "node ID").requiredOption("--type <type>", "node type").requiredOption("--label <label>", "node label").option("--summary <summary>", "node summary").option("--aliases <aliases>", "comma-separated aliases").option("--metadata-json <json>", "metadata JSON object").action(async (options) => {
+		currentCommand = "cloud.graph.create-node";
+		const g = await cloudGlobals();
+		const aliases = options.aliases ? options.aliases.split(",").map((s) => s.trim()) : void 0;
+		exitCode = await runCloudGraphCreateNodeCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			nodeId: options.nodeId,
+			type: options.type,
+			label: options.label,
+			summary: options.summary,
+			aliases,
+			metadataJson: options.metadataJson
+		});
+	});
+	graph.command("list-edges").description("list graph edges").option("-l, --limit <n>", "maximum edges to return", parsePositiveOption).option("--cursor <string>", "pagination cursor").option("--status <status>", "active | deprecated | conflicted | deleted").action(async (options) => {
+		currentCommand = "cloud.graph.list-edges";
+		const g = await cloudGlobals();
+		exitCode = await runCloudGraphListEdgesCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			limit: options.limit,
+			cursor: options.cursor,
+			status: options.status
+		});
+	});
+	graph.command("create-edge").description("create a graph edge").option("--edge-id <id>", "edge ID").requiredOption("--from <id>", "from node ID").requiredOption("--to <id>", "to node ID").requiredOption("--type <type>", "edge type").option("--directed", "directed edge", true).option("--weight <n>", "edge weight (0-1)", parsePositiveOption).option("--metadata-json <json>", "metadata JSON object").action(async (options) => {
+		currentCommand = "cloud.graph.create-edge";
+		const g = await cloudGlobals();
+		exitCode = await runCloudGraphCreateEdgeCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			edgeId: options.edgeId,
+			fromNodeId: options.from,
+			toNodeId: options.to,
+			type: options.type,
+			directed: options.directed,
+			weight: options.weight,
+			metadataJson: options.metadataJson
+		});
+	});
+	graph.command("neighbors").description("find graph neighbors").requiredOption("--node-id <id>", "seed node ID").option("--direction <dir>", "in | out | both").option("--depth <n>", "search depth", parsePositiveOption).option("-l, --limit <n>", "maximum results", parsePositiveOption).action(async (options) => {
+		currentCommand = "cloud.graph.neighbors";
+		const g = await cloudGlobals();
+		exitCode = await runCloudGraphNeighborsCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			nodeId: options.nodeId,
+			direction: options.direction,
+			depth: options.depth,
+			limit: options.limit
+		});
+	});
+	graph.command("path").description("find graph path between nodes").requiredOption("--from <id>", "start node ID").requiredOption("--to <id>", "target node ID").option("--max-depth <n>", "maximum search depth", parsePositiveOption).action(async (options) => {
+		currentCommand = "cloud.graph.path";
+		const g = await cloudGlobals();
+		exitCode = await runCloudGraphPathCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			fromNodeId: options.from,
+			toNodeId: options.to,
+			maxDepth: options.maxDepth
+		});
+	});
+	const extraction = cloud.command("extraction").description("extraction operations");
+	extraction.command("run").description("run graph extraction").option("--mode <mode>", "full | core | notes | sync | connectors").option("--force", "force re-extraction", false).action(async (options) => {
+		currentCommand = "cloud.extraction.run";
+		const g = await cloudGlobals();
+		exitCode = await runCloudExtractionRunCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			mode: options.mode,
+			force: options.force
+		});
+	});
+	extraction.command("jobs").description("list extraction jobs").option("-l, --limit <n>", "maximum jobs to return", parsePositiveOption).action(async (options) => {
+		currentCommand = "cloud.extraction.jobs";
+		const g = await cloudGlobals();
+		exitCode = await runCloudExtractionJobsCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			limit: options.limit
+		});
+	});
+	cloud.command("evals").description("run context quality evals").option("--fixture-ids <ids>", "comma-separated fixture IDs").option("--iterations <n>", "number of iterations", parsePositiveOption).option("--thresholds-json <json>", "thresholds JSON object").action(async (options) => {
+		currentCommand = "cloud.evals.run";
+		const g = await cloudGlobals();
+		exitCode = await runCloudEvalsRunCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			fixtureIds: options.fixtureIds,
+			iterations: options.iterations,
+			thresholdsJson: options.thresholdsJson
+		});
+	});
+	cloud.command("benchmarks").description("run context benchmarks").option("--fixture-ids <ids>", "comma-separated fixture IDs").option("--iterations <n>", "number of iterations", parsePositiveOption).option("--thresholds-json <json>", "thresholds JSON object").action(async (options) => {
+		currentCommand = "cloud.benchmarks.run";
+		const g = await cloudGlobals();
+		exitCode = await runCloudBenchmarksRunCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			fixtureIds: options.fixtureIds,
+			iterations: options.iterations,
+			thresholdsJson: options.thresholdsJson
+		});
+	});
+	const exports = cloud.command("exports").description("export operations");
+	exports.command("create").description("create memory export").option("--label <name>", "export label").action(async (options) => {
+		currentCommand = "cloud.exports.create";
+		const g = await cloudGlobals();
+		exitCode = await runCloudExportsCreateCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			label: options.label
+		});
+	});
+	exports.command("download").description("download export archive").requiredOption("--export-id <id>", "export ID").action(async (options) => {
+		currentCommand = "cloud.exports.download";
+		const g = await cloudGlobals();
+		exitCode = await runCloudExportsDownloadCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			exportId: options.exportId
+		});
+	});
+	const snapshots = cloud.command("snapshots").description("snapshot operations");
+	snapshots.command("create").description("create memory snapshot").option("--label <name>", "snapshot label").option("--trigger <trigger>", "manual | sync | system").action(async (options) => {
+		currentCommand = "cloud.snapshots.create";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSnapshotsCreateCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			label: options.label,
+			trigger: options.trigger
+		});
+	});
+	snapshots.command("download").description("download snapshot archive").requiredOption("--snapshot-id <id>", "snapshot ID").action(async (options) => {
+		currentCommand = "cloud.snapshots.download";
+		const g = await cloudGlobals();
+		exitCode = await runCloudSnapshotsDownloadCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			snapshotId: options.snapshotId
+		});
+	});
+	const providers = cloud.command("providers").description("provider operations");
+	providers.command("list").description("list provider credentials").action(async () => {
+		currentCommand = "cloud.providers.list";
+		const g = await cloudGlobals();
+		exitCode = await runCloudProvidersListCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs
+		});
+	});
+	providers.command("create").description("create provider credential").requiredOption("--provider <provider>", "voyageai | openai | upstash-vector").requiredOption("--key-name <name>", "key name").requiredOption("--secret <secret>", "provider secret").option("--rest-url <url>", "REST URL (required for upstash-vector)").option("--embedding-model <model>", "embedding model").option("--rerank-model <model>", "rerank model").action(async (options) => {
+		currentCommand = "cloud.providers.create";
+		const g = await cloudGlobals();
+		exitCode = await runCloudProvidersCreateCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			provider: options.provider,
+			keyName: options.keyName,
+			secret: options.secret,
+			restUrl: options.restUrl,
+			embeddingModel: options.embeddingModel,
+			rerankModel: options.rerankModel
+		});
+	});
+	providers.command("test").description("test provider credential").requiredOption("--credential-id <id>", "credential ID").action(async (options) => {
+		currentCommand = "cloud.providers.test";
+		const g = await cloudGlobals();
+		exitCode = await runCloudProvidersTestCommand({
+			output,
+			json: g.json,
+			cloudUrl: g.cloudUrl,
+			apiKey: g.apiKey,
+			workspaceId: g.workspaceId,
+			projectId: g.projectId,
+			timeoutMs: g.timeoutMs,
+			credentialId: options.credentialId
+		});
+	});
+	const config = program.command("config").description("inspect or create .tekmemo/config.json");
+	config.command("get").description("print resolved CLI configuration").action(async () => {
+		currentCommand = "config.get";
+		const g = await globals();
+		const safeConfig = {
+			...g.config,
+			cloud: {
+				...g.config.cloud,
+				apiKey: g.config.cloud.apiKey ? "<redacted>" : void 0
+			}
+		};
+		if (g.json) printJsonEnvelope(output, "config.get", safeConfig);
+		else output.write(JSON.stringify(safeConfig, null, 2));
+	});
+	config.command("init").description("create .tekmemo/config.json without storing secrets").option("-f, --force", "overwrite existing config", false).option("--runtime <mode>", "runtime mode: local, cloud, or hybrid", "local").option("--cloud-url <url>", "TekMemo Cloud API URL").option("--workspace-id <id>", "cloud workspace ID").option("--project-id <id>", "cloud project ID").option("--read-policy <policy>", "hybrid read policy", "local-first").option("--write-policy <policy>", "hybrid write policy", "local-first").action(async (options) => {
+		currentCommand = "config.init";
+		const g = await globals();
+		const result = await writeDefaultCliConfig({
+			cwd: input.cwd ?? process.cwd(),
+			root: g.root,
+			force: options.force,
+			config: {
+				version: 1,
+				runtime: options.runtime,
+				root: ".",
+				cloud: {
+					...options.cloudUrl ? { baseUrl: options.cloudUrl } : {},
+					...options.workspaceId ? { workspaceId: options.workspaceId } : {},
+					...options.projectId ? { projectId: options.projectId } : {}
+				},
+				hybrid: {
+					readPolicy: options.readPolicy,
+					writePolicy: options.writePolicy
+				}
+			}
+		});
+		if (g.json) printJsonEnvelope(output, "config.init", result);
+		else if (result.created) output.success(`Created ${result.path}`);
+		else if (result.overwritten) output.success(`Overwrote ${result.path}`);
+		else output.warn(`${result.path} already exists. Use --force to overwrite.`);
+	});
+	try {
+		const args = normalizeArgv(input.argv);
+		await program.parseAsync(args);
+		return {
+			exitCode,
+			stdout: output.stdout,
+			stderr: output.stderr
+		};
+	} catch (error) {
+		if (error instanceof CliError) {
+			exitCode = error.exitCode;
+			if (wantsJson) printJsonError(output, currentCommand, error.code, error.message);
+			else output.error(error.message);
+		} else if (isCommanderError(error)) exitCode = typeof error.exitCode === "number" ? error.exitCode : 1;
+		else {
+			exitCode = 1;
+			const message = error instanceof Error ? error.message : String(error);
+			if (wantsJson) printJsonError(output, currentCommand, "CLI_UNEXPECTED_ERROR", message);
+			else output.error(message);
+		}
+		return {
+			exitCode,
+			stdout: output.stdout,
+			stderr: output.stderr
+		};
+	}
+}
+function collect(value, previous) {
+	previous.push(value);
+	return previous;
+}
+function normalizeArgv(argv) {
+	if (argv.length > 0 && !argv[0]?.endsWith("node") && !argv[0]?.includes("/") && argv[0] !== "tekmemo") return [
+		"node",
+		"tekmemo",
+		...argv
+	];
+	if (argv[0] === "tekmemo") return ["node", ...argv];
+	return [...argv];
+}
+function isCommanderError(error) {
+	return error instanceof commander.CommanderError;
+}
+
+//#endregion
+Object.defineProperty(exports, 'CliError', {
+  enumerable: true,
+  get: function () {
+    return CliError;
+  }
+});
+Object.defineProperty(exports, 'CliFsError', {
+  enumerable: true,
+  get: function () {
+    return CliFsError;
+  }
+});
+Object.defineProperty(exports, 'CliJsonlError', {
+  enumerable: true,
+  get: function () {
+    return CliJsonlError;
+  }
+});
+Object.defineProperty(exports, 'CliProtocolError', {
+  enumerable: true,
+  get: function () {
+    return CliProtocolError;
+  }
+});
+Object.defineProperty(exports, 'CliUsageError', {
+  enumerable: true,
+  get: function () {
+    return CliUsageError;
+  }
+});
+Object.defineProperty(exports, 'CliValidationError', {
+  enumerable: true,
+  get: function () {
+    return CliValidationError;
+  }
+});
+Object.defineProperty(exports, 'REQUIRED_DIRS', {
+  enumerable: true,
+  get: function () {
+    return REQUIRED_DIRS;
+  }
+});
+Object.defineProperty(exports, 'REQUIRED_FILES', {
+  enumerable: true,
+  get: function () {
+    return REQUIRED_FILES;
+  }
+});
+Object.defineProperty(exports, 'TEKMEMO_PATHS', {
+  enumerable: true,
+  get: function () {
+    return TEKMEMO_PATHS;
+  }
+});
+Object.defineProperty(exports, 'TekMemoFileSystem', {
+  enumerable: true,
+  get: function () {
+    return TekMemoFileSystem;
+  }
+});
+Object.defineProperty(exports, 'cloudConnectionSummary', {
+  enumerable: true,
+  get: function () {
+    return cloudConnectionSummary;
+  }
+});
+Object.defineProperty(exports, 'createBufferedOutput', {
+  enumerable: true,
+  get: function () {
+    return createBufferedOutput;
+  }
+});
+Object.defineProperty(exports, 'createCliCloudClient', {
+  enumerable: true,
+  get: function () {
+    return createCliCloudClient;
+  }
+});
+Object.defineProperty(exports, 'createDefaultManifest', {
+  enumerable: true,
+  get: function () {
+    return createDefaultManifest;
+  }
+});
+Object.defineProperty(exports, 'createSafeIdFromLabel', {
+  enumerable: true,
+  get: function () {
+    return createSafeIdFromLabel;
+  }
+});
+Object.defineProperty(exports, 'formatCloudError', {
+  enumerable: true,
+  get: function () {
+    return formatCloudError;
+  }
+});
+Object.defineProperty(exports, 'inspectTekMemo', {
+  enumerable: true,
+  get: function () {
+    return inspectTekMemo;
+  }
+});
+Object.defineProperty(exports, 'normalizeCloudConnectionOptions', {
+  enumerable: true,
+  get: function () {
+    return normalizeCloudConnectionOptions;
+  }
+});
+Object.defineProperty(exports, 'parseJsonl', {
+  enumerable: true,
+  get: function () {
+    return parseJsonl;
+  }
+});
+Object.defineProperty(exports, 'parseManifest', {
+  enumerable: true,
+  get: function () {
+    return parseManifest;
+  }
+});
+Object.defineProperty(exports, 'printHumanOrJson', {
+  enumerable: true,
+  get: function () {
+    return printHumanOrJson;
+  }
+});
+Object.defineProperty(exports, 'printJsonEnvelope', {
+  enumerable: true,
+  get: function () {
+    return printJsonEnvelope;
+  }
+});
+Object.defineProperty(exports, 'printJsonError', {
+  enumerable: true,
+  get: function () {
+    return printJsonError;
+  }
+});
+Object.defineProperty(exports, 'redactSecretPreview', {
+  enumerable: true,
+  get: function () {
+    return redactSecretPreview;
+  }
+});
+Object.defineProperty(exports, 'resolveCliRuntimeConfig', {
+  enumerable: true,
+  get: function () {
+    return resolveCliRuntimeConfig;
+  }
+});
+Object.defineProperty(exports, 'runTekMemoCli', {
+  enumerable: true,
+  get: function () {
+    return runTekMemoCli;
+  }
+});
+Object.defineProperty(exports, 'scanForSecrets', {
+  enumerable: true,
+  get: function () {
+    return scanForSecrets;
+  }
+});
+Object.defineProperty(exports, 'stringifyJsonl', {
+  enumerable: true,
+  get: function () {
+    return stringifyJsonl;
+  }
+});
+Object.defineProperty(exports, 'toCloudClientOptions', {
+  enumerable: true,
+  get: function () {
+    return toCloudClientOptions;
+  }
+});
+Object.defineProperty(exports, 'validateManifest', {
+  enumerable: true,
+  get: function () {
+    return validateManifest;
+  }
+});
+Object.defineProperty(exports, 'validateSnapshotLabel', {
+  enumerable: true,
+  get: function () {
+    return validateSnapshotLabel;
+  }
+});
+Object.defineProperty(exports, 'writeDefaultCliConfig', {
+  enumerable: true,
+  get: function () {
+    return writeDefaultCliConfig;
+  }
+});
+//# sourceMappingURL=runner-CiA5dFku.cjs.map